Privacy Notice

The short version

We store your email address and a hashed password so you can sign in. We store the SimulationCraft profiles and talent builds you import so your workspace remembers them. We do not sell, rent, or share personal data with third parties. We do not run third-party tracking or advertising scripts on this website. If you want any of it gone, email us and it is deleted.

Account data

When you create a Quin Forge account we store your email address and an Argon2 password hash. The password is never stored in plain text — Argon2 is a memory-hard hash designed specifically so the hash cannot be reversed to recover the password.

After each sign-in we issue a session token (32 random bytes) that identifies you for 30 days. On the website the token is held in your browser's localStorage; on the desktop client it lives in Windows Credential Manager. The server stores only a SHA-256 digest of the token, so a database leak cannot be used to impersonate you.

Character and simulation data

When you import a character — from the Quin Forge add-on, a SimulationCraft profile, or the Armory — we store the text profile you provided so your workspace keeps it between visits. Simulation results (DPS, healing reports, gear comparisons) are stored as JSON and linked to your account.

The Quin Forge in-game add-on exports your character sheet (gear, talents, stats) into a text profile in World of Warcraft's SavedVariables. The add-on sends nothing to us directly; the desktop client reads that file and submits it to the server only when you choose to import.

Game data and private packages

Quin Forge reads spell coefficients, item stats, and encounter data extracted directly from the World of Warcraft client via CASC. This data is the same information SimulationCraft, Wowhead, and Blizzard's own UI use. It contains no personal information.

Billing data

If you purchase Premium we store the order record (product, price, status) and the duration it grants. For card payments, the card never touches our server — checkout is handled by the payment provider, and we store only a provider reference, never the card number.

For cryptocurrency payments we derive a receiving address per order from a watch-only extended public key (xpub). We hold no private keys. The address exists so we can confirm a payment landed; once the order is settled we keep only the transaction reference, not the address history.

Server logs

The web server logs standard request data (IP address, timestamp, path, user agent) for abuse prevention and reliability. These logs are rotated and deleted within a few weeks. We do not enrich them with identity data, and they are never shared.

Cookies and local storage

The website uses localStorage to keep your session token and your cookie-consent choice. We do not set advertising or third-party tracking cookies. See the Cookie Policy for the full list.

Your rights

• Access: you can see the data tied to your account by signing in.
• Deletion: open a bug report in the Quin Forge desktop client (Help → Report a bug) and ask for deletion. We delete your account, characters, simulations, and order history.
• Export: your SimulationCraft profiles are text — you can copy them out at any time.
• Withdrawal: you can delete your account at any time; deletion cannot be undone.

Children

Quin Forge is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has registered, contact us and we will delete the account.

Changes to this notice

If this notice changes in a way that affects your rights, we will bump the "Last updated" date above and, where reasonable, notify signed-in users in the app. Continued use after the effective date means you accept the updated notice.

Contact

Questions or deletion requests: open a bug report in the Quin Forge desktop client (Help → Report a bug) and let us know what you need.