Loading
D2R.ORGThe short version: we collect only what the features you use need, we never sell or share it for advertising, there are no trackers, and you can delete your account yourself. Everything we do keep is listed below, with how long it lives. Terms of Use · Copyright and Takedowns
D2R.ORG runs D2R.ORG at d2r.org (“the site”, “we”). We are the controller of the personal data described here. This policy covers the site and the e-mails it sends. It does not cover YouTube, Discord, Blizzard's services or any other site we link to; each has its own policy.
The site is a free fan project. It has no advertising, no analytics service, no tracking pixels and no social-media widgets, and we never sell, rent or trade personal data. We collect only what the features you use need, and this page lists all of it.
Reading the site needs no account and sets no identifying cookie. Two things happen on every visit:
Your browser stores two things locally: your light-or-dark theme choice, and, for the offline page and faster repeat visits, a cache of pages and images kept by the site's service worker. Both stay on your device, are never sent to us, and are cleared when you clear site data.
Creating an account adds the following. Each row says what it is for and how long we keep it.
| What | Why | Kept |
|---|---|---|
| E-mail address | to confirm the account, to sign in, to reset a password, and to send the account mails below. Never shown to anyone. | until you delete the account |
| Forum name, password | your public name; the password is stored only as a salted scrypt hash and cannot be read back. | until you delete the account |
| Sign-in sessions: a hash of the session token, the network address and user agent at sign-in | to keep you signed in, to show you your active sessions and let you end them, and to spot a stolen session. | 30 days, or until you sign out |
| Profile: avatar, signature, wallpaper, about text, profile page, characters, grail progress, settings | what you choose to show on the forum. Uploaded images are stored in our database. | until you change or delete them, or delete the account |
| Posts, topics, reactions, reports, builds, follows, notifications | the forum and the build library. | posts stay under a placeholder after deletion (§6); the rest is deleted with the account |
| E-mail preferences and a log of mails sent to you: template name, address, time and whether delivery succeeded | to honour your choices and prove an unsubscribe; the log never holds the text of a mail that carried a code or link. | preferences until deletion; the log 90 days |
| Moderation records: warnings, suspensions, removed content and the staff member who acted | to run a fair forum and handle appeals and repeat offences. | as long as the account exists, then anonymised |
Account mails are sent when you create an account, reset your password, change your password or sign in from somewhere new, and when a staff action concerns you. Most can be switched off under Notifications; the ones that carry a code or protect your account cannot.
Newsletters, events, announcements, patch notes and ladder news are sent only if you opted in, at registration or later. Every one of them carries an unsubscribe link and a one-click unsubscribe header that work without signing in, and you can change each topic separately under Notifications.
Mail is carried by Cloudflare's e-mail sending service from an address on our own domain. Cloudflare processes your address to deliver the message and keeps delivery logs for a short period under its own terms. We do not use open or click tracking.
Where the law asks us to name a basis, it is one of these:
Section 3 gives the period for each kind of record. In short: presence hashes 25 hours, sign-in sessions 30 days, the mail log 90 days, everything tied to your account until you delete it, and posts under an anonymous placeholder after that. Backups of the database are kept for 14 days, so a deleted record can survive in a backup for up to 14 more days before it is gone everywhere.
United States residents. We do not sell personal information or share it for cross-context behavioural advertising, so there is nothing to opt out of; the rights to know, delete and correct are met by the means above. We treat a Global Privacy Control signal as a request not to sell or share, which is already our practice.
To exercise any right, write to [email protected] from the address on your account, or from any address with enough detail for us to find your records. We answer within 30 days.
The site is served only over HTTPS. Passwords are stored as salted scrypt hashes and session tokens as hashes, so neither can be read from the database. Sign-in, registration and reset are rate-limited. The database listens only to the site's own server, and the server is kept patched. No system is perfectly secure; if a breach ever affects your data we will tell you and, where required, the authorities, without undue delay.
The site is not meant for anyone under 16, and we do not knowingly collect personal data from them. If we learn that an account belongs to someone younger, we delete it. If you believe a child has given us data, write to us and we will remove it.
The site's server and database are in the United States. Cloudflare's network and Google's services are worldwide, so a request may be handled wherever their nearest point of presence is. If you are in the European Economic Area, the United Kingdom or Switzerland, your data is therefore transferred to the United States: for our own server under the safeguards described in this policy and the law's provisions for transfers necessary to perform our agreement with you, and for Cloudflare and Google under their standard contractual clauses or Data Privacy Framework certification.
We may change this policy; the date at the top says when it last changed and our change log records what changed. For a material change we will post a notice on the forum or e-mail account holders who receive announcements. Continuing to use the site after a change means you accept it.
Privacy requests and notices: [email protected]. Anything else: [email protected] or our Discord.