Privacy policy

This explains what personal data we process on nwn.gg, why, for how long and what your rights are. We collect as little as we can: we don’t sell data, we don’t show ads and we don’t use tracking cookies.

1. Controller

Pol Navarro Oliver, tax ID 41633052Q, Carrer Pas d’en Marges, 22, 08360 Canet de Mar (Barcelona) (España). Contact for anything privacy-related: team@nwn.gg.

2. What we process and why

Your account. When you sign in with Discord or Google we receive your ID on that platform, your name, your email and your profile picture, and we keep the access it grants us for the features you use (for example, reading the avatar decoration you wear on Discord if you turn that option on). This is to create and run your account. Legal basis: performance of the contract you accept with the terms (Art. 6(1)(b) GDPR).

Your profile. What you publish (name, bio, links, images, videos, music) is public by nature: you choose it so others can see it. Legal basis: performance of the contract.

Session security. When you sign in we store that session’s IP address and browser to detect unauthorised access. Legal basis: our legitimate interest in protecting accounts (Art. 6(1)(f)).

Visit statistics. To show you how many people see your profile we count visits and clicks without cookies. For each visit we keep the country, the referring site, the device and browser type, and an anonymous code that changes every day and cannot be turned back into an IP. We don’t store IP addresses. Legal basis: legitimate interest in giving profile owners statistics.

Who viewed your page. If you visit a profile while signed in to nwn.gg, its owner can see your name, photo, @ and when you visited, for 30 days. If you’d rather not show up, turn on incognito mode in Settings: you stop appearing and visits already recorded are deleted (while it’s on, you don’t see who visits you either). Visits without a session are never identified. Legal basis: our legitimate interest in offering this feature, with your right to object in one click.

Reports. If you report a profile we keep the reason, the details you write and, if you give them, your name and email (required for copyright claims). To prevent abuse we also keep a code derived from your IP that doesn’t reveal it. If you are signed in, the report is linked to your account. The profile owner doesn’t learn who reported them. Legal basis: the duty to handle notices under the Digital Services Act (Art. 6(1)(c)) and our legitimate interest in keeping the service safe.

Moderation. We log moderation decisions (what was done, why and by whom) and the notices we send you. Legal basis: legal obligation and legitimate interest.

Purchases. If you buy in the store we keep what you bought, when, the amount, the payment status and, for ranks, your Discord ID to give or remove the role in the NWN server. Your card details are collected by Stripe on its payment page: we never see or store them, we only receive your email, your country and the payment identifiers. Legal basis: performance of the contract and, to keep invoices, legal obligation (art. 6.1.c).

Automated AI review. When you publish your profile we send its text and some of its images (which are already public) to an artificial intelligence model, through OpenRouter, to detect prohibited content. The result is stored with the profile and, if serious, the profile is hidden until a person reviews it. No decision about your account is made by automated means alone. Legal basis: our legitimate interest in keeping the service safe and the duty to act against illegal content.

Hosted images and custom badge. If you use Image Host or Custom badge we store every image you upload (re-encoded and without metadata such as EXIF or GPS location), its thumbnail, the original file name, its size and the status of its review. Before it is published, a small copy of the image is sent on its own, without your name, account or any other data about you, to an artificial intelligence model through OpenRouter to detect prohibited content; if it holds the image, a person on our team reviews it. An approved image is public to anyone who has its link. Legal basis: performance of the contract (the add-on you buy) and our legitimate interest in keeping the service safe and not spreading illegal content.

Technical errors. When something breaks we log the page address and the error so we can fix it, on servers we run ourselves. Legal basis: legitimate interest.

3. Cookies

We only use technical cookies the service needs to work, which don’t require your consent:

• better-auth.session_token and better-auth.session_data: keep you signed in (up to 1 year).
• nwn_lang: remembers the language you pick (1 year).

Some profiles include third-party content. YouTube, Spotify, SoundCloud and Twitch players only load when you press play, and from then on that platform may use its own cookies under its policy. Profiles that show a Discord status fetch it from Lanyard (api.lanyard.rest), and avatar decorations load from Discord: those services receive your browser’s IP when the profile loads.

4. Who we share data with

• Cloudflare, Inc., which hosts the website, the database and the files, as our processor.
• Discord and Google, when you choose to sign in with them; each handles your data under its own policy. If you buy a rank, Discord also receives the instruction to give you the role.
• Stripe Payments Europe, Ltd. (Ireland), which takes payments and renewals. For fraud prevention and its financial obligations it acts as an independent controller, under its own privacy policy.
• Our own servers, where the images, videos and audio you upload are processed.
• OpenRouter, Inc. and the AI model provider, as processors, for the automated review of hosted images, without being allowed to use them to train their models.
• OpenRouter, Inc. and the AI model provider, as processors, for the automated review of published content, without being allowed to use it to train their models.
• Authorities and courts, when the law requires it.

We don’t sell or hand over your data to third parties for advertising.

5. Transfers outside the EU

Cloudflare, Discord, Google, Stripe, Inc., OpenRouter and the AI model provider are US companies. Transfers rely on the EU-US Data Privacy Framework and, where applicable, the European Commission’s standard contractual clauses.

6. How long we keep it

• Account and profile: while you have the account; when deleted, they are removed within 30 days.
• Hosted images and custom badge: while you have the add-on; if you delete them, straight away. If the add-on ends (refund or chargeback), they stop showing at once and are deleted after 30 days. Deleting your account deletes them at once. An image held or taken down by moderation is kept until the team decides on it.
• Sessions: expire after 1 year without use.
• Per-visit statistics: about 3 months; after that only daily totals that identify no one remain.
• “Who viewed your page”: 90 days after the last visit.
• Reports and moderation decisions: up to 3 years after they are resolved, in case of claims.
• Purchases and invoices: 6 years, because commercial and tax law require us to keep them, even if you delete your account.
• Backups: rotated regularly and deleted within a limited time.

7. Your rights

You can ask to access, correct or delete your data, object to or restrict its processing, and take it with you in a standard format. Write to team@nwn.gg from your account’s email; we reply within one month. If you think we haven’t handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es) or the authority where you live.

8. Children

nwn.gg is not meant for children under 14. If we learn that an account belongs to someone under that age without their parents’ or guardians’ permission, we will close it.

9. Security

We use encrypted connections, access limited to the people who need it, and a log of moderation actions. No system is foolproof: if a breach affected you, we would tell you and notify the authority as the law requires.

10. Changes

If we change this policy we will publish the new version here with its date and let you know if the change is significant. See also the Terms of use.