Privacy Policy
This policy explains how Stonetavern (stonetavern.app), a non-commercial World of Warcraft fan community, handles information in connection with our website, our game realms Elwynn and Barrens, the Stonetavern launcher, and the social-media channels we operate. It describes what the site, the game servers and the launcher actually record and send — read off the code and the server configuration, not off intentions.
1. What this site measures
The two services below run on every visit to this site, for every visitor, without asking first. There is no cookie banner and no opt-out switch here: one of them is a system we operate ourselves, and the other receives only the specific events described below, never a general record of your visit.
Statistics — PostHog
The site loads PostHog. We run it ourselves, on our own server — no data about you
leaves our infrastructure to reach it. The browser reaches it through
stonetavern.app/ingest, which forwards to posthog.stonetavern.app — a
host we operate. It records page views, automatically captures clicks and form interactions
(autocapture), builds heatmaps, measures page performance, and makes a
session recording — a replay of your visit: the pages, the mouse movement, the
scrolling and the clicks. Text you type into input fields is masked in that recording. PostHog also
records which site sent you here (referrer, utm_* and ref parameters, and
advertising click identifiers such as fbclid, gclid and ttclid
if they are in the address you arrived on).
Advertising — Meta (Facebook)
The site loads the Meta Pixel from connect.facebook.net, which reports
your page view. Beyond that, Meta receives data only through specific funnel events we send
ourselves — opening the download, joining Discord, clicking register, completing registration,
opening the donation link — never a passive recording of everything you do on the site. The same
funnel events are additionally sent a second time from our own server to Meta through the
Meta Conversions API, so a script blocker in your browser does not by itself stop
the second copy. Meta receives your IP address, your browser's user agent, the page address, and the
Meta cookies (_fbp, _fbc) if present. When you register, a one-way hash
(SHA-256) of your email address and of your account number is sent along so Meta can match the
event. Meta uses this data for its own advertising measurement and targeting under its own terms.
To be plain about it: your visit becomes part of Meta's advertising data about you through the funnel events above. That is what a pixel is for. This is the same measurement anyone running ads has to make to know whether they work — Meta does not receive a replay of your session or a copy of what PostHog records.
2. What the site needs in order to work at all
These are not optional and are not used to profile you. They stay on our own servers.
| Cookie | What it is for |
|---|---|
st_session | Keeps you signed in to your game account. |
st_discord_state, st_discord_pending |
Short-lived, protects the Discord sign-in against request forgery. |
st-theme | Light or dark. |
st-lp | Which version of the landing page you were shown. |
st-reg | Ten minutes after a successful registration, so the next page knows it happened. |
Our web server also writes ordinary access logs (IP address, time, address requested, user agent), as any web server does, to operate the site and defend it against abuse.
3. Error reports
When something breaks in your browser, the site reports the error to Sentry
software running on our own server (Bugsink). It is configured to send no personal data
(sendDefaultPii: false) and no performance traces; it sends nothing at all on a visit
where nothing goes wrong. It does not measure audiences and does not build profiles, which is why it
is separate from section 1.
4. In the game and the launcher
This part is about your game account, both realms, and the Stonetavern launcher. Apart from the registration event described in section 1, none of it is shared with Meta or used for advertising.
- Your account. Account name, email address, the date you joined, and the verifier the 1.12 client uses to check your password (not the password itself). On every login the game stores the IP address you connected from, the time, your client language and your operating system. When you register on this site we also keep the IP address and browser user agent you registered from, and a normalised form of your email address. We use those to notice one person running many accounts, never to block a shared connection by itself. If you register with Discord, we keep your Discord user id to link the two.
- Game logs. Both realms write server logs of chat in every channel, including whispers, party, raid and guild chat, and of trades, loot, level-ups and anti-cheat events. Staff read them when a player reports something and when we check for bots, multiboxing or real-money trading. They are never published.
- The launcher. It asks our servers whether the realm is online, checks for updates
of itself and of the game, and downloads files from
downloads.stonetavern.app. Signing in or registering in the launcher uses the same account system as this site. It contains no analytics and no advertising. When you send a problem report from it, the report carries what you type, an optional contact address, the launcher version, your operating system, the realm, the client build, the last part of the launcher log and the IP address it came from. It arrives as an email in our staff inbox. - Game settings that follow your account. If you leave “Sync my game settings” on in the launcher (it is on by default and can be turned off there at any time), the files the 1.14.2 client keeps for your interface are stored on our server, per account and realm: key bindings, macros (including the text you wrote in them), game settings, the names and channels of your chat windows (not your chat messages), and raid frame profiles. The 1.12 client is not part of this. With each version we store the time it arrived, a random id the launcher created for that computer, and the name of its operating system (“Windows”, “Linux” or “macOS”). We keep the current version and up to 20 older ones per file, and copies from a conflict between two computers for 90 days. All of it is deleted with your account.
- How long. Account data stays while the account exists. We have not set a fixed period after which game logs are deleted. To have your account and its characters deleted, write to us from the email address on the account; if the account was banned, a short note of that ban stays so it cannot be dodged by starting over.
5. Social-media publishing
We use the official APIs of social platforms (including TikTok, Instagram, Facebook, YouTube and others) to publish our own content to our own accounts, including via scheduling tools we host ourselves. When we connect one of our accounts, the platform issues us an access token that we store solely to publish our posts on our behalf. We do not access, collect, or store data belonging to other users of those platforms, and we request only the permissions needed to publish our own content.
6. How we use information
Information is used to operate our website, our game realms and our community, to publish our own social content, and to measure how the site is used and how people find it. We do not sell personal data. We do not share it with third parties except the services named above, the platform you are viewing our content on, and where required by law.
7. Access tokens
Access tokens for our own social accounts are retained only while a channel remains connected and are deleted when we disconnect it or when they expire. You can revoke our access at any time from the relevant platform's app/permissions settings.
8. Age
Stonetavern is for people aged 16 and over, and you need to be 16 to create an account. We do not knowingly keep personal data of anyone younger; if we learn that an account belongs to someone under 16, we close it.
9. Changes
We may update this policy from time to time; the date above will change accordingly.
10. Contact
Privacy questions or data requests: [email protected].