Privacy

In short

• You sign in with Battle.net. There is no password and no e-mail address on this site: the hub keeps your Battle.net account number and BattleTag, and nothing else about your Battle.net account.
• Nothing unnecessary is collected. No IP address, no e-mail, no password – only what the site needs to show you your play and to build the quest guides.
• Analytics and advertising only if you say yes. Without a yes in the cookie banner no analytics runs at all: no cookie, no script, and your visit is not even counted. With it, the site’s own analytics runs on this server, and Google Analytics runs too, which means Google receives what its script reads (below). Advertising cookies, if advertising is ever added, are asked about the same way. Change your answer at any time in Cookie settings.
• Your data stays in the EU. It is stored on this hub's own server (Hetzner Finland Oy) and is not transferred outside the EU – except what Google Analytics collects if you allow analytics, which Google may transfer to the United States (see “Who else sees it”).
• It is stored securely. Encrypted connections, nothing secret stored in a readable form, and an audit trail that ages out on its own.
• You decide who sees you. Your profile is private until you make it public; while it is private no other visitor sees your characters or your BattleTag. This hub’s admins see every account, to run the site (see “Who else sees it”).

Who is responsible

PandaQuest is the software. The controller – the person or company answerable for the data on this particular hub – is whoever runs it, and these details come from their configuration rather than from the code.

Where your data is

Everything this hub stores is on its own server: Hetzner Finland Oy. The data is kept in the EU and is not copied, sold or transferred to anywhere outside the EU.

The one outside service the hub talks to is Blizzard's Battle.net: your browser goes there to sign in, and the hub may ask Blizzard's API about a character you uploaded, by name and realm.

If you allow analytics, your browser also loads Google Analytics, run for this site by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) as a processor. What it collects is kept by Google, for the retention period set for this site’s property (2 months), and may be transferred to Google LLC in the United States under the EU–US Data Privacy Framework. Without a yes, or after you withdraw it, nothing is sent to Google and its cookies are deleted.

What is not collected

• No password: you sign in with Battle.net, and the hub never sees your Battle.net password.
• No e-mail address.
• No IP address: not in the database and not in the hub's own logs. While a request is being answered, the address it came from is used in memory to slow down anybody sending far too many requests and to tell people from crawlers, and forgotten within the hour; with your consent to analytics it is also used, in memory, to look up your country, and Google Analytics' script sends it to Google with each request, which Google Analytics 4 uses for a country and city and does not store.
• No raw browser fingerprint: only a coarse label such as "Firefox on Windows".
• Nothing about your Battle.net account beyond its number and your BattleTag: not your name, not your other games, not your list of characters (the characters come from the sync app).

What is processed

Positions are stored to two decimals of the map coordinate – roughly ten yards. The addon measures more precisely than that; the extra precision is thrown away when the upload arrives and is never written down.

Consent, and taking it back

Uploading play data is on consent, asked for in its own unticked box when you connect your first computer – never bundled into signing in or accepting terms. Every answer is recorded with its date and the version of this text it was given against.

Withdrawing is one click on Your data and it is as easy as giving it was. Withdrawal stops uploads being accepted and deletes the data already stored under that consent, because consent was the only reason it could be held.

The service is not offered to people under 13.

Your rights, and where to use them

All of them are self-service on Your data. None of them require the operator to do anything by hand, and none of them can be refused by making them tedious.

• Access and portability (15, 20). One download containing everything about you as JSON, plus your events as CSV. Built in the background; the link works once.
• Rectification (16). Change your display name yourself. Your BattleTag is updated from Battle.net every time you sign in, and character details correct themselves on the next upload.
• Erasure (17). Delete the account, confirmed by a fresh Battle.net sign-in. The account is locked and hidden immediately and the rows are removed after 7 days, which is how long you have to change your mind.
• Deciding who sees you. Make your profile public or private on your account page, and hide single characters on your characters.
• Restriction (18). Freeze the account: nothing is deleted, nothing is used, and uploads are refused until you lift it.
• Objection (21). Same as withdrawing consent.

For anything the page cannot do, write to the operator at ba@zroot.it. You can also complain to your data protection authority. In Finland that is the Office of the Data Protection Ombudsman (tietosuoja.fi).

Deleting your data, and the community guides

The quest guides on this site hold averages, medians and clustered hotspots – no names, no character names and no timestamps. A guide is published from the first recorded run of a quest and gets more precise with every upload after it. From the start it shows where the quest is picked up and handed in and where its objectives are done – places every player doing the quest goes to, so they say nothing about you that doing the quest does not. Where players died is about the player rather than the quest, and it is shown only once at least 5 different characters from at least two different people have done that quest.

When somebody erases their account, every guide their data fed is checked. A guide survives only if it is genuinely an aggregate: at least 5 different characters from at least two different accounts contributed to it. Anything below that is one person's route with the name filed off, so it is deleted outright and rebuilt from what remains. If nothing remains, it stays gone.

What you write on this site

When you send a bug report, a correction, a note about something missing or an experience through the contribute form or the sync app’s Bugtracker, the text is stored with your account so that an admin can read it and decide what to do with it.

• What it is for. Moderation, showing an approved note on the page of the quest it is about, and showing a bug report you chose to make public on the Bugtracker. Nothing else: it is not used for anything about you, and nobody is emailed.
• A bug report on the public Bugtracker. When you send a bug report you choose who can read it. If you choose everybody, its title, its text and what it is about are shown on the Bugtracker – without your name, without the details below and without any admin’s note – together with the status the admins give it (open, confirmed, fixed, won’t fix) and how many players voted for it. If you choose only the admins, it is shown on no page. You can take it off the list, or put it on, whenever you like on what you have sent, and an admin can take it off the list (for example if it holds somebody’s personal data) without deleting it. A bug report sent before the Bugtracker was public (16 October 2026) stays private unless you put it on the list yourself.
• Your votes. When you vote for a report on the Bugtracker, we store which report you voted for and when, with your account, so that you can vote once and take the vote back. Everybody sees how many votes a report has; nobody sees who voted. Your votes are in your data export, and they are deleted when you take them back or delete your account. While your account is frozen or waiting to be deleted, you cannot vote and your votes are not counted.
• A suggested change to the data. When you suggest a correction, an addition or a removal of a quest, an NPC, an object or an item, the change you suggest is stored with your note. If a moderator approves it, the data itself changes – on the site and in the addon – and the changelog says what changed, never who suggested it; your note itself is shown on no page.
• The details. You may add what you expected and what happened instead, the game, your character’s level, the zone and the map coordinates, and the version of the addon or the sync app. All of them are optional, and the sync app fills in its own version when a report is sent from it. They are stored with the report under the same rules, and they are shown on no page, not even with an approved note or on the Bugtracker.
• Who sees it. The admins and the moderators they appoint, always. Everybody else sees it only if it is a note about a quest, sent with the quest’s id, and only once it is approved – on that quest’s page, as “a player” and without your name – or if it is a bug report you made public, on the Bugtracker as above. A bug report you kept private, and a note about anything else (an NPC, an object, a zone, an item, a best-in-slot list, the site, or a quest given only by name), is shown on no page: it stays between you and the admins, though it may lead to a fix in the data.
• Searching it. You can search what you have sent; nobody but you, the admins and the moderators can. They can search everything that was sent, to find the reports about one quest or item. Your search also lists the approved notes already shown on quest pages, as those pages show them.
• How long. Until you delete it, which is one button on what you have sent, or delete your account, which deletes all of it. An admin can remove or delete it sooner. If an admin has turned a correction into a line of the data changelog, the line says what changed and never who wrote it, and stays when your note goes.
• Your copy. It is in your data export, together with what became of it and any note an admin made about it.
• While your account is frozen or waiting to be deleted, your approved notes and your bug reports on the Bugtracker are not shown, your votes are not counted, and nothing new is accepted from you.

Who else sees it

Other visitors see your characters and your BattleTag only if you make your profile public; the quest guides they read are aggregates with no names in them.

This hub’s admins see a list of every account, public or private, so that they can run and moderate the site: the BattleTag, the roles, whether the profile is public, when the account was created and last signed in, whether it is frozen or waiting to be deleted, the names of the connected computers and when they last uploaded, the characters’ names, levels, classes, races and sides, how many sessions and quest runs were uploaded, what you sent, and the account’s security record. They do not see where or when you played. Every time an admin opens one person’s page it is written to that person’s security record, which is in their data export. The legal basis is the legitimate interest in running the service securely (GDPR 6(1)(f)).

• Nobody buys your data from this hub. Before you allow analytics the pages load no third-party script. If advertising is ever added, the companies involved are named here before any of it runs, and only with your consent.
• Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), which runs Google Analytics for this site as a processor, only if you allow analytics: it receives what its script reads in your browser (see the table above) and keeps it for the retention period set for this site's property. Google may transfer it to Google LLC in the United States under the EU-US Data Privacy Framework, which Google LLC is certified under, and Google's standard contractual clauses.
• Blizzard Entertainment, which runs Battle.net. You sign in on Blizzard's own page, and the hub then receives your Battle.net account number and BattleTag from Blizzard. The hub never sees your Battle.net password.
• Blizzard Entertainment, which this hub asks for its record of a character you uploaded: the request carries the character's name and realm and nothing else about you. Your browser never contacts Blizzard for it; the pictures are copies kept on this server.
• The hosting provider, which runs the server the data is stored on: Hetzner Finland Oy.

How it is kept safe

• Encrypted connections. This hub is served over https only, so every page, every sign-in and every upload travels encrypted (TLS).
• No password to steal. Signing in happens on Battle.net's own page; the hub never sees or stores a password.
• Nothing secret stored readably. The keys your computers upload with, browser session ids and pairing codes are stored only as hashes, so a copy of the database hands over no working credential. A key is shown once, to the sync app that collects it, and never on a page.
• Sessions that end. A signed-in browser holds a signed, HttpOnly cookie that scripts cannot read, which stops working after 30 days at most, sooner when it is idle, and at once when you sign out or disconnect.
• The sync app’s window signs in by itself. The sync app shows the website’s Bugtracker and report form in its own window, signed in as you. To do that it asks the hub, with the key of the computer it runs on, for a sign-in that works once and for one minute, and only the hub’s hash of it is stored. The session it starts is listed with your signed-in browsers as the PandaQuest sync app, follows the same rules as any other, and ends at once when that computer is disconnected – with the app’s Sign out or on your computers.
• An audit trail without addresses. Account events – sign-ins, computers connected or disconnected, deletions, an admin opening an account’s page – are written to a separate audit table so an incident can be reconstructed, with no IP address in it, and that table ages out on its own window.
• Who is online is not written down. While the sync app runs on a connected computer it tells the hub so every two minutes, so the app can show how many players are online. The hub keeps that in memory for five minutes only, to count players, and writes none of it to the database or to a log: it can say how many, never who or when.
• Only what is needed. Map positions are cut to about ten yards before they are stored, and the public pages show aggregates, never a timeline of when somebody played.

Changes in version 18 (26 October 2026)

• The age limit is 13. It was 16; it is now 13, the same age Battle.net asks for an account of your own.
• Guild pages. The addon now uploads the guild each character is in and its rank, so the character can be counted on its guild’s page – and named there while your profile and the character are public. A new “Guild pages” row says what the guild pages you manage, your posts on them and the decisions about your characters hold. No new cookies.
• Connected applications. You can let an application such as Claude use this site’s MCP server for you by signing in and allowing it, instead of pasting a developer key. A new “Connected applications” row says what is kept about each connection and the OAuth clients you make on the developer page, and the security record now lists applications connected or disconnected.