Privacy

Last updated: November 7, 2026.

This notice is issued by Friend Feed ("we"), the operator of the Friend Feed service and the data controller for everything described here. You can reach us at support@friendfeedwow.com. This page explains what the Friend Feed website, server and desktop app store about you, why, where, for how long, who can see it, and how to get a copy or delete it.

What we store

• Your Battle.net account id and BattleTag, from signing in with Battle.net. We never see your Battle.net password or email address.
• Your Battle.net friend list, as BattleTags, uploaded by the app. We use it only to find out which of your friends also use Friend Feed and have you on their list too.
• Your milestones recorded by the addon: character name, ruleset, time, and what happened (for example the item id, quality and name of an epic drop, a new level, an achievement, mount, pet or toy, or a character death with its level and zone).
• Public profile and follows (only if you use them): whether your profile is public, your handle, an optional Twitch, YouTube or Kick link, and the list of public profiles you follow.
• Connected apps: a name for each signed-in app (like "James's PC"), when it was signed in and last used. The app's sign-in key is stored only in a scrambled (hashed) form, so it can't be read back even by us.
• Payments: if you upgrade to the Offline & Social Tier, Stripe tells us the payment id, amount, currency and whether it was paid, refunded or disputed. Card details go to Stripe only; we never see them. We also record when you ticked the box accepting the Terms at checkout, and which version, in case a payment is ever disputed.
• Abuse protection: short-lived counters to limit how often the service can be called. For sign-in requests these are keyed by a hashed IP address and deleted within about a day.
• Site statistics: we count page views on this website (which page, and the name of the site that linked you here, like reddit.com) and clicks on the download buttons. To count each visitor once a day we keep a one-way, keyed hash of your IP address and browser type, which can't be turned back into either, and delete it after about two days. Only daily totals are kept. No cookies, nothing stored in your browser, nothing linked to your account, and nobody outside Friend Feed sees it.
• Server logs: our hosting provider keeps standard request logs (time, path, IP address, browser type, errors) for up to 30 days, for security and debugging.
• Email: if you write to us, we keep the conversation for as long as we need it to help you.

What we don't collect

• No chat, gold, inventory, location, play time, who you group with, or anything else from the game.
• No Battle.net password, email address or real name. Battle.net gives us only your account id and BattleTag.
• No third-party analytics, tracking pixels, advertising IDs or fingerprinting on this website, and nothing that follows you from one day to the next or onto other sites. The site statistics above are counted on our own server. The only third-party script is Google AdSense, and only if ads are switched on.
• No data from people who only use the addon without the app.

The desktop app

• It reads one file in your game folder, the addon's saved settings file (FriendFeed.lua under WTF/Account/.../SavedVariables), after you log out, and uploads your new milestones and friend list from it. It writes one file, Inbox.lua, into the Friend Feed addon folder.
• It can also install the Friend Feed addon into Interface/AddOns/FriendFeed and keep it up to date (you can turn automatic addon updates off). It only ever writes inside that folder.
• It talks to friendfeedwow.com, and to GitHub to check for and download app and addon updates, always over HTTPS. It sends no telemetry, crash reports or usage statistics.
• It keeps its sign-in key on your computer encrypted with your operating system's own protection (Windows DPAPI or the macOS Keychain), and a small settings file (game folder, BattleTag, whether you're paid). Signing out in the app removes the key.
• It doesn't run inside the game or read anything else on your computer.

Why we store it (legal basis)

• To provide the service you asked for (our contract with you under the Terms): your account, friend list, milestones, profile, follows, connected apps and payments. Without these, Friend Feed can't work.
• Our legitimate interest in keeping the service secure and working, and in being able to answer a payment dispute: rate limits, server logs and the record of your acceptance of the Terms. Also in knowing how many people visit the site and download Friend Feed: the site statistics.
• Your consent, where the law requires it: cookies that aren't strictly necessary (ads), which you can refuse.
• Legal duties: keeping payment records for as long as tax and accounting law requires.

Who can see your milestones

Only Battle.net friends who have you on their friend list and whom you have on yours, who use the app, and who are on the Offline & Social Tier. They see your milestones from the last 30 days, labelled with your BattleTag. Nobody else can see them, and we don't sell or share them.

If you turn on a public profile in the app, anyone using the app can find you by your handle and see your link, how many followers you have, and the character name and ruleset of your most recent milestone. The same details, plus how many people you follow, the month you joined and your most recent milestones (up to 20, with their character name, ruleset and where they came from), are shown to anyone on the public People pages of this website, which search engines may index. Unlocked accounts that follow you also receive your milestones from the last 30 days, shown under your handle. Followers and visitors never see your BattleTag. When you turn the profile off, you disappear from search and from the People pages, and delivery to followers stops right away.

Who we share data with

We share data only with the companies that run things for us (our "processors"), and only as much as each needs. We never sell it, and we never give it to advertisers or data brokers.

• Blizzard Entertainment (Battle.net) signs you in. Blizzard tells us your account id and BattleTag; we tell Blizzard nothing. Blizzard's own privacy policy covers the sign-in.
• Google Cloud (Cloud Run) hosts the website and the API, in the United States (Google Cloud, us-east4, Virginia). Google also keeps the server logs described above.
• Supabase hosts the database, in Canada (Supabase, ca-central-1).
• GitHub hosts the app and addon downloads and updates. Like any download, GitHub sees your IP address and that the file was fetched; we send it nothing about you. GitHub's privacy statement covers that.
• Stripe takes payments. Stripe sees your card details and, if you give it, your email address for the receipt; we see only the payment id, amount and status. Stripe's privacy policy covers that.
• Google AdSense shows ads on this website only, if ads are switched on, and only after you consent where the law requires it. Google may set cookies and see your IP address and browser. The addon and the app never show ads.
• If Friend Feed changes hands (for example someone else takes over running the service), your data may go with it, under this same notice. We'll say so on this website first, and you can delete your account before that happens.
• Nobody else, unless the law requires it (for example a valid court order), or to defend a payment dispute with Stripe or your bank, where we may share the payment record and the record of your acceptance of the Terms.

Where your data goes

Our servers and database are in the United States (Google Cloud, us-east4, Virginia) and Canada (Supabase, ca-central-1), so your data is stored there wherever you live. Blizzard, Stripe and Google may process data in the United States and elsewhere. For people in the EU, UK and Switzerland, these transfers rely on the providers' standard contractual clauses or an adequacy decision; email support@friendfeedwow.com if you'd like a copy.

How long we keep it

• Milestones: deleted automatically once they are more than 60 days old (this happens each time your app syncs). Friends only ever receive the last 30 days.
• Account, friend list, profile, follows, connected apps: until you delete your account.
• Payment records: seven years, or as long as tax and accounting law requires, even if you delete your account. They hold the payment id, amount and status, not your card details.
• App sign-in codes: ten minutes. Website sign-in: up to 30 days. Rate-limit counters: about a day. Server logs: up to 30 days. Site statistics: visitor hashes about two days; the daily totals, which say nothing about any one person, as long as the site runs.
• Backups: our database provider keeps backups for up to about a week. Deleted data disappears from backups when they are overwritten. Backups are never used to restore data you deleted.

How we protect it

• Everything travels over HTTPS, between your browser or app and us, and between us and our providers.
• App sign-in keys and sign-in codes are stored only as one-way hashes. Website sessions are signed cookies that can't be forged.
• The database accepts connections only from our server, and every table is locked against direct access. Only the operator has access to it.
• Uploads are checked and size-limited, and every part of the service is rate limited, so one account can't read or flood another's data.
• No system is perfectly secure. If we ever find a breach that puts your data at risk, we'll tell you on this website and, where the law requires it, notify the relevant authority within 72 hours.

Cookies

• ff_session: keeps you signed in to this website for up to 30 days. Strictly necessary.
• ff_oauth: a short-lived cookie (10 minutes) that protects the Battle.net sign-in from forgery. Strictly necessary.
• If ads are switched on, Google AdSense may set its own cookies on this website. Where the law requires it (for example the EU, UK and Switzerland) you'll see a consent message first, and you can refuse. Refusing doesn't change anything else about Friend Feed.
• Do Not Track: this website doesn't respond to your browser's Do Not Track signal, because it doesn't track you in the first place. If ads are on, Google decides how it treats the signal.

Your choices and rights

• Download your data at any time from your account: one JSON file with everything listed above.
• Delete everything at any time from your account. It's removed from the database right away (payment records excepted, as above).
• Sign out any connected app from your account page.
• Turn your public profile off in the app, which stops search and delivery to followers immediately.
• Email support@friendfeedwow.com to ask for a copy of your data, to correct it, to delete it, to object to or restrict how we use it, or to withdraw consent. We'll answer within a month and never charge for it. To protect your data we may ask you to sign in with Battle.net first, so we know the request is yours.
• Complaints: we'd rather fix the problem, so please write to us first. You can also complain to a privacy regulator: in Australia the Office of the Australian Information Commissioner (OAIC), in the EU your national data protection authority, in the UK the Information Commissioner's Office (ICO).
• We make no automated decisions about you, and we don't profile you.

People in the EU, UK and Switzerland

The GDPR and UK GDPR give you the rights listed above: access, rectification, erasure, restriction, portability, objection, and the right to withdraw consent at any time. Our legal bases are listed under "Why we store it". We are the controller and have not appointed a representative in the EU or UK, because the processing is occasional and low-risk. You may complain to the supervisory authority where you live.

People in California

In the last 12 months we have collected these categories of personal information: identifiers (BattleTag, Battle.net account id, IP address), commercial information (your payment), and internet activity on this website (server logs and the site statistics). We collect them directly from you, from Battle.net and from Stripe, for the purposes above. We do not sell your personal information, and we do not share it for cross-context behavioural advertising. You have the right to know what we hold, to delete it, to correct it, and not to be treated differently for using those rights. Use your account page or email support@friendfeedwow.com. An authorised agent may act for you if they can show your permission.

People in Australia

We handle personal information in line with the Australian Privacy Principles, whether or not the Privacy Act 1988 applies to us as a small business. Your data is stored overseas, in the regions named above. You can access or correct it from your account page or by email, and complain to the OAIC if we don't resolve a problem.

Children

Friend Feed is not meant for children under the age needed to have a Battle.net account in their country, and we don't knowingly collect data from anyone under 13. If you think a child has given us data, email support@friendfeedwow.com and we'll delete it.

Changes

If this notice changes, we'll update the date at the top of this page and mention it on this website. If a change would let us use your data in a new way, we'll ask before we do.

Contact

Anything about your data: email support@friendfeedwow.com.