Who we are
Morally Grey is a World of Warcraft guild community (Magtheridon-EU). This site lets members sign in, link their game accounts, and take part in guild tournaments. We are the controller for the personal data described below. To exercise any of your rights or ask a privacy question, email privacy@morallygrey.org or contact a guild administrator on our Discord server. The email address works even if you have left the guild or its Discord server.
What we collect
- Discord account. When you sign in, we receive your Discord user ID, username, avatar, the email address on your Discord account, and your roles in our Discord server (OAuth scopes
identify, email,guilds, guilds.members.read). We use this only to verify guild membership and to grant access; the email is stored with your sign-in account and is never used for marketing. - Battle.net / World of Warcraft. If you link your Battle.net account (scope
wow.profile), we receive your BattleTag and your WoW characters (name, realm, class, item level, Mythic+ score, avatar). - Tournament data. Your sign-ups, the characters you enter, role preferences, team assignments, and the final tournament results and standings.
- Guild activity records. Loot-distribution history — which item was awarded to which character — kept as the guild's shared fairness ledger.
- Content you submit. Feedback, comments, and any images you attach.
- Officer meeting notes. Officers keep private notes of their meetings, visible only to officers. If you are an officer, we record which meetings you created, edited and attended. Notes can also mention members by name — for example roster or recruitment discussions.
- Raid death statistics. For officers' progression reviews we record, from the guild's Warcraft Logs, which of our characters died in each raid pull, when, and to what — plus any correction an officer makes (with their name and reason). Visible only to officers.
- Error diagnostics. When something breaks in your browser we log the error message, the page it happened on, and your browser user-agent so we can fix it. No cookies. While your account exists these are linked to it; when you delete your account the link is removed (the diagnostic entry is anonymised), and the entry is then purged within 90 days.
Why we use it (lawful basis)
- Providing the site & verifying membership — necessary to deliver the service you ask for (GDPR Art. 6(1)(b)).
- Linking your game accounts — your consent, given through the Discord and Battle.net authorization screens (Art. 6(1)(a)). You can unlink at any time.
- Abuse prevention (rate limiting) and error diagnostics — our legitimate interest in running and protecting the site (Art. 6(1)(f)).
- Guild loot & tournament records — our legitimate interest in keeping an accurate, lasting record of guild loot distribution and competition results (Art. 6(1)(f)). These records identify in-game characters rather than real-world individuals and are retained even after an account is deleted (Art. 17(3)).
How long we keep it
- Error diagnostics: 90 days. Notifications: 60 days. Feedback screenshots: 30 days after a report is resolved.
- Internal admin and audit records (the admin audit log and tournament activity log): 180 days. These accountability logs may include a snapshot of your username at the time of an admin action (e.g. a ban, role change, or being added to a team). That snapshot is retained for this window even after you delete your account, and is removed when the record ages out.
- Your account and the data linked to it: until you delete your account (see your rights below).
- Loot-distribution history and finalised tournament results: retained as guild records even after account deletion, as they identify in-game characters and form a shared historical ledger. A full copy is included in your data export.
- Officer meeting notes: kept as guild records for running the guild (our legitimate interest, Art. 6(1)(f)). When an officer deletes their account, their attendance is removed and their name is detached from notes they wrote. To ask about notes that mention you, contact a guild administrator.
- Raid death statistics: kept as guild records for the raid tier they belong to. They identify in-game characters, are included in your data export, and an officer's name is detached from their corrections when they delete their account.
Your rights
You have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Specifically:
- Delete your account and associated data from your profile page. (A username snapshot may remain in our accountability logs for up to 180 days — see “How long we keep it” above.)
- Export your data as a machine-readable file from your profile page.
- Hide individual characters from the public roster from your profile.
- For anything else, or to lodge a complaint, email privacy@morallygrey.org or contact a guild administrator. You may also complain to your local data-protection authority.
Who we share it with
We do not sell your data. We use the following processors to run the site:
- Supabase — database, authentication, and file storage (hosted in the EU).
- Vercel — website hosting and request logs.
- Upstash — rate-limiting (processes your IP to throttle abuse).
- Discord and Blizzard / Battle.net — account sign-in and game data.
- Raider.IO and Warcraft Logs — we send your character name and realm to fetch public Mythic+ and raid data.
- Wowhead (Zam Network, US) — item and spell tooltips. Your browser loads the tooltip script directly from Wowhead's servers, which therefore see your IP address and browser user-agent, like any site you visit. We send them no account data.
Some of these providers may process data outside the European Economic Area; where they do, transfers are covered by Standard Contractual Clauses or an equivalent safeguard.
Your guild roster (character names, realms, and scores) is shown publicly. You can hide any character from your profile.
Children
This site is intended for members of our guild aged 16 or over. We do not knowingly collect data from children under 16. If you believe a child has provided us data, contact a guild administrator and we will remove it.
Changes
We may update this policy. Material changes will be noted by updating the date at the top of this page.