Privacy policy

What Meadhall keeps about you, why, where, for how long, and how to get rid of it.

Last updated: 16 October 2026

Who runs Meadhall

Meadhall (meadhall.app) is run by Nathan Preen (privacy@meadhall.app), who is responsible for your data under this policy (the "controller", in data protection law). It is a fan project, not connected to NCSOFT or Blizzard Entertainment.

The short version

You sign in with Discord. Meadhall has no passwords of its own.
We keep what the hub needs to work: your name, your Discord id, your email if Discord gives us a verified one, your settings, and what you and your groups put in.
What identifies you is encrypted field by field with a key of your own, before it's stored.
It's stored with Amazon Web Services in London (eu-west-2), except the public pages' visit counts, which are kept on Meadhall's own server in the UK (see Counting visits to the public pages).
No adverts, no third-party analytics or tracking scripts, no analytics cookies, and we never sell your data or share it for advertising. Meadhall keeps service-wide operational counts as described below, and the public pages have a first-party, cookieless visit counter (see Counting visits to the public pages). Some services see parts of your data so Meadhall can work (Discord, Amazon Web Services, Paddle for a group's payments, and ImprovMX for email you send us; see Who else is involved), and what you put in a group is seen by that group's members. Meadhall also reads public raid status from Masterwork, and World of Warcraft raid loot lists from Battle.net, without sending either member data.
You can delete your account yourself, from the account page, at any time, or ask us to start the same deletion for you.

What we collect, and why

When you sign in with Discord

We ask Discord for the identify, email and guilds permissions. From Discord's answer we keep:

Your Discord user id, to recognise you the next time you sign in, and to match you with your group's Discord server when a group links one (for Discord role sync). It is stored encrypted, and the lookup that finds your account uses a keyed hash of it, never the id itself.
Your Discord display name (or username), as your starting name on Meadhall. You can change it on the account page.
Your email address, only if Discord says it is verified. It is shown to you on your account page. Meadhall does not send email today.
Nothing about the Discord servers you're in. We read the list of them at sign-in (the guilds permission) only to find Meadhall groups that have linked one of those servers, comparing keyed hashes of the servers' ids, never the ids themselves. For each such group you aren't in yet, we keep a suggestion for 30 days (the group's name, game, server, realm if it has one, and kind), so Create or join can offer to send it a join request. We keep no server ids or names.

We don't keep the access token Discord gives us: it is used once, during sign-in, to read the details above, and then dropped.

What you add

Your profile: name, time zone and language, and, once you choose a character with the Discord bot's event buttons, which of your characters it signs you up as on each game and server (the character's id only, kept with your account, so it doesn't ask again; deleted with your account). When you last saved a character on each game and server is kept with your account too, so your groups' character update reminders go only to members who haven't updated theirs; it's deleted with your account.
Your characters: name, game and server, and optionally class, level, whether it's your main and, for a Lineage 2 character, its subclasses (each one's class and level), or for a World of Warcraft character, its realm and item level, or for a character on Reborn, its world (Signature x1, Eternal x10 or Origins), which decides its classes. The members of each group you're in see your main on that group's game and server (its name, class, level and subclasses; the highest level if you mark more than one) on the group's People and Stats pages, and on People, for World of Warcraft, its realm and item level too, read from your account when the page is opened; the Clan page shows the same details for characters placed in a clan when that character is visible there. Your alts aren't shown on People, and nothing is until you mark a main. In each group you're in, people holding Change the class and level of members' characters (its leaders, and anyone they give it to) can change the class and level of your characters that group sees (not their own: those they change on their Me page) (your main and any alt not marked Private, on its game and server), in your account, as you can; a leader's characters only its leaders can. Nothing else about a character can be changed by anyone but you. Who made the change is kept with the character (their account id, their name as that group knows them, encrypted with your account's key, the group and when) and shown on your Me page until you save that character yourself or remove it; the group also keeps a record of the change (whose character, who changed it and their name in the group then, encrypted with the group's key, when, and the class and level before and after), which its ttl deletes 90 days later, or sooner if the group is deleted. You're sent a Discord DM saying who changed it unless you switch that DM off. When your group shares characters with a linked group, subclasses go with the same characters and follow the same main, alt and Private rules. For a World of Warcraft character, the raid lockouts you tick (which raid, which difficulty, and when you ticked it): the members of your groups on that game and server see your main's on the Raids page, and only you see your alts'. An officer who may record boss kills can also lock everyone confirmed at one of the group's events, on the character each signed up as, or on their main on that server. Each lockout ends at the weekly reset, and the record of it is deleted within about a week after, or with the character.
Your saves in the public tools, if you sync them: a public tool keeps its save in your browser (below). When a tool offers to keep its save on your account and you sign in on it (the LU4 craft calculator is the first to come), the save is also kept there, so it follows you to another browser: everything the tool keeps, such as your characters' names and inventories, your prices and their history (with the seller's character name an imported price named), and your plans. Signed in, the craft calculator reads your account's Lineage 2 characters (as your Me page does) and keeps each one's inventory in its save beside the character's id; a character you add in it is added to your account, as on your Me page. It is encrypted with your account's key as one sealed value, so nobody can read any part of it without that key, and stored with a revision number and when it last changed. Only you can read or change it. It's kept until you change or clear it in the tool, or delete your account, and it's in your data export.
Which clan your characters are in: in a Lineage 2 group with box clans, you can say which of its clans each of your characters on its server is in. The group keeps only that choice; your character's name, class, level and subclasses are read from your account when its clan page is opened, so a change or removal shows straight away. The group's members see your main in its clan's list. An alt is shown to them only if you tick Show to my clan; otherwise it's counted in its clan but not named. Officers can move a character they can see to another clan. The choice is deleted when you leave the group, when you delete that character, and when the box clan it names is removed.
Group crests: an image a group may upload as its crest, encrypted with the group's key, kept in members' browsers to show it, and deleted with the group.
In your groups: your membership and roles (in an alliance, the CP you lead, if you're made a CP lead: the alliance keeps a record of that after you leave or delete your account, for its legitimate interest in keeping that limit in force if you come back, and the record is still there if you do: see "Deleting your account" below), join requests, event sign-ups and their notes, a World of Warcraft event's soft reserves (the items you reserve, the character you signed up as, and when; everyone in the group sees them), a loot council wishlist (the items you want from each raid, how much and why, and the character; only you and whoever logs the group's loot see it), attendance (who came to an event), party plans (who goes in which party), raid timer records (including who recorded a kill), clan entries (including what a clan spent before tracking began, with a note saying what and the date if given), which of a Lineage 2 group's clans each of your characters is in (if you say), DKP entries (points given or spent, with their reasons), the loot log (what dropped, who got it, how, and any DKP price, or the adena or gold an auction sold it for; for an item a loot council gave, who had wished for it and how much, which only whoever logs the group's loot sees; and in a World of Warcraft group, which raid it came from, if given: in a loot council group, whoever may log the group's loot sees, for each member, which items they received from that raid in the last eight weeks and when), and what leaders and officers set up (the group's name, a World of Warcraft group's realm, a Lineage 2 group's world or the name of its server, if it typed one, the names of its box clans, roles, joiner codes, events and their reminders (and the Discord role an event's post pings and the Discord channel it's posted in, if either is chosen, and the group role it may nudge for not signing up), raid rules, DKP pools and activities, the linked Discord server and its role mapping (with the permissions each mapped role had when it was mapped), and the Discord webhook used for reminders).
DKP claims: when you claim points for a party, the activity, when it was, who was in the party, your note, and the screenshots you upload as evidence; then whether an officer approved or rejected it, and why.
Reading a claim screenshot: if you choose "Read it", the part of the screenshot you mark is read by Meadhall's own text-reading service, which runs in our AWS account in London and keeps nothing. What it reads is shown to you as suggestions and isn't stored: only what you tick and send becomes part of your claim.
Auctions: the item and its note, whether it's bid in DKP or in the game's adena or gold, the starting bid and step, every bid (who, how much and when), in a DKP auction the DKP a leading bid holds until the auction ends, and who won and for how much. Meadhall never knows how much adena or gold you have: an adena or gold bid isn't checked against anything, and the winner pays in the game.
Linked groups: when an alliance, clan or CP links to another group, which groups are linked, their names and kinds, and one-use link codes. On its own a link shares only names and kinds. The lower group's leader may also choose to share its members' characters with the group above (asked when linking, and changeable in its Settings; a link made before 28 September 2026 shares nothing until they choose). While it does, the group above keeps a copy of each member's characters on that game and server: the character's name, class and level (and, on Reborn, its world), whether it's their main, and which group they're in. Never your account name, email or Discord id, except as follows. A CP under a clan: while the CP shares, each of its members is also a member of the clan, holding the clan's role for them, so the clan sees you as it sees any member (your account name, when you joined, your roles, your main on its People page) and keeps your Discord id, sealed with the clan's key, so that its Discord role sync can read your roles on its server. You leave the clan when you leave the CP, when the CP stops sharing or the link ends, or when you delete your account, unless you joined the clan yourself too. Your main is always shared while your group shares; an alt you mark Private on your Me page is not, and nothing is shared until you mark a main. People in the group above who hold the permission See the characters linked groups share can see the copy, on its People and Stats pages and through its Discord bot; every starter role (Member, Officer) holds it, so by default that's everyone, and its leaders can take it away. The copy is kept only while it's shared: it's deleted when sharing is turned off, the link ends, you leave the group, you remove the character or mark it private, or you delete your account, and a nightly check deletes anything missed. A clan's Proof of Loyalty totals and skills (never who gave what) are shown to the CPs linked under it. An event the group above sends to yours is copied into your group: its title, time and details. When you sign up on an event the group above sent to yours, the group above sees your sign-up: your character's name, class and level (and, on Reborn, its world), and whether you're in, late, maybe, can't come or on the waitlist for a place (not your note, and not your account). When your group confirms you came to an event the group above sent, the group above's DKP gets a line: the points, the event, your group and the name of whoever confirmed it. The line is tied to you, not a character: the group above shows it under your shared main while your group shares, and without a name once it stops; if you're a member there too, it's on your own balance there. DKP lines are never deleted (a mistake is reversed).
An alliance's roster: an alliance's officers may keep a list of the characters in its CPs, as alliances keep in spreadsheets, including characters of players who have no Meadhall account: each character's name and its other names (Queen Ant, Zaken, box), its clan, CP, class, status (active, inactive, left, box, reorganising), noblesse, level band and point multipliers, a note, and who added or last changed it, when. It isn't linked to anyone's Meadhall account. Everyone in the alliance holding See the alliance roster can see it (every starter role holds it, so by default that's everyone in the alliance); people holding Keep the alliance roster (Officers, by default) change it, and a CP lead only their own CP's characters. It's kept until they remove a character or the alliance is deleted, and it's in the export the alliance's leaders, and anyone they give Download the group's data, can download. Its characters can be given DKP points (alliance DKP): each line keeps the points, the multiplier applied, the pool, the reason (encrypted), who gave them and when. Lines are never deleted (a mistake is reversed by a new line), so a character with DKP lines stays on the roster, marked Left if it goes, for as long as the alliance keeps it. Nothing about it reaches a CP linked under the alliance. It can also be imported from a spreadsheet: the file is read in the importer's browser and never uploaded; Meadhall receives only its rows, and keeps the file's name (encrypted), who imported it and when, to recognise it and to let the import be undone. Its DKP points can be imported the same way: each imported point becomes a DKP line as above, marked as imported with the file it came from, and undoing the import reverses those lines with new ones. The import's record (the file's name, encrypted, who imported it and when) stays after an undo, so the same file can be imported again; it goes with the alliance. Its prices and drops can be imported the same way: each imported line becomes a price or a drop as below, marked with the file it came from, and undoing the import removes them (and any item the import added that nothing else names); that import's record (the file's name, encrypted, who imported it and when) goes once none of its lines is left.
An alliance's item price list: an alliance's officers may keep a list of items with what each is worth in adena: each item's name (as the game spells it), type (jewel, book or other) and the epic it drops from, and its prices, each with the day it starts, who set it and when. Everyone in the alliance holding See the alliance roster can see it; people holding Keep the alliance's item price list (Officers, by default), other than CP leads, change it. It's kept until they remove a price or an item, or the alliance is deleted; an item a recorded drop names can't be removed (drops are voided, never deleted, unless their import is undone), so it's kept until the alliance is deleted or no drop names it. It's in the export the alliance's leaders, and anyone they give Download the group's data, can download. Nothing about it reaches a CP linked under the alliance.
A group's craft calculator prices: an LU4 group's members may keep shared prices for the craft calculator: for each item or craft shop fee, its price in adena, who set it and when, the seller's character name if an imported price named one (a player in the game, whom every member sees with the price), and its last 50 changes, each with who made it, when and that seller (a removed price leaves a mark that it was removed, by whom and when). Prices only: nobody's characters or inventories are shared with the group. Every member can see them, but not who set them or made a change (the calculator shows only when, and whether it was you); people holding Change the group's craft calculator prices (LU4) (every member, by default) change them. Every night, each item's current price in every LU4 group goes into a median across groups, which anyone can read (the calculator's estimated prices): an item gets one when any group prices it, from prices set in the last 60 days, so where only one group prices an item, that group's price can be read from it (a minimum number of groups will come back as more clans use Meadhall), and it says only the median and how many groups it came from, never which groups or who set them. A craft shop's fee isn't included. They're kept until the group is deleted, and they're in the export the group's leaders, and anyone they give Download the group's data, can download.
An alliance's drops: an alliance's officers may record its drops: each drop's epic, item and day, the CPs that asked for it, the CP it went to and how (claimed or assigned), or that nobody claimed it and what it sold for, its value in adena (from the price list on its day, or set by hand), a note (encrypted), and who recorded or last changed it, when. Everyone in the alliance holding See the alliance roster can see them; people holding Record the alliance's drops and who got them (Officers, by default) record and change them, and a CP lead only records a drop as open and asks for drops for their own CP. A drop is never deleted: a mistake is voided, with a reason (encrypted), and kept, so drops are kept until the alliance is deleted, except imported ones, which undoing their import deletes. They're in the export the alliance's leaders, and anyone they give Download the group's data, can download. Nothing about them reaches a CP linked under the alliance.
An alliance's pick-order periods: for each period, the day it starts and who opened it, when. When its officers close one, Meadhall works out, from the alliance's DKP ledger, each CP's DKP up to the end of the period's last day, and keeps, for each CP, its DKP, its Left characters' points, its Spent line, its percentage of the DKP, how many drops it was given in the period, its share of the period's sold adena and its place in the order; and, for each counted roster character with points, its CP and its points up to that day (by the roster's id, not its name); who asked to close it and when, and, if a close didn't finish, why (the ledger failed its integrity check, DKP kept being written while it was read, it took too long, or it couldn't be started). Everyone holding See the alliance roster sees them; people holding Record the alliance's drops and who got them (Officers, by default; never a CP lead) open, close and reopen them (reopening the latest closed period removes what was kept at its close). In Discord, anyone who can use /fairness can share the open period's pick order to a channel: everyone who can read that channel, in the alliance or not, then sees each CP's name, DKP, percentage and share of the adena (no character names). They're kept until the alliance is deleted, and they're in the export the alliance's leaders, and anyone they give Download the group's data, can download. Nothing about them reaches a CP linked under the alliance.
An alliance's epic jewels: when its officers allocate one of an epic's allocated items (its jewels and books, or other items the alliance chooses to put through allocation), Meadhall keeps the item, the CP it went to, the day, its place in the pick order, any reason given for skipping first pick (encrypted), which characters' points moved to the CP's Spent line and how many (by the roster's id, not the name), and who allocated it and when, and, when a leader broke one of the alliance's rules to give it or an allocation was undone, who did and the reason (encrypted), with the points it moved given back as new lines in the ledger; the item is also kept as one of the alliance's drops (above). It keeps each epic's settings too: how many top performers' points an allocation moves, any CP's own number, and which items go through allocation. Everyone in the alliance holding See the alliance roster, Award alliance DKP to the roster's characters, Record the alliance's drops and who got them or Allocate the alliance's epic jewels can see them, with the names of who allocated and who undid each; people holding Allocate the alliance's epic jewels (Officers, by default; never a CP lead) allocate, undo the latest allocation in an epic and change the settings, and only the alliance's leaders break a rule. They're kept until the alliance is deleted, and they're in the export the alliance's leaders, and anyone they give Download the group's data, can download. Nothing about them reaches a CP linked under the alliance.
The Discord bot, if your group adds it to its server: your Discord user id when you use a command (to find your Meadhall account), the server's id (to match it to the group that linked it), the group you picked for that server if it has more than one, and, for about an hour, a record that a command is being answered so it isn't run twice. When you open /people roster, the class and level of each member's main it shows (never a character's name) are kept in your account, encrypted with your account's key, so its pages and filters don't read every member's characters again. They're used for 15 minutes, then set to expire, and DynamoDB deletes expired records automatically, usually within a few days. For the group: the channels the bot posts in, whether members may share replies, how joining from Discord works, whether and how often registration reminders and character update reminders are sent, the language of its public posts, whether it adds events to the server's Events, the posts it keeps up to date (and the ids of the scheduled events made for them), and the group's join panel if a leader posts one (where it is, whether it's pinned, and the line the leader wrote on it). The panel shows publicly on the server the group's name, crest, kind, game and server (with its realm, for a World of Warcraft group, or its world or server name, for a Lineage 2 group on a server other than LU4) and that line. Discord role changes a group applies from the hub go into the group's changelog (who, when, and each member's roles before and after). With /lu4 craft and prices: mine, the bot reads your own synced craft calculator save (its prices) to answer you privately; nothing from it is kept or shown to anyone else. /lu4 price records the group's price under your name, with its history, as the calculator does (see A group's craft calculator prices).
Who is still on the group's Discord server, if the group links one and adds the bot: every 15 minutes, and within seconds when Discord tells us someone joined or left the server or had their roles changed, Meadhall checks the group's members against Discord. A member who is no longer on the server (or has lost the group's role) is marked as having left Discord: the mark is the time Meadhall first found them gone, kept with their membership. After 30 days still gone they're suspended (kept in the group, with their roles and data, but locked out of it, and sent none of its Discord messages); coming back clears the mark, and so does the group unlinking the server. Leaders, and members who are in a group only through a linked CP, are never marked. A member still on the server loses a role whose Discord role they no longer hold. If someone who manages the group's Discord link turns registration reminders on, Automatic joining and a specific group role are also required: at the 15-minute check, Meadhall compares the Discord ids holding that role with the encrypted Discord ids on the group's member records, then asks Discord to privately send the registration link to role holders who are not yet members. Someone who manages the link can also press Send the link now to send it once at the next check, in their name; until it's sent, Meadhall keeps which member asked and when (the time is kept, to allow it once a day). The message names who sent it (that member, or the group's leaders), the group, the server, and the group's join panel if it has one; it can open with words the group's leaders wrote, kept encrypted with the group's key until they change or clear them, or the group is deleted. The queue carries their Discord ids (and, for Send the link now, the Meadhall account id of the member who asked, so the message can name them) only until the messages are handled, normally seconds and at most a day; a message that repeatedly fails moves to an encrypted dead-letter queue for up to 14 days so the operator can diagnose or retry it. Meadhall keeps when the group last completed a batch and, only while retrying a partially failed batch, one-way hashes of the recipients still waiting; it does not keep a list of who was messaged. If someone who manages the group's Discord link turns character update reminders on, Meadhall keeps when they did, and at the 15-minute check after each interval it queues one message per member (their Meadhall account id); each is sent as a private Discord message, by the Discord id kept with their account, only if they haven't saved a character for the group's game and server within the interval and haven't switched these messages off. Meadhall keeps when the group last completed a batch and, only while retrying a partially failed one, the account ids still waiting; it does not keep a list of who was messaged. Discord's notices reach us through a small listener we run on our own server; it passes on only the server's id and the person's Discord id (for anyone on the server, member or not), which wait in a queue at Amazon Web Services until Meadhall has checked them with Discord, and it keeps and logs neither.

We use all of this only to run the hub for you and your groups: to show your groups their rosters, timers, events, points and loot, to post the reminders your group asked for (raid windows and events in its chosen Discord channel, registration links privately to eligible role holders, and character update reminders privately to its members, when the group turns those on), and to keep your group's Discord roles in step when the group has linked its server. An event reminder in Discord gives the event's title, when it starts and how many have signed up, not who. An event's post can ping one Discord role the event's maker chose, which notifies everyone holding that role on the server. If someone who manages the group's Discord link turns on adding events to the server's Events (off by default), each event the bot posts is also sent to Discord as a scheduled event on that server: its title, start and end time, details and a link to the post. Every member of the server can see it, even members who can't read the channel the post is in. It's updated as the event changes and deleted when the event is cancelled or deleted. An event can also have its own nudge role, one of the group's own roles (not a Discord role): if set, each of the event's sign-up reminders mentions its holders who haven't signed up for the event in the channel the event is posted in, where everyone who can read that channel sees who hasn't signed up. If the bot hasn't posted the event, Meadhall privately messages them instead, giving its title, start time and a link to it. Like every DM Meadhall sends, a nudge waits in a queue until it's delivered, normally seconds and at most a day; one that repeatedly fails moves to an encrypted dead-letter queue for up to 14 days so the operator can diagnose or retry it. Meadhall does not keep a list of who was messaged once delivery is done.

When a group pays for its plan

A group's leader can pay for a plan through Paddle, which sells the plan as the merchant of record: Paddle takes the card or PayPal details and the billing address, and charges the VAT, under its own privacy policy. Meadhall never sees card, wallet or address details. When a leader presses the button to pay, Meadhall's server asks Paddle to start the payment, giving it the plan's price and the ids of the group and the leader's account (nothing else about them), and the page then loads Paddle's checkout script from Paddle, only then: no other page loads anything from Paddle. To limit how many payments one account can start, Meadhall keeps an account-linked hourly counter of them, which stops counting after the hour and is set to expire two hours after the latest payment it counted (DynamoDB then deletes it automatically, usually within a few days). So that a group has only one payment open at a time, it also keeps, on the group, which leader's account, plan and period is being paid for and Paddle's id for that payment, for half an hour, set to expire a day later and then deleted the same way. Paddle's server tells Meadhall's about each payment, renewal, failed payment, cancellation and refund, and from those messages Meadhall keeps:

A record of each payment and refund: which group it's for and which account paid, the amount, the VAT in it and the currency, its status and time, and Paddle's ids for the payment and the subscription. A copy of it, without the account, is listed under its month so Meadhall's admin portal can show a month's payments.
The group's plan: which plan, until when, that Paddle manages it, and Paddle's ids for the subscription and the paying customer, with the subscription's status, whether it has been cancelled to end with the period paid for, and the time of Paddle's latest message about it; the id of the account that pays for it, so only that account can manage the billing and the group's other leaders can be told when it stops being a leader (they're told that the leader who pays has left, never who it is); and, for a founding group, whether its founders' discount has been used. The paying account's id stays on the group's plan record if that account is deleted, pointing to nothing, until a later payment replaces it.
A record of each message from Paddle: its id, its type, when it arrived and whether it was handled, not its contents. One that failed is also listed, with why, for the admin portal, and normally removed from that list as soon as it's handled; both are set to expire after 90 days, and DynamoDB deletes expired records automatically, usually within a few days.
A request to cancel a subscription, when the leader who pays stops being a leader of the group or the group is deleted: the group's and the subscription's ids, why, and when it was asked and last tried, not who pays. Meadhall asks Paddle to cancel that subscription (at the end of the period paid for, or at once if a payment has failed or the group is gone), and keeps trying until Paddle takes it; the request is then set to expire after 7 days.

When the leader who pays presses Manage billing, Meadhall's server asks Paddle for a link to Paddle's own billing page for the group's subscription, giving Paddle its ids for the customer and the subscription. The link signs that person in to Paddle's page for a short time; Meadhall passes it to their browser and doesn't keep or log it. Changing the card, invoices and cancelling happen on Paddle's page, under Paddle's privacy policy. Meadhall keeps an account-linked hourly counter of these links, the same way as the payment counter above.

A leader can also arrange by email to pay for a yearly plan in crypto (no processor: the payment comes straight to us). Then we keep the emails, and a record of the payment: the group it's for, the amount, the coin, when it arrived, its transaction id and the address it came from (both public on the blockchain), and the licence key it paid for, in the email we send it in (Meadhall's database keeps only the key's keyed hash, as for any key).

Public LU4 raid status

Every five minutes, Meadhall's server reads the public elemental raid-boss rating at mw2.global for Gamma, Black, White and Carmine. It keeps each server's last complete four-boss result, when that result and the latest attempt happened, and whether the latest attempt failed. This is public game state and contains no member data. Your browser never contacts mw2.global, and signing in, opening a group or changing pages does not cause a request to it.

Technical logs

Each request to Meadhall's API is logged with its time, route, result and the IP address it came from, and the API writes error logs. Successful group requests also write the route template, random group id and feature name, and routed Discord slash commands write the command name, so Meadhall can count feature and bot use. Pressing Add to Discord on the home page or the guide writes which of those two pages it was on, and linking a Discord server from a group's Settings writes only that a link started and how it ended (linked, cancelled, refused because the server already serves as many groups as it can, or failed), so Meadhall can count those. These usage events do not contain account, member or Discord ids, names or group content. Technical logs are kept for 30 days, to find faults, spot abuse and produce service-wide counts, and then deleted automatically.

Counting visits to the public pages

The public pages (the home page, pricing, the guide, the tools, the game pages, and this policy and the terms) count visits with a small script of Meadhall's own. It sets no cookie and stores nothing in your browser. When a page opens, it sends Meadhall's counter the page's address as it is, including anything after a ? or #, the site you came from (if your browser says), your browser's user-agent and your IP address. The hub's own pages (where you are signed in), the admin portal and the reader don't send it. The counter is Plausible, software we run on Meadhall's own server, not a service run by anyone else. It uses your IP address and user-agent only to work out your country and a visitor hash that changes every day, and keeps neither. Of the address, Plausible keeps the page's path (not anything after a #) and the campaign tags in it (utm_source, utm_medium, utm_campaign, utm_content, utm_term, ref and source), not the rest of the query. What is kept is counts: by page, by referring site, by browser, by operating system, by device type and by country, with no record of you. Pressing Sign in adds one "Sign in" count, carrying the address of the page you were on (without anything after a # or ?), the page you came to it from (Plausible doesn't keep a referrer from Meadhall's own pages) and nothing about you or your Discord account. The counts are for knowing which pages and sources bring people to Meadhall. If the counter can't be reached, or your browser blocks it, the page works the same and the visit isn't counted.

Stored in your browser

Your chosen language, and your saves in the public tools (such as the alchemy planner and the craft calculator), are kept in your browser's local storage. They leave your device only if you sign in on a tool that syncs its save to your account (above). A file you import into the craft calculator's prices is read in your browser and isn't uploaded: only the prices read from it (and any seller's name beside one) are saved, into your save or, with clan prices, as the group's (see A group's craft calculator prices). Export prices writes a file to your device and sends nothing. The LU4 lookups read your craft calculator prices from the same storage, to value what a zone's mobs drop and to show an item's price; that stays in your browser too. Signed in, an item's page also shows the clan prices of the LU4 groups you're in, which you can already see. Whether the craft calculator fills missing prices with estimates is kept in your browser too, and its estimates are read from Meadhall without sending anything about you; signed in, they also use the clan prices of the LU4 groups you're in, which you can already see. A tool that syncs also keeps, beside its save, which account it last synced with (its random id), the save's revision and a copy of what was last synced, so it can tell your changes from another browser's.
Event reminders in the browser: whether you've turned them on here and how many minutes before, and which reminders this browser has already shown. This is kept on this device, not in your account; turning reminders off clears the setting.
Small notes the hub keeps for its own display, such as whether you've closed the "getting started" card for a group.

The legal basis

We process your data because you asked us to provide the service by signing up (performance of a contract), and, for technical and support audit logs, for our legitimate interest in keeping the service working and secure. Payment records are kept because the law requires a business to keep its financial records (legal obligation). An alliance's record of a former CP lead, kept after they leave or delete their account, rests on legitimate interests too: keeping the alliance's limit on that person in force if they come back (see "Deleting your account"). So does the record that someone redeemed a founder code, kept after their account is deleted: keeping the offer to one code a person.

Encryption

Your own fields (your name, email, Discord id, character names and the public tools' saves synced to your account) are encrypted before they're stored, with the AWS Encryption SDK and a key that belongs to your account alone. Each value is bound to the record and field it belongs to.
Group content (member names within the group, the characters a linked group shares with it, an alliance roster's names, other names, clans and notes, the notes on an alliance's drops and why any was voided, event details and sign-up notes, soft reserves, loot council wishlists, party plans, raid timer records, clan entries, the reasons on DKP entries, claim notes and decisions, loot log items and notes, auction items and notes, the Discord link and webhook, the bot's channels and role settings, the join panel's line, and the registration message a leader wrote) is encrypted the same way with the group's own key.
Claim screenshots are encrypted with the group's key before they're stored, in a private Amazon S3 bucket in London. Each group's screenshots are kept apart, and Meadhall reads or writes them only with credentials limited to that one group.
A group leader's name, for support: if you lead a group, your name as the group sees it is also stored on your membership in that group, encrypted with a separate key kept for this one purpose, so that Meadhall's support tools can show who leads each group (below). It's removed when you stop being a leader or leave, and changes when you rename yourself.
Those keys are protected by AWS Key Management Service (KMS). The whole database is also encrypted at rest.
Not encrypted per field: random ids, dates and times (for example when an event starts), roles and permissions, sign-up and claim statuses, which member ids were at an event or in a claimed party, DKP amounts, which member ids each DKP award or deduction has paid (a record beside its entries, signed, so a retry never pays anyone twice; the same members its entries name, and kept as long as they are), each DKP award's or deduction's time and pool beside its id (an index the ledger page reads, newest first, kept as long as the entries are), the multipliers an alliance's DKP lines applied, an alliance's item price list, an alliance's drops (their epics, items, days, CPs, states and adena), an alliance's pick-order periods (their days, states and who opened, closed or asked to close them; for each CP its DKP, Left characters' points, Spent line, percentage, drops given, adena share and place in the order; for each counted roster character with points, its CP and DKP, by the roster's id; why a close didn't finish), loot methods and prices, the raid a World of Warcraft drop came from, your time zone and language, a group's name, game, server, realm and kind, and on an alliance's roster the names of its CPs, how many characters each has and which linked group it is, and each character's CP (and the CP it's moving to), status, class, noblesse, level band and multipliers (its names, clan and note are encrypted). These are needed to sort, add up and look things up; they are still covered by the database's encryption at rest.

So a copy of the database on its own shows random ids and ciphertext, not who you are.

What Meadhall's support tools show

To answer support requests and keep the service running, Meadhall's operator can look up an account or a group in a private admin tool, reachable only from one network and only after signing in with two-factor authentication. It shows the details that aren't encrypted per field: ids, dates, a group's name, game, server, kind and plan (including its source and end date, and whether its trial was extended), how many members, leaders and officers it has, whether it's linked to Discord and to other groups, when it was last active, how much screenshot storage it uses, which groups an account is in and with what role, how many sign-in sessions it has open, and its time zone and language. It doesn't show anything encrypted with your key or your group's key: not your email or Discord id, not member names, and not what a group has written. The one name it shows is a group leader's, from the separate copy described under Encryption, so support can tell who leads a group and get in touch about it; a member who isn't a leader is never named there.

The operator can change a plan that is not managed by Paddle, extend a group's trial once by up to 14 days, or suspend and restore a group for abuse when a support request requires it. A suspended group remains readable and exportable but cannot be changed; its leaders see the suspension reason. Meadhall keeps the suspension state, reason and time until the group is restored. The admin audit records the operator, time, action, group id, reason and result.

The operator can end every sign-in session on an account when a support or security request requires it. On a verified erasure request, the operator can also start the same permanent account deletion described below. The admin audit records the operator, time, action, account id, support request reference and result. It does not record the account's name, email or Discord id.

When a support request, abuse report, data bug or legal request requires access to a group's encrypted contents, the operator can open an audited, read-only break-glass session for 15, 30 or 60 minutes. The append-only admin audit is written before access and keeps the operator, group id, category, free-text reason, window and result for two years. The short-lived AWS session is tagged with the group, audit id and administrator, is attributed in AWS CloudTrail, and cannot write group data. An alert is sent before every session. The group's leaders receive a notice that access was requested, containing the date and category but never the free-text reason: on the group's Dashboard for 7 days (each leader can hide it for themselves sooner), and as a Discord direct message from the bot to each leader whose account is linked to Discord; that wording remains accurate if AWS refuses to create the session. During the window, the private admin portal can show paged roster, DKP, claim, loot and event records, including member names and group-written details opened with the group's key. The server checks the administrator, group and expiry on every read. Temporary AWS credentials never leave the server. The browser keeps only a random session handle in memory; Meadhall stores only its one-way hash with the group, audit, category, administrator and expiry until the short-lived row expires, never the free-text reason.

The operator can create batches of single-use plan licence keys with a plan, duration or end date, count and administrative note. A generated key is shown once for immediate download and is never stored by Meadhall or written to its logs or the audit record (a key we email to someone who paid in crypto stays in that email, below). Meadhall stores only a keyed hash made inside AWS KMS, the batch details and counters, the hashes belonging to each batch, and which administrator created it, so a database copy cannot reveal a usable key. When a group leader redeems a key, Meadhall records that the hash was redeemed, the group and time, updates the batch counters, and puts the resulting plan and end date on that group's entitlement record. An operator or Finance administrator can revoke hashes that have not been redeemed; Meadhall keeps the revoked state and time, and the append-only audit keeps the administrator, reason and before/after counters. To limit guessing, it also keeps an account-linked hourly counter of failed licence-key attempts for up to two hours. A founder code (a key that makes a founding group) also marks the group as a founding group, kept after its Founder plan ends so its founders' discount can be applied, and puts a note on the redeeming leader's account (the group and when), because each person can redeem only one; that note is in the account's data download and is deleted with the account. So that deleting an account and signing in again can't get a second code, Meadhall also keeps a record of when the code was redeemed, under a keyed hash of the leader's Discord account id (the same keyed hash, made inside AWS KMS, that finds your account when you sign in; never the id itself). It names no account or group. It is not deleted with the account: it's kept while founder codes are offered, and deleted when that offer ends. While you have an account, it's in your data download.

Once a night, Meadhall reads the operational row types, counts-only group lifecycle counters and up to seven days of technical usage logs needed to produce one service-wide statistics row for the preceding complete UTC day. Group create/delete stream records increment those daily counters exactly once; random event markers retained for up to two years prevent a retried stream record from incrementing a counter twice. The isolated job briefly uses account and random group row keys to classify source rows and count distinct groups using each feature, but excludes member rows and does not log or store the source ids. The statistics row contains numbers only: current, created and deleted group and account totals, recently active totals, linked Discord totals, group totals by game, server, kind and size band, current plan and trial totals, 1/4/12-week retention cohorts, rolling seven-day feature counts, daily bot-command counts, Discord's own approximate counts of the servers and users that have added the bot, and daily counts of Add to Discord clicks by page and of server links by how they ended. It contains no account, group or Discord ids, no names, no sealed values and no per-user rows. Meadhall uses these totals to operate the service and decide which features are useful; there are still no analytics cookies or third-party tracking scripts.

When a group on a Lineage 2 server the hub doesn't list (Other server, or a Scryde world) types its server's name, Meadhall also counts that name, separately from the group, so the most-used servers can be added to the list. The count keeps only the name as last typed, the game version it was typed for, how many times it has been chosen, and the dates it was first and last chosen: no group, account or member. A group that changes its server's name adds one to the new name; the old name keeps its count. These counts are server names, not personal data, so they aren't encrypted per field (they are still covered by the database's encryption at rest), and only Meadhall's operator reads them.

Where it's stored

Meadhall runs on Amazon Web Services. Your data is stored in AWS's London region (eu-west-2), in the United Kingdom. The exception is the public pages' visit counts, which are kept on Meadhall's own server in the UK (see Counting visits to the public pages). The website itself is delivered through AWS CloudFront, a network of servers around the world, which handles each request close to you.

How long we keep it

Your account: until you delete it. We may delete an account that hasn't been used for two years; we'll email you (if Discord gave us an address) at least 30 days before.
Sign-in sessions: 30 days from sign-in, or until you sign out.
Technical logs: 30 days.
Visit counts for the public pages: until removed. They are counts only, with no per-person rows, so there is nothing to delete for one person; they are not deleted on a schedule.
Admin audit records: two years.
Service-wide operational statistics: two years. These daily rows contain counts only, with no account, group or Discord ids, names, sealed values or per-user rows.
Payment and refund records: as the business's financial records, which UK law requires to be kept for six years. They stay when the group or the paying account is deleted; the account id in them then points to nothing.
Records of crypto payments made by arrangement, and their emails: six years, as financial records, like Paddle's.
Records of Paddle's messages: 90 days.
The record that you redeemed a founder code (when, under a keyed hash of your Discord account id): while founder codes are offered, deleted when the offer ends, whether or not you still have an account.
Group content: until the group deletes it, or the group is deleted. Some records are kept on purpose as the group's history: the DKP ledger is never edited (a mistake is reversed by a new entry), a removed loot line is marked void rather than deleted (and so is an alliance's drop), and attendance stays after its event is deleted. Auction bids stay with their auction.
The Discord bot's records: a command's "being answered" record, about an hour; the group you picked for a server, until you pick another or delete your account (if you leave that group, the choice is no longer used, and you're asked again).
Discord's join, leave and role notices: in the queue until they're checked, usually seconds; at most a day, or two days if Meadhall couldn't handle one.
Discord DMs waiting to send (registration links, character update reminders, event reminders and nudges): in the queue until delivered, normally seconds and at most a day; one that repeatedly fails moves to an encrypted dead-letter queue for up to 14 days so the operator can diagnose or retry it. No record of who was messaged is kept once delivery is done.
Claim screenshots: with their claim. Withdrawing a pending claim deletes its screenshots; an approved or rejected claim keeps them as evidence. All of a group's screenshots are deleted when the group is deleted.
Backups: the database keeps point-in-time backups for 35 days. Deleting your account destroys your key, so the encrypted fields in those backups can't be read afterwards; the unencrypted parts listed above age out of the backups within 35 days.

Deleting your account

On the hub's account page, under "Delete my account", type DELETE and confirm. If you ask us to erase your account, the operator can start this same process after verifying the request. Meadhall then:

ends all your sessions;
removes you from every group and withdraws your join requests (if you were a group's only leader, leadership passes to the member with the most permissions, the longest-serving if several tie; a group left with no one in it is deleted);
destroys your account's key, so every field encrypted with it is unreadable, in backups too (within five minutes: our servers keep a key they've used in memory for up to that long);
deletes your account, your characters, the public tools' saves synced to it, and the record that links your Discord id to it;
deletes the copies of your characters that groups above yours kept.

If you redeemed a founder code, the record of when (under a keyed hash of your Discord account id, naming no account or group) is kept after your account is deleted, so the same Discord account can't redeem a second one; it's deleted when the founder-code offer ends.

A group of your own too big to delete at once is deleted in several steps while the account page stays open. If the page is closed first, your sessions have already ended and the account can't be used, and the remaining steps (the key's destruction among them) are finished automatically, usually within a day (a very large group can take a few nights), or sooner when you next sign in. While a deletion of an account or a group is under way, Meadhall keeps a note of its random id and when it started, nothing else, so the deletion can be found and finished; the note is deleted when the deletion finishes.

Some things you added to a group belong to that group and are encrypted with its key, not yours: for example event sign-ups and their notes, soft reserves, loot council wishlists, attendance, raid timer records, clan entries, DKP entries and claims (with their screenshots) and the loot log. These may stay in the group after you leave or delete your account, until the group removes them or is deleted. A group's leader can delete the group, which destroys its key.

If you were a CP lead in an alliance, the alliance keeps a record of it after you leave or delete your account: which CP, your account id, your Discord id (encrypted with the alliance's key), when it was set and by whom. The legal basis is the alliance's legitimate interest in keeping the limit it set on you in force: it's kept so the limit applies again if you come back, with the same account or the same Discord account, and if you do come back, the record is still there and applies at once. Your account keeps only a pointer to the alliance holding the record (the record itself is kept in the alliance), so your data export can find it and list it; the pointer goes when the record is cleared, when the export finds the record or the alliance gone, or with your account. It's removed when someone in the alliance who can make CP leads clears it while you're a member, or when the alliance is deleted; or ask us (below) and we'll remove it.

You can also remove Meadhall's access from Discord, under Discord's settings for Authorised Apps; that doesn't delete your Meadhall account.

Cookies

Meadhall uses only the cookies it needs to sign you in. There are no advertising or analytics cookies, so there's nothing to consent to.

mh_login: set for 10 minutes while you sign in with Discord, so the answer that comes back from Discord can be checked against the request you started. Deleted once sign-in finishes.
mh_refresh: keeps you signed in for up to 30 days. Page scripts can't read it, it's sent only over HTTPS and only to Meadhall's sign-in routes, and it's replaced every time it's used. Signing out deletes it.

Who else is involved

Discord, to sign you in, and, for groups that link a Discord server, to read roles on that server, post reminders to the channel the group chose, privately send a registration link to eligible role holders or a character update reminder to members when the group enables that, nudge an event's nudge-role holders who haven't signed up (a mention under the event's post, or a private message if the bot hasn't posted the event), and, for groups that add the Meadhall bot, to answer its commands and post to the channels the group chose. Discord's own privacy policy covers what Discord does.
Amazon Web Services, which hosts Meadhall and stores its data, as our processor. Amazon SES, part of it, is set up to send Meadhall's email; Meadhall doesn't email members today.
Paddle (Paddle.com Market Ltd), when a group pays for its plan: Paddle sells the plan as the merchant of record, so it is responsible for the sale and the payment and billing details it collects, under its own privacy policy. It keeps, with each payment, the ids of the group and the account it's for, so its messages to Meadhall say which group a payment counts for.
Battle.net (Blizzard), whose Game Data API supplies World of Warcraft raid loot lists. Meadhall's server reads them once a day with its own app's credentials, without sending member data; Blizzard sees the request from Meadhall's AWS service, not from your browser. If you import your characters from Battle.net, you sign in there and Meadhall reads your account's World of Warcraft character list and each character's class, spec, level, item level and raid progress (which raid bosses it has killed, and when: a kill since the weekly reset ticks that raid's lockout for the character you import), once, when you ask; you then choose which to add. The sign-in's token is used for that read only and not kept, nor is anything about your Battle.net account (its id or BattleTag); what was read is kept, sealed with your account's key, while you choose: it can be used for ten minutes, is deleted when you use it, and otherwise is removed automatically shortly after.
Masterwork, whose public raid rating at mw2.global supplies LU4 elemental raid-boss status. Meadhall's server checks it on a schedule without sending member data; Masterwork sees the request from Meadhall's AWS service, not from your browser.
Cloudflare, whose tunnel carries the visit counts from CloudFront to Meadhall's own server. It carries them, with your IP address in a header, so it sees them in transit; Meadhall doesn't ask it to keep them.
ImprovMX, which forwards email sent to meadhall.app addresses (such as privacy@meadhall.app) to our inbox. If you email us, it handles your message and address on the way.

We don't sell your data, share it with advertisers, or use it to train anything. We would disclose it only if the law required us to.

Your group's leaders and officers see what the group holds about its members, such as names, roles, characters signed up to events and notes. What you put into a group is visible to that group's members as the hub shows it.

Your rights

You can see and correct your profile and characters on the account page, download a copy of your data there (a JSON file: your account, your characters, the public tools' saves synced to your account, and, for each group you're still in, your own records there: sign-ups, soft reserves, wishlists, what you recorded, DKP and clan entries about you), and delete your account there at any time. You can also ask us to correct or erase your data, or to restrict or object to how we use it, by contacting us (below); we answer within one month. If you're in the UK you can complain to the Information Commissioner's Office (ico.org.uk); in the EU, to your local data protection authority.

Children

Meadhall is not directed at children. You must be at least 13 to use it, or 16 in the EU/EEA where the law requires it, and never below the minimum age Discord sets in your country. If we learn an account belongs to someone younger, we'll delete it.

Changes to this policy

If we change what we collect or how we use it, we'll update this page and the date at the top, and for significant changes say so in the hub before they take effect.

Contact

Nathan Preen (privacy@meadhall.app)