Privacy policy

Last updated: 11 November 2026

This policy explains what Goblin Kassa (this website) stores about you, why, for how long and what you can do about it. It describes what the site actually does today. If that changes, this page changes first.

Who is responsible

The site is run by a private person, referred to here as the site owner. The site owner decides what data is processed and is responsible for it (the "controller" under the GDPR, the "operator" under Russian law).

To contact the site owner, use the Feedback form (the button in the header and the link at the bottom of every page). The answer appears on the page of your request; if you are signed in and your account is linked to Telegram, you also get it as a message from the site's Telegram bot (@wow_forever_ah_bot).

In short

  • You can use most of the site without an account. Guests get no tracking cookies and no account.
  • An account is created through Telegram. We store your Telegram id and names, your language and time zone, and what you create on the site.
  • The Ledger stores the Journalator data you upload yourself.
  • No advertising, no tracking or analytics cookies, no third-party trackers. We do not sell or share your data.
  • The site counts its own anonymous usage statistics: no IP address, no cookies, no third-party services (see "Usage statistics"). Page visits are counted by Umami on the site's own server, also without cookies (see "Visit statistics (Umami)").
  • You can delete your account with all its data yourself: Account → Delete my account and all my data.

What we process and why

When you visit without an account

  • IP address, for rate limits. Every request is counted against limits per IP address (for IPv6, per /64 network) so that nobody can overload the site. The counters live only in memory and expire within a minute to a day.
  • Web server logs. Like any web server, ours records requests: IP address, time, requested address, response code and browser (user agent). These logs are used to keep the site working and to investigate abuse and errors. They are not combined with other data and are deleted when the server rotates its logs.
  • The lang cookie. When you pick a language, the site remembers it in a cookie named lang (one year) so that a link without a language opens in yours. It contains only the language code.
  • Browser storage. Your theme, language, chosen market, recently viewed items and leveling settings are kept in your browser's local storage. They stay on your device; pages send the server only what they need to show (for example, item numbers), without anything that identifies you.
  • Item icons are loaded by your browser directly from the image servers that host them: Blizzard's render.worldofwarcraft.com and, for some items, cdn.scourge.tech and Wowhead's wow.zamimg.com. These servers receive your IP address and browser details under their own privacy policies.

When you sign in

Accounts are created through Telegram: you confirm the sign-in in the site's bot, and the bot creates an account when you agree to it.

  • Account: account name (taken from your Telegram first and last name or username), Telegram user id, first name, last name and username as Telegram passes them, language, time zone (from your browser at sign-up), the market you chose, your role and dates of creation and changes. Accounts created by the site owner with a sign-in key store only a hash of the key.
  • Sign-in requests: a hash of the one-time sign-in token, its status and, for a new account, the page language, your time zone and a keyed hash of your IP address (to limit how many accounts can be created from one address; the address itself is not stored). These records are deleted a day after they expire (a sign-in link is valid for 5 minutes).
  • Session: a session cookie and an XSRF-TOKEN cookie (protection against forged requests) keep you signed in. The server-side session record holds your IP address and browser (user agent). It ends when you sign out or after 30 days without visits.

Guests do not get a session cookie; it appears only when you sign in or start signing in.

What you create

Alert rules and formulas, the notifications sent to you, news subscriptions, favorites, dashboards, saved leveling guides and your settings. We store them to show them to you and to send the notifications you asked for.

Ledger

If you use the Ledger, you upload your Journalator addon data (the SavedVariables file) on the site or with the Kassa Agent. From it we store:

  • your characters: name, realm and faction;
  • your auction records: sales, purchases, postings, expired and cancelled auctions — item, quantity, prices, time and, where Journalator records it, the name of the other party's character;
  • your crafts and manual corrections that you enter;
  • a record of each upload (checksum, size, time, result), kept for 90 days.

The uploaded file itself is deleted after processing, within a day; a file that could not be processed is kept for up to 7 days to find the cause. The Kassa Agent key is stored only as a hash. You can export the Ledger as CSV at any time.

Feedback

When you send feedback we store its type and text, the contact you enter (optional), the replies, the address of the page you were on, the language, the market, the site version, your browser (user agent), the last script error on the page (if any) and a keyed hash of your IP address (to enforce the limit on requests; the address itself is not stored). If you are signed in, the request is linked to your account. The text of the request is sent to the site owner's Telegram. Requests are kept until the site owner deletes them.

Usage statistics

To understand which parts of the site are used and what to improve, the site records usage events in its own database:

  • a page opened — only the name of the section (for example "recipe" or "leveling");
  • a search — the query text (cut to 64 characters and lowercased), the number of results and the position of the result you picked;
  • a recipe opened, a leveling guide built or saved (profession, skill range, the professions ticked under "My professions");
  • feedback sent (only its type), signing in and signing up.

Each event carries the time, the page address (without parameters, except the site's own ones such as the selected tab), the page language and the chosen market.

  • No IP address is stored. The request that carries the events counts against the rate limits per IP address like any other request, but the event record has no address.
  • Session id. So that the events of one visit can be linked (for example "built a guide → saved it"), your browser creates a random id and keeps it in sessionStorage, the tab's storage that is cleared when the tab is closed. The id is replaced by a new one every day. It is not a cookie, and the id itself carries nothing about your device, IP address or account; while you are signed in, events carry both this id and your account number, so the events of that tab before you signed in can be linked to the account too.
  • Account. If you are signed in, the events carry your account number. Guests have none. When you delete your account, the events lose the link to it.
  • Requests from search engine robots and other programs are dropped.
  • Only the site owner sees the events, as a summary report (counts per day, top searches, recipes and guides). They are not shared with anyone and not used for advertising.
  • Events are kept without a time limit: they are the site's usage history, from which a guest cannot be identified.

Visit statistics (Umami)

Page visits are also counted with Umami, an open-source web analytics program that runs on the site's own server; it is not a third-party service. Its script is loaded from this site after the page has loaded. It sets no cookies and stores nothing in your browser.

  • What is recorded per page view: the page address without parameters, the address of the site you came from (only for the first page you open, without parameters), the time, the browser and operating system, the device type and screen size, the browser language, and the country, region and city derived from your IP address.
  • Private pages are not recorded at all: your account, the Ledger, alerts, your own dashboards and saved guides, feedback requests and the admin pages.
  • No IP address is stored. At the moment of the visit your IP address is used to look up the location and to compute a visitor id: a one-way hash of the IP address, the browser (user agent) and a secret that changes every month. The id links the page views of one visitor within one calendar month at most; the address itself is not stored.
  • Do Not Track. If your browser sends the Do Not Track signal, the script is not loaded and nothing is recorded.
  • Only the site owner sees these statistics. They are not shared with anyone and not used for advertising. They are kept without a time limit and are not linked to accounts.

Telegram

Sign-in confirmations, alerts, news and answers to your feedback are delivered through Telegram. The text of these messages passes through Telegram's servers and is processed by Telegram under its own privacy policy. We do not read your Telegram chats; the bot only receives the messages and buttons of the sign-in.

Legal grounds (GDPR)

  • Account, Ledger, alerts, dashboards and the other features you use: performance of the agreement with you (Art. 6(1)(b)) — the Terms of use.
  • Rate limits, logs, hashed IP addresses in sign-ups and feedback, backups: our legitimate interest in keeping the site secure and working (Art. 6(1)(f)).
  • Feedback: our legitimate interest in answering you and fixing problems (Art. 6(1)(f)).
  • Usage statistics: our legitimate interest in understanding how the site is used and improving it (Art. 6(1)(f)).
  • Visit statistics (Umami): the same legitimate interest (Art. 6(1)(f)).

We do not use your data for advertising or profiling and make no automated decisions about you.

Who else receives data

  • Telegram — to deliver messages, as described above.
  • The hosting provider of the server where the site runs — it stores the data on the site owner's behalf.
  • Image servers of item icons (Blizzard, cdn.scourge.tech, Wowhead) — only what your browser sends when it loads an icon.

Nobody else. We do not sell, rent or share your data, and there is no advertising on the site.

How long we keep data

Data Kept
Account, settings, rules, dashboards, favorites, guides, Ledger Until you delete your account
Ledger upload records 90 days
Uploaded Ledger file Until processed (within a day); up to 7 days if processing failed
Sign-in requests One day after they expire
Session Until you sign out, or 30 days without visits
Rate-limit counters From a minute to a day
Feedback Until the site owner deletes it; after account deletion it stays without the link to the account
Usage statistics (events) Without a time limit; no IP address; the link to an account is removed with the account
Visit statistics (Umami) Without a time limit; no IP address; not linked to an account
Web server logs Until the logs are rotated
Backups Daily copies of the database, on the same server, kept for 14 days

Deleted data disappears from backups within 14 days.

Your rights

  • Access and export. Your account data, rules, dashboards and Ledger are visible on the site; the Ledger can be exported as CSV. For a full copy of what we store about you, write through Feedback.
  • Correction. Change your settings on the Account page; for anything else, write through Feedback.
  • Deletion. Account → Delete my account and all my data deletes the account and all its data at once: Ledger, rules, notifications, subscriptions, favorites, dashboards, guides, the Telegram link and every session. Feedback requests stay without the link to the account; ask through Feedback if you want them deleted too.
  • Objection and restriction. Write through Feedback.
  • Complaint. You can complain to the data protection authority of your country (in the EU) or to Roskomnadzor (in Russia).

We answer requests within 10 working days.

Russian users (Federal Law No. 152-FZ "On Personal Data")

  • Operator: the site owner; contact — the Feedback form.
  • Purposes: providing the account and the site's features (Ledger, alerts, dashboards, guides), delivering notifications through Telegram, answering feedback, protecting the site from abuse, usage statistics of the site.
  • Personal data: Telegram user id, first name, last name and username; account name, language, time zone and chosen market; the Ledger data you upload (character names, auction records including the names of other parties' characters); the content you create; feedback texts and the contact you leave; the IP address and browser details in sessions and server logs; keyed hashes of IP addresses; site usage events (including search query texts) with a random session id and, if you are signed in, the account number; page visit data (Umami): page address, referrer, browser, operating system, device type, screen size, language, location derived from the IP address (country, region, city) and a visitor id hashed from the IP address and browser.
  • Actions: collection, recording, storage, use, transfer (to Telegram for message delivery), deletion and destruction; automated processing.
  • Legal basis: your consent, which you give by creating an account (confirming the sign-up in the Telegram bot), and the agreement with you (the Terms of use).
  • Storage: the data is stored on the site owner's server. Messages to Telegram pass through Telegram's servers, which may be located outside Russia (cross-border transfer).
  • Retention: as in the table above; account data until the account is deleted.
  • Withdrawing consent: delete your account (Account → Delete my account and all my data) or write through Feedback. The data is deleted at once, and from backups within 14 days.

Game data

Prices, items, recipes and other game data come from the Blizzard API and the game client data (see Data sources). This game data is provided to players "as is", without guarantees of accuracy or completeness.

Children

The site is not intended for children. Do not create an account if you are under 16.

Changes

When this policy changes, we update this page and the date at the top.