Privacy

Who is responsible

ShadowFellowship is run by controller name, set before sign-in opens. Questions about your data: contact address, set before sign-in opens. Signing in stays switched off until both are set.

The app works without an account

Everything the Windows app does on your PC works without signing in. It reads the combat log and the boxes of screen you place, on your PC. Screen frames and combat-log lines are never uploaded.

What we store when you sign in

• From Discord: your Discord id, display name and avatar. We ask Discord only for your identity: we do not get your email address, cannot see your messages and cannot post anything.
• Your synced setups: buff profiles, and app settings if you switch that on (later also HUD settings, your Gear Checker loadout and routes), each with its last 20 versions so a change can be undone. They never contain a character or player name: the app leaves names out and the server refuses documents that carry one.
• Tools on the website: Gear Checker sets and gear plans you save while signed in, kept like your synced setups. Signed out, they stay in your browser only.
• Devices: for each PC you sign the app in on, the name the app sent, its app version and when it was last seen.
• Browser sessions: the browser and system (user agent) and the IP address, so you can see where you are signed in and sign a session out.
• Activity: sign-ins, devices approved, renamed or signed out, documents deleted or restored, exports. Kept 180 days, shown to you on your account.
• Server logs: requests and errors, kept for a few days to run and fix the service.

Routes, votes, comments and reports

When you take part in the community routes on the website:

• What is public: your Discord display name and avatar next to the routes and comments you post, the routes with their notes, the comments, and how many votes a route has. Who voted is never shown.
• What moderators see: reports and who filed them, a copy of the reported text as it was when reported, account ages, a route's vote timeline and how many of its votes and reports came from one network. When they hide or remove a route or a comment, or suspend an account, they keep a copy of that text for 90 days, so an appeal can be checked even after the post is gone. A report never tells the reported person who filed it.
• Spam and vote rings: we work out when your Discord account was created from its id (nothing extra is asked from Discord or stored). With each vote we keep a keyed hash of your network (the /24 or /64 block, not your IP address) for 30 days to spot vote rings. With each route you vote on we also keep a keyed hash of your Discord account for as long as that route exists, also after you delete your account, so a new account cannot vote on it again at full weight. Posting limits are counted per Discord account and per network.
• Reports: with a report you file we keep a keyed hash of your network until a moderator has dealt with it, at most 90 days, so several accounts on one network cannot hide a post by themselves; moderators see only how many reports share a network.
• Suspensions: if your posting is suspended, your Discord account id is kept for as long as the suspension lasts, also if you delete your account, so the suspension cannot be undone by signing up again.
• How long: unpublished routes 90 days, then deleted; comments you delete 30 days (moderators only, as evidence of abuse); copies of reported, hidden or removed text 90 days; the network hash on a report until it is resolved, at most 90 days; the Discord account hash on a vote as long as the route exists; resolved reports and moderation records 365 days; backups 14 days on top of each.
• Your export includes the routes and comments you posted, your votes and the reports you filed.

Friends, teams and live runs

These features are optional. They run only for what you turn on: friends and teams when you add someone, live sharing only after you switch it on in the app.

• Your public id (like SF-7K3Q-9ZPD) is made for your account the first time you use these features. People you give it to, or your add-me link, can find you with it. Nobody can find you by your Fellowship name unless you turn that on.
• Your Fellowship name and Friend Code are what you type. Friends, team members and people watching your live run see your Fellowship name; only friends see your Friend Code. Others never see your Discord name or avatar: those stay on your own account pages. You can change your name once every 14 days (free within 24 hours of first setting it); a moderator may reset a name that impersonates someone.
• Friends, requests, blocks and teams are kept until you remove them or delete your account. A friend request is forgotten 30 days after its last change, a team invite after 14 days, a notification after 90 days (or when it is not among your newest 200). Blocking someone hides you from each other and is never shown to them or to moderators.
• Online status: while the app is open it tells your friends whether the game is running, unless you set "Show when I am online" to Nobody. The website never reports you as online. Kept 10 minutes.
• Routes you share stay yours. People you shared with see your latest version until you stop sharing or delete the route; copies they saved are theirs and keep only your public id, never your name.
• Live sharing is turned on only in the app, after it shows you what it sends. While you are in a dungeon the app sends the dungeon, the key level, the clock, the route you follow and the pull you are on, and for each party member their hero, role, relic cooldowns, spirit and when a relic is used. It never sends a name from the game: the other players in your party did not agree to be shown, so they appear as heroes. They are not named, but a group can be recognised by joining its heroes, dungeon, key level and timing with public leaderboards. The website keeps only the latest update and forgets it 15 minutes after your last one; it is never stored in your history, your export or our backups. People who can watch your live run also see your own route while it runs, never a route someone shared with you.
• Who watches your live run is shown to you on your Sharing page, and viewers are told that you can see them. Watching someone's run shows them your Fellowship name. You can turn live sharing off on the website even when your PC is elsewhere, and narrow who can watch.
• Why: to run the features you use (our agreement with you); live sharing and online status additionally rest on your switch, which you can turn off at any time.
• When you delete your account your friendships, requests, blocks, team memberships, shares, notifications and live state go with it. Teams you own pass to the longest-standing member, or are deleted if you were the only one.
• Your export includes your profile, friends, requests, blocks, teams, shares and notifications, and your live setting (never live updates: none are kept). Other people appear in it only by their public id and Fellowship name.

Backups

The database is backed up every night to our server and to an encrypted copy elsewhere. Backups are kept 14 days, so something you delete can remain in a backup for up to 14 days before it is gone everywhere.

What we do not do

• No ads, no trackers, no third-party analytics.
• We do not sell or share your data.
• Videos on this site come from YouTube (youtube-nocookie.com) and load only after you press play. Until then nothing is requested from YouTube.

Your rights

You can see everything stored for you on your account, download it as a zip of JSON files, and delete your account with everything saved with it. Signing a device out stops it syncing at once.