Privacy and your data

What an upload carries#

An upload is the records your addon wrote, plus a random install id. It has no account and no character login. You choose when to upload, and on the website you preview everything before it is sent.

• Open-world sightings, loot, vendors and similar observations are anonymous.
• Named data (guild, gear, gold, collection) is sent only if you tick it and have a verified sharing grant. The Desktop App never sends it.
• The census and the installed addon list are off in the game until you turn them on, and they are sent only from the upload page, after the preview.
• An upload that contains a scan is stored with a keyed one-way hash of the address it came from, never the address, so distinct reporters can be counted. The hash stays in private storage and is never published.

What is published#

• Your anonymous observations are published as individual records, without character names and without the install id, so anyone can check our counts. They are under CC BY-SA 4.0, credited to Everloot contributors.
• The facts the site states, such as drop rates, spawn points and recipe ranges, appear only after at least 3 installs report them. Distinct install ids do not prove independent players.
• Full auction scans are not public records. They feed market values, and a value is published when 3 distinct reporters scanned the item.
• Guild data is published only through an authorised officer's upload.
• Uploads build the public database. We never sell them.

What is never published#

• Your install id, and the address hash.
• The installed addon list, row by row. The site shows only counts for addons that at least 3 installs report.
• Census rows, row by row. Only counts, and only when a count covers at least 10 characters from at least 3 installs. Below that it reads "fewer than 10".
• Named records, unless the person they belong to chose to share them.

The census#

The census counts who plays what. It is off until you type /everloot census on in the game. It records race, class, level and faction for your own characters (with the realm name) and for players you target, mouse over or group with. It never reads another player's name, guild, gear or position.

Before anything is stored, the game's id for each character is replaced with a keyed one-way hash. You can turn it off at any time with /everloot census off, which deletes every census row from your file.

Sharing grants#

Named records need your explicit choice and a verified grant. You can withdraw a grant on the upload page at any time, without emailing us. A verified character owner can also opt out across guild rosters, attendance, loot, gear and gold.

Deleting and opting out#

You can also ask us what we hold about you, have it corrected, object to how we use it, or withdraw a consent. We answer within a month.

Cookies and analytics#

• If you sign in, an essential login cookie keeps you signed in for at most 30 days after your last visit. Signing out ends it.
• Optional analytics cookies are off unless you accept them in the cookie banner. You can reopen Cookie preferences from the footer on any page.
• Cloudflare Web Analytics sets no cookies. It does not run if your browser sends Do Not Track or Global Privacy Control.
• Ads come from Google AdSense, each labelled "Advertisement". There are no ads on the upload page, the privacy page, account pages or the lore archive.

The full list of tools, what each one does and how long things are kept is in the Privacy Policy.