Privacy

Last updated November 9, 2026.

This page says what Thottbot Forever keeps about you, why, for how long and who else sees it. The short version: the site keeps what it needs to run accounts, comments, screenshots and uploads, and nothing to show you ads or follow you around. There are no ads and no third-party trackers, and the one script that is not the site’s own is Cloudflare Web Analytics, which counts visits without a cookie (see Analytics). No cookie is shared with any other service; every cookie is one the site, or its host, cannot work without (see Cookies), which is why there is no cookie banner. The site’s terms of use are on a page of their own.

Reading the site

You can read every page without an account, and the site sets no cookie for reading (its host may set one of its own, to keep the site safe: see Cookies). Two things happen as you read all the same:

• Your address is counted against the rate limits whenever the server has work to do for you, such as a page or an API call it answers fresh rather than from its cache, or a sign-in, so that one visitor cannot take the site down for everyone. An IPv4 address is counted by itself, and an IPv6 address by its /64 network, since a home or a phone can use any address in its /64. The count is held only for the few minutes the limit counts over and then let go. Your address is never written to the database or into the analytics. Once you are signed in, most limits count your account instead.
• The page is counted for the administrators’ analytics, without you in it, and your browser tells Cloudflare Web Analytics about the visit and how fast the page was. See Analytics.

Signing in with Battle.net

Signing in, to comment, vote, report, send a screenshot, upload or write to the administrators, is with your Battle.net account. There is no sign-up form, no password and no email address here: the site never sees your Battle.net password, and never asks for an email address.

What the site asks Battle.net

• Who you are: your Battle.net account’s id and your BattleTag, from the region you chose.
• Whether you own World of Warcraft, where the site requires it for uploads: whether your Battle.net account has at least one World of Warcraft character. Only the answer, yes or no, is kept, with when it was asked; nothing about the characters themselves is.

Battle.net hands the site an access token to ask those questions with. It is used while your sign-in is being finished and then thrown away: it is never stored.

What is kept about your account

• The name you choose for the site, which is what everyone else sees.
• Your Battle.net account’s id, which is how the site knows you next time; your BattleTag and region, for support; and the license answer above. Your BattleTag is shown to you, on your account page, and to the administrators, and never beside a comment or on your profile.
• Your role, whether the account is suspended and why, when you joined and when you last signed in, and how far you have read the replies to you.
• Sessions: each browser you are signed in on, kept as a hash of its cookie, with when it began, when it ends and when it last went through Battle.net or a second factor. Signing out deletes it, and expired ones are deleted every hour.
• API tokens you make, kept as a hash, with the name you gave each, its first few characters and when it was made, last used and revoked.
• Signing in the desktop uploader: the program’s name and version and your computer’s name, as the program gives them, with the sign-in, which lasts ten minutes and is deleted once it has been used or, after it runs out, the next time the program asks or a sign-in begins. The API token the program is given is named after your computer: “Uploader on” and its name.

The second factor, for moderators and administrators

A moderator or an administrator also passes a second factor of the site’s own, since Battle.net cannot say whether an account has an authenticator. For an authenticator app the site keeps its secret, encrypted under a key that is not in the database or its backups; for a security key, only its public key, its id and its count of signatures. With either goes the name you gave it, when it was added and last used, and a count of wrong codes. Removing one deletes it.

Cookies

The site sets three cookies, all its own, and all for signing in. None is set for reading, none is readable by a script on the page, and the site stores nothing else in your browser.

Cloudflare, which hosts the site, may set cookies of its own as you read it, such as __cf_bm, to tell people from bots and keep attacks off the site. They are part of the infrastructure the site cannot run without, and Cloudflare’s cookie policy says what each holds.

No cookie, the site’s or its host’s, follows you to other sites, is shared with another service or is there for advertising or analytics. Each is needed for the site to work or to be kept safe, which is why the site asks for no consent and shows no cookie banner.

What you post

• Comments are public, under the name you chose, with their score, and are in the site’s API and its comments feed as well as on its pages. A vote is counted in the score; only you are shown which way you voted. When you delete a comment it is gone from the site for everyone, but its text stays in the database, where the moderators can still see it, for 30 days; then it is removed, unless a report on it is still waiting for a moderator. A comment a moderator hides stays visible to the moderators. When a moderator edits somebody’s comment, the words from before are kept in the moderation log, until 30 days after the comment is deleted.
• Reports on a comment are seen only by the moderators, with who sent each one and the comment as it read when it was reported; that copy goes with the comment’s text, 30 days after it is deleted. What you wrote in a report’s note stays with the report.
• Screenshots are stored as read from the picture itself, with everything written about it left out: EXIF, where and when it was taken, its comments. Nobody but you and the moderators sees one until a moderator approves it; then it is public, with its caption and your name. Everybody will see what the picture shows, so crop out what you would rather keep. One turned down loses its file and keeps its record, so that you can see what became of it. Delete one yourself and its file and its record go.
• Messages to the administrators, from Contact, are seen by you and the administrators and nobody else. Nothing about them is emailed. One is kept while it is open and deleted, with its answers, 90 days after it is closed; the moderation log keeps only that the message, by its number, was answered, closed or reopened, by whom and when, and none of its words.
• Email to contact@thottbot-forever.com is read by the administrators and nobody else, and answered by email. The site keeps the address it came from, the name and subject you gave, the message’s text and the names and sizes of its attachments, never the attachments themselves, with the administrators’ answers, in an inbox only they can open. Like a message from Contact, it is kept while the conversation is open and for 90 days after it is closed or set aside as spam. It is never added to an account, a list or anything else on the site.

Uploads

What the in-game addon saves, and you upload with the desktop uploader or the API, is what your character saw in the game: items, creatures, quests, objects, where they stood, what dropped, what merchants sold, auction prices and the like. Contribute describes it in full. With it go the name and version of the program that sent it, the game’s version and language, your character’s faction and level, and whether its realm plays by hardcore or self-found rules.

• Your character’s name and realm are taken out before an upload is stored, and your character’s name is taken out of the quest text and what creatures say to you. An auction price keeps what the game said of the server it was read on; readers see prices by gameplay style, never the server’s name or who read them.
• Where it is kept. Each upload is kept compressed in the site’s private object storage (Cloudflare R2), with a record in the database of whose it is, which token sent it, when, and what became of it. What each upload added to the database is recorded beside what it added, and what it changed is kept as it was before and after. Those changes stay in the database for 180 days and then move into the same private storage, where they are also copied into the backups.
• For how long. There is no end set today: uploads and the record of what they changed are kept so that an upload can be processed again, and so that everything an untrustworthy uploader sent can be taken back.
• Who sees it. You, on your account page and under your uploads. The moderators and the administrators, who can see whose upload recorded or changed what. Everyone else sees the facts the uploads added, and never who added them.

Analytics

The administrators’ own analytics are counted by the site’s own server, not by a script in your browser. For each page they keep its address without the query string, its status, the site you came from (the host name only, and only from another site), your country as Cloudflare works it out from your address, whether a phone, a tablet or a desktop asked, the first language your browser asks for, whether it was a program such as a search engine’s crawler, how long the page took, and which version of the site answered and from which of Cloudflare’s data centers. For a search they keep the words searched for and how many results they found. For a call to the API they keep the route, the method, the status, how long it took and which version of the site answered. For an upload from the collector they also keep how it ended, how many batches and records it stored, how much it sent, how long it took, and the collector and desktop uploader that sent it, by name and version, as they name themselves; and, for each batch, how processing it went. For a request a rate limit turns away they keep which limit it was, whether it counted an address, an account or a token (never which one), whether a program asked, and how long it was told to wait. For a sign-in they keep only how it was made (with Battle.net, an authenticator app’s code, a security key or the desktop uploader) and how it ended, never whose it was. For a feed, a sitemap, the desktop uploader’s download or an entry’s share card they keep only which it was, never its address, how it was answered, whether a program asked, and for a download the uploader’s version. For an entry’s share card they also keep the kind of entry and how long drawing it took. For a message emailed to the site they keep only whether it was kept or refused and why, whether the sender’s domain vouched for it, and its size, never who sent it.

They keep no address, no account, no cookie and no user agent, so they count pages and not people: nothing in them says who asked for what, or that two pages were read by the same person. They are kept in Cloudflare’s Workers Analytics Engine, which keeps three months of them.

Every page also loads Cloudflare Web Analytics, a script from Cloudflare that your browser runs to count the visit and measure how fast the page was for you. It sends Cloudflare the page’s address and the address of the page you came from, this site’s or another’s, each without its query string, and how long the page took to load and to respond, as page timings and Core Web Vitals; Cloudflare works out from the request your country and what kind of browser, system and device you use. It sets no cookie and keeps nothing in your browser, and Cloudflare says it does not use your address or user agent to tell visitors apart or follow them from site to site, so it too counts visits rather than people. The administrators see only the totals, in Cloudflare’s dashboard; Cloudflare’s privacy policy says what it keeps. It is blocked by most content blockers, and the site works the same without it.

Logs

Cloudflare keeps logs of a sample of the requests the site answers: one in ten of the pages and API calls, and fewer of the requests for icons. A log holds what Cloudflare records of the request and anything the site wrote while answering it, which is mostly errors. Cloudflare keeps them for up to 7 days, and the administrators read them only to find and fix what goes wrong.

Backups

The database can be put back as it was at any minute of the last 30 days (Cloudflare D1’s Time Travel), and a copy of it is taken every day into a private bucket that nothing serving the site can read. The daily copies have no end set today. Something deleted from the database, a closed account included, is still in the copies taken before it was deleted, for as long as they are kept. The uploads and screenshots in storage are not in the daily copy.

Who else sees it

• Cloudflare, which hosts the site: its Workers run it, D1 holds its database, R2 its uploads, screenshots and backups, a Durable Object and Cloudflare’s rate limiting its rate limits, and KV and the Cache API what it caches. Email to contact@thottbot-forever.com reaches the site through Cloudflare’s Email Routing, and the administrators’ answers go out through Cloudflare’s email service. Everything on this page passes through Cloudflare’s network, and Cloudflare handles your address as it answers every request, as any host does.
• Blizzard, when you sign in: your browser goes to Battle.net to sign in there, and the site asks Battle.net who you are and whether you own World of Warcraft. The site tells Blizzard nothing about what you do here.
• Cloudflare Web Analytics, which your browser tells about each visit: the page, the page you came from and how fast it was (see Analytics).
• Nobody else. The site sells nothing about you and shows no ads. Its pages run no script but the site’s own and Cloudflare’s analytics beacon, which their Content-Security-Policy enforces, and load nothing but the site’s own files, that beacon and the game’s icons and maps from the site’s own image server, so no other third party learns what you read.

What you make public is public, though: your chosen name, the date you joined, your role, your comments and your approved screenshots can be read, and copied, by anyone, search engines included, on the site and through its API and feeds.

Seeing, exporting and deleting your data

• See it on your account page: your name, your Battle.net account and region, your role, your API tokens, your uploads and your screenshots; and under replies and messages.
• Export it as JSON from the API, signed in on the site or with one of your tokens:

  Endpoint	Gives
  GET /api/v1/me	Your account
  GET /api/v1/me/comments	Your comments
  GET /api/v1/me/screenshots	Every screenshot you sent, whatever became of it
  GET /api/v1/me/tokens	The API tokens you have not revoked, never their secrets
  GET /api/v1/me/contributions	Your uploads, and what each applied
  GET /api/v1/me/uploads	What your uploads recorded, changed and counted

• Change or delete one thing: rename yourself (your comments follow you), edit or delete a comment on its page, delete a screenshot, revoke a token or sign out.
• Close your account from the account page. It asks Battle.net to confirm it is you, then for your name, and cannot be undone.

What closing your account does

Deleted: your account, with your name, your Battle.net id, your BattleTag and region and the license answer; your sessions and API tokens; your second factors; your votes, which come off every score they were in; your reports; and your messages to the administrators.

Kept: your comments and screenshots, with no name beside them, so the threads they are part of still read; the text of comments you deleted, until 30 days after each was deleted; your uploads and what they added, under your account’s number and not your name, so that they can still be taken back; and the moderation log’s lines about you, by number. Once the account is closed there is no way left to delete these, so delete any comment or screenshot you want gone first. Backups taken before you closed it hold the account until they are gone.

For anything this page does not cover, or anything you cannot do yourself, such as a request about your data, write to the administrators on the site, which needs you signed in, or email contact@thottbot-forever.com, which does not.

Changes to this page

This page changes when what the site keeps changes, and the date at the top says when it last did.