CARRY Privacy Policy

Last updated: October 2026 · Operated by CARRY · Contact: [email protected]

What We Collect

• Email address and username (account registration)
• Warcraft Logs links you submit for analysis, and the analysis of your own fight
• From public Warcraft Logs logs: anonymous statistics (spec, dungeon or boss, key level or difficulty, item level and the measured values), used as comparison samples
• Login provider tokens (Battle.net / Google OAuth) — we store only the user ID, not passwords

What We Do NOT Do

• We do not sell your data to any third party, ever
• We do not serve ads or use ad-tracking pixels
• We do not share individual player data with other guilds or users
• We do not store Battle.net or Google passwords
• We do not mine cryptocurrency or perform any background compute on your behalf

Other Players in Logs

A Warcraft Logs log contains every player of the group. CARRY only reads public or unlisted logs, never private ones. Anything from someone else's log that identifies a player other than the person who submitted it (names, realms, guilds, character ids, report codes) is deleted within 14 days of the fetch. What we keep from other people's logs is anonymous statistics only: nothing in them points back to a player or a log.

Data Storage

All data is stored on a single server in Canada. Raw Warcraft Logs data is deleted within 14 days of the fetch. Your account and your own analyses are kept while your account is active; anonymous statistics are kept. You may request full deletion at any time by emailing [email protected].

Your Rights

• Access: request a copy of all data we hold on you
• Correction: update or correct any stored information
• Deletion: request complete removal of your account and all associated data
• Portability: receive your data in machine-readable format (JSON)

To exercise any of these rights, email [email protected]. We respond within 30 days.

Third-Party Services

• Warcraft Logs API — used to fetch raid log data; governed by WCL's own terms
• Blizzard Battle.net OAuth — optional login; we receive only your BNet account ID
• Google OAuth — optional login; we receive only your Google user ID and email
• Resend — transactional email delivery (activation and notification emails only)
• Cloudflare — CDN and DDoS protection; see Cloudflare's privacy policy for their data handling

Quebec Law 25 (Act Respecting the Protection of Personal Information in the Private Sector) & PIPEDA

CARRY operates from Canada and complies with Quebec Law 25 and the federal Personal Information Protection and Electronic Documents Act (PIPEDA). We collect only the minimum data necessary, obtain consent at registration, and provide access and correction rights as described above. Our Privacy Officer can be contacted at [email protected].

Security

Passwords are hashed with bcrypt and never stored in plaintext. HTTPS is enforced via Cloudflare. The server is not publicly accessible on any port other than 443 (HTTPS). We do not log individual request bodies.

Cookies

CARRY uses a single session cookie for authentication (Flask-Login). We do not use tracking cookies, analytics cookies, or advertising cookies.

Changes to This Policy

If we make material changes, we will update the date at the top and notify registered users by email. Continued use of CARRY after notification constitutes acceptance.