Privacy policy.
What we collect, why, and how to get rid of it.

EllesmereUI is a free World of Warcraft addon run by Ellesmere Gaming. This policy covers this website - including the Feedback Hub, where feature requests and bug reports live - and the Discord bot that posts bug reports to our bug-report forum. The addon itself runs entirely on your own computer and sends us nothing.

What we collect

If you sign in

Signing in is optional. You only need it to upload a preset, like one, or leave a comment, and on the Feedback Hub to request a feature, report a bug, vote, or follow a request or a bug. We use Discord, and nothing else - there is no password to create and we never see one.

From your Discord account we store your user ID, your display name, and a link to your avatar picture. That is what appears next to anything you post. Your name and picture follow your Discord profile: we refresh them once a day, and again when you sign in. Pictures are only ever loaded from Discord's own image server.

Signing in asks Discord only for your user ID, name and picture. We do not receive your e-mail address, and our sign-in system does not store one.

Like any web service, Supabase keeps short technical logs of sign-ins and requests, such as IP address and browser, for security. We do not keep our own copy of these sign-in records.

If you upload a preset

We store what you entered: the title, description, import strings, tags, UI scale, any links (including an optional YouTube link), an optional Edit Mode string, and any screenshots you attach. Screenshots are resized in your browser before upload and kept in our own file storage. If you add a YouTube link, our bot copies that video's thumbnail picture into our storage, so the preset page can show it without contacting YouTube. All of this is public by design - that is the point of sharing a preset.

If you like, comment or report

A like records which preset and which account. Only you can see which presets you liked; everyone else sees the total. A comment stores its text and who wrote it. Reporting a preset or a comment records the reason you gave and who reported it, visible only to the site owners.

If you copy a preset's import string

Each preset shows how many times it was copied. To count a copy once per day per connection, we store a one-way code made from your IP address, the preset and the day, mixed with a secret that changes every day. The codes and the secrets are deleted after two days. Nothing is stored in your browser for this.

If you use the Feedback Hub

Feature requests and the screenshots you attach to them, comments, and the requests and bugs you follow are stored with your account. Requests and comments are public, with your Discord name and avatar beside them, just like a preset. When you edit a request, its earlier versions stay in its public history unless you or a moderator hides one - you can hide them yourself from the request's edit history. A hidden version's text stays visible to our moderation team, and only a moderator can show it again.

Votes, on feature requests and on bugs, are public only as totals - nobody else can see what you voted for. The site owners can see who voted for what when they check for abuse, and each such look-up is logged. Notifications are private to you.

Unless you turn on Ping me on Discord - in the notification bell, on the feature request form, or when we ask once after you follow something: then our bot mentions you in a public channel of our Discord for each new notification, with its title, its text and a link, so anyone who can read that channel sees them. A notification about something a moderator removed, or about a suspension, is only announced as "a new notification". It is off until you turn it on, and you can turn it off in the bell at any time. The site owners are also mentioned in that channel when a contributor asks them to review a claim: the ping names the feature request, never who asked.

A comment you delete disappears from the site. Its text stays visible to our moderation team as a record for 180 days, as does the text of a comment a moderator removes; after that the text is deleted. If you edit a comment, its earlier wording is visible to our moderation team only. Reporting a request or a comment records the reason you gave and who reported it, visible only to the site owners.

Keeping the hub safe

To keep brand-new throwaway accounts out, the hub can require a minimum Discord account age before you vote, post a feature request or report a bug. It works out the age from your Discord ID; nothing extra is collected for it. It also notes when you post, edit, comment, report or vote, so it can slow down spam. Those notes are deleted after 7 days.

The site owners also keep these records to deal with abuse. Only they can see them, except that a suspended member sees their own suspension and its reason.

• Suspensions, with the reason, who set them and when they end. A suspension record is deleted 12 months after it ends.
• A log of what the team does - moderators, owners and contributors - such as removing a post, changing a status or a role, claiming or closing a request, or looking up a member's votes. These logs are kept for 24 months.
• Unusual-voting alerts that the hub raises on its own. An alert is deleted 90 days after it is reviewed or dismissed; an alert that led to action is kept.

If you report a bug

Bugs are reported on this site, signed in with Discord. We store what you entered with your account: the title, the description, the steps to reproduce, the section, the game version and EUI version, and any screenshots you attach, which are resized in your browser before upload and kept in our own file storage. The report is public in the Bug Tracker at once, with your Discord name and avatar, just like a feature request, and it is listed under My feedback. You can edit or delete it while the bug is still open.

Our bot also posts the report in the Bug Reports forum of our Discord, so the team can ask you about it there: its title, description, steps, section and versions, links to its screenshots in our storage, a link back to the report here, and a mention of your Discord account, which pings you and adds you to the post's thread. When you edit or delete the report, the bot edits the post to match. When its status changes, or the team removes or restores it, the bot posts a short message in its thread (the one saying your bug's fix is live mentions you again) and puts the forum's Closed tag on the post or takes it off. Anyone in our Discord can read that forum.

Before reports moved to this site, bugs were reported straight in that forum, and our bot read it. For each such post it recorded the title, the text of the post, the bug form's fields (the section, game version and EUI version picked), the tags applied, how many screenshots it has, the link to the post, and the Discord name, ID and avatar of the person who posted it. While such a post is open on Discord, its report stays in the Bug Tracker, with the reporter's Discord name and avatar - the same things anyone in our Discord already sees. If you also have an account here, your reports are matched to it through your Discord ID, so they show up under My feedback and you hear when they change. The bot no longer adds posts made straight in the forum, and their screenshots stay on Discord: the website does not copy them.

Before a report is shown or posted, we hide user-folder and WoW account-folder names (such as those in Lua error paths), computer names, email addresses, BattleTags, and the "Locals" sections of error dumps, which can contain other players' names or chat. We don't display Discord IDs, though Discord's own avatar image links contain them, as they do anywhere Discord avatars appear. Pages only ever show reports with those details hidden. Our moderators cannot read the stored text; only the site owners can, directly in the database. Bug pages ask search engines not to index them.

The team can remove a report from the tracker, with a reason that its reporter on this site is told. Only the team and that reporter still see it, and 30 days later we erase its title, text, names, Discord IDs, pictures, screenshots and staff notes, and keep only details about the bug itself, such as its number, status, version and history; its Discord post then only says it was removed. A report you delete yourself, while the bug is still open, goes the same way, except that you no longer see it either and its post says you deleted it at once. The same happens 30 days after a post made straight in the forum is deleted on Discord. When a report is closed - by the team, by a contributor, or with the Closed tag on its Discord post - it leaves the tracker; only the team still sees it, and we keep it as our issue history, so we can tell people which release fixed a given problem. A bug closed, or fixed live, 24 months ago loses the names, Discord IDs and pictures of the people who reported and posted it, its screenshots and its staff notes. (For a bug that was already closed when this policy took effect, the 24 months count from that day.) We then keep only the version of its text with private details hidden, and it no longer appears under the reporter's My feedback.

In the forum, the bot only posts the reports filed on this site and edits those posts when a report changes, through the forum's webhook. Its one other post is the Discord pings described above, in their own channel and only for members who turned them on (and for the site owners, about claims waiting for their review). It never replies, deletes, changes the tags of anything but its own posts, or sends direct messages. It reads the forum only to keep the reports already in it up to date, and no other channel, no replies inside threads, and no direct messages. It keeps a technical log on its own server, such as the titles of the posts it read or made; lines older than 30 days are deleted. Posts from our old feature-request forum, which the bot no longer reads, have been deleted from our database.

If you contribute code

EllesmereUI's code lives on GitHub, where pull requests are public. Our bot reads EllesmereUI's merged pull requests from GitHub's public data: each one's number, title, branch name, when it was merged, and the GitHub username and account number of whoever opened it. GitHub sends us nothing else, and we never act on GitHub as you.

Our team links a GitHub account to your account here, usually because you submitted that pull request's link on a bug or a feature request. From then on your merged pull requests give you a public contributor profile on this site: your Discord name and avatar, your rank, how many pull requests you merged, bugs you fixed and features you built, the achievements you earned, and your merged pull requests with their titles, links and the bugs and requests they fixed or built. A small rank mark beside your name, wherever it appears, links to your profile. The profile also links your GitHub account unless you hide it, which you can do on your profile at any time. If a GitHub account is linked to you by mistake, or you would rather not have a profile, tell us and we unlink it.

If you donate

We credit donors by the name they gave, on the EUI Legends wall on our Donate page and in the addon. Ask us any time and we will remove your name.

What we do not collect

• No analytics, no tracking pixels, no ad networks, no fingerprinting. The only banner on the site is our own Patreon link, a plain picture that tracks nothing.
• No cookies for tracking. Your browser keeps your sign-in session, your name and picture so the menu shows at once, and a few small preferences, such as your last filter or an invitation you hid - nothing that tracks you.
• No outside fonts. Our fonts are served from this site itself.
• Nothing from the addon. It never contacts us, so we have no idea what settings you use or even that you installed it.
• No payment details. Donations go through Patreon and PayPal, who handle that entirely - we never see a card number.

Who can see it

Presets, comments, feature requests, bug reports and contributor profiles are public - that is the point. Your Discord name and avatar appear beside them. Votes and likes show only as totals. Unless you are on our team, other visitors see your name and picture only next to something public you posted.

Our team: Staff and Valkyries moderate the site and set the status of bugs and feature requests; Contributors can claim a bug or a feature request to work on it, which shows on the bug as "Assigned (their name)" and on the request as "Planned (their name)", and once their work is submitted, a link to their pull request on GitHub; contributors whose rank reaches the one the site owners pick can also close a feature request for something EllesmereUI already does as "Already in EUI", with a public note saying where to find it; the site owners run the team and the hub's settings. Before claiming a feature request, a contributor can ask the site owners to review the claim first: until an owner approves or declines it, our team and the other contributors see who asked, and nothing about it is public. A bug's or request's public history lists each status it has had. A bug's severity, a claim taken without that review and the team's log of who claimed, released, closed or changed what stay internal, and older internal staff notes are never shown. Access is enforced by the database itself, not by hiding a page, so an unauthorised request returns nothing rather than being merely unlinked.

We do not sell anything to anyone, and we do not share data with advertisers.

Who processes it for us

• Supabase - database, file storage and sign-in. Preset screenshots and video thumbnails load from its storage.
• Cloudflare - our network and security provider. Every page request passes through it, so it sees your IP address.
• Bluehost - web hosting.
• DigitalOcean - hosts the bot that posts bug reports to our bug-report forum, keeps them up to date and posts the Discord pings.
• Discord - sign-in, the forum our bug reports are posted to and discussed in, and the channel of the Discord pings you can turn on. Member pictures load from Discord's image servers, which see your IP address as any web request does.
• jsDelivr - serves the one script our pages use to reach our database and sign-in, pinned to a fixed version we have checked. It sees your IP address as any web request does.
• YouTube - only if you press play on a video. The pictures shown before that come from this site or our own storage, so nothing loads from YouTube until you do, which is deliberate.
• Patreon - only if you open one of our Patreon links, such as the banner on the Feature Hub and the Bug Tracker, whose pictures come from this site. We send Patreon nothing; the link just opens their site.
• GitHub - our bot reads EllesmereUI's merged pull requests from GitHub's public data, and sends GitHub nothing about you. In your browser, GitHub is reached only if you open a pull request or GitHub account link, which just opens their site.

How long we keep it

• Your account, presets, feature requests and comments - until you remove them or ask us to.
• Likes and follows - until you take them back or your account is deleted.
• Votes - votes from earlier weeks stay part of each request's totals, and a bug vote stays part of its bug's total until you take it back.
• Notifications - read ones once they are 180 days old, and all of them after a year.
• Comment text kept for moderation - 180 days for a Feedback Hub comment you deleted or a moderator removed, and for a preset comment a moderator removed. A preset comment you delete is gone at once.
• Screenshots of a request a moderator removed - 30 days.
• A feature request you delete - 30 days (the team can restore it until then), then erased with its comments and votes.
• Reports you file - 12 months after they are resolved or dismissed.
• Spam-control notes - 7 days.
• Suspensions - 12 months after they end.
• Moderation and audit logs - 24 months.
• Unusual-voting alerts - 90 days after they are reviewed or dismissed; an alert that led to action is kept.
• Download-counter codes - 2 days.
• Bug reports - kept as issue history; erased 30 days after the team removes one or you delete your own, or after a post made straight in our Discord forum is deleted there, and without names, IDs, pictures or screenshots 24 months after the bug is closed or its fix is live (for a bug already closed when this policy took effect, 24 months after that day).
• The bot's technical log - 30 days.
• Merged pull requests - kept as EllesmereUI's history, as they are on GitHub. Your contributor profile and achievements last until we unlink your GitHub account or your account is deleted.

Your data: see it, fix it, get a copy, delete it

While signed in, you can edit or delete your presets and delete your comments; Feedback Hub comments can be edited too. You can edit your feature requests and hide their earlier versions, and edit your bug reports while the bug is open. You can delete a feature request or bug report of yours until the team picks it up (a request still Open or Under review, a bug still Open). You can take back your votes: feature votes in the week you cast them, bug votes in any week. My feedback lists your requests, votes, bug reports, comments and notifications in one place. Your name and picture follow your Discord profile. On your contributor profile, if you have one, you can hide your GitHub account.

For anything else, ask us in Discord or by email (see Contact below). No form needed. You can ask for:

• A copy of everything we hold about you. We send it to you as a file.
• A correction of anything that is wrong.
• Deletion of your account, a feature request, your bug reports, or everything we hold.

This includes people who only posted in our Discord bug forum and never used this site: we find your reports by your Discord ID. To make sure a request really comes from you, we confirm it with a Discord message from the same account. We reply within one month.

You can also revoke this site's access to your Discord account at any time from Discord Settings, then Authorizations. That stops future sign-ins immediately.

What deleting your account removes

We remove your profile, your presets with their screenshots, your preset comments, likes, the reports you filed, your follows and notifications, any suspension records, your contributor profile and achievements, and your sign-in account. Some things stay:

• Your feature requests and Feedback Hub comments, shown as "Deleted user". Ask and we remove them too.
• Votes from earlier weeks keep counting in the totals, under a random code that is no longer linked to you. This week's votes are withdrawn.
• Your bug reports, as described above: a report filed on this site no longer shows your name here, though its Discord post still names your Discord account. Ask and we clear them too.
• The merged pull requests our bot read, with the GitHub username that opened them - as they are on GitHub itself - no longer linked to you.
• Log entries about you, until their 24 months run out, with your name taken out.

Changes

If this policy changes in a way that matters, we will say so in our Discord rather than quietly editing the date at the top.

Contact

Ask in our Discord server, or email ellesmeregaming@gmail.com.