Data sent and privacy

← Back to FlowUp · Français

What is sent

• The game events noted by the FlowUp addon: quests accepted, progressed and turned in, the NPCs who give them, in-game positions, level, XP, play time, deaths, zone changes, travel, and the comments you wrote in the addon. Also: quest items looted and from which monster or object, monsters killed (summarised by kind, with their level), the vendors, class trainers, flight masters and innkeepers met, the character's gold and what it spends on training and flights, and the group size (never other players' names), the quest rewards offered, and the path walked on foot (positions on the map, to work out real distances). From the next version (0.7.18) also: the monster that killed you (never a player), dungeon entries and exits (name, length, group size), average item level and profession levels, and every 5 minutes the time spent in combat, mounted, AFK and resting, gold looted, and XP split between quests, monsters and exploration; they feed the statistics of the "My characters" page. Your character's name is never recorded, even when the game writes it into a quest text.
• The character's race and class, the game version, the client language and the addon version.
• Programming errors of the addon, if any (message and place in the code), so we can fix them.
• A character identifier to group its sessions: with the text copied in game, it is a random number drawn by the addon; with a file, a fingerprint computed on your computer. The character name and the realm are never sent.

Sharing from the game (copy and paste)

The addon never connects to the Internet. With /flow partager, it shows a compressed text containing the events above, without name or realm. You copy it and paste it on the FlowUp page: it is read in your browser, then sent only if you tick the box and click Send.

Automatic sending in game (relay)

If you accept it in the addon, your notes leave while you play, in small invisible addon messages, towards a "collector": a FlowUp character online at the same time, run by the FlowUp team or by a trusted player. The packets contain the same events as the text copied in game, without name or realm, with the random number and the fingerprint of a secret code that the relay never sends (only FlowUp Companion uploads it, inside the log): if you wish, it will later let you link these notes to your key. They travel on a hidden FlowUp channel, addressed to the collector. Since version 0.6.34 they are encrypted: only FlowUp can read them, not other players, not even the collector (which keeps them without being able to open them). With a collector that is not updated yet, they leave as before, unencrypted: other players who have FlowUp could then technically see them pass, but they contain nothing that identifies you. Only an official collector can confirm them. Each packet also says when it was prepared and sent, to measure the relay's speed. The game shows the collector the sender's name during the exchange, as for any message; FlowUp does not record it. The packets received arrive here with the collector's log. Since version 0.6.37, packets are prepared out of combat and may also leave in combat or in a dungeon, but never while the game restricts addon messages (boss fight, mythic+, PvP match); the addon also notes how long preparing them takes, to check that the game is not slowed down. To stop: untick the box in the addon options.

Automatic sending (FlowUp Companion)

If you install FlowUp Companion (Windows or Linux) and accept sending, it sends the addon's save file (FlowUp.lua) after each game session: the same events as above, plus the addon settings (guide step you are at, options). It removes the character name and the realm on your PC before sending. It reads no other file, never touches the game, and keeps a copy of each log in Documents\FlowUp_Journaux. To stop: "Désinstaller FlowUp Compagnon" in the Start menu, or its menu in the taskbar.

What is not kept

• No character name, realm, account name or e-mail address.
• The server does not store your IP address in the database.
• The site only counts, day by day, how many times the addon and the Companion are downloaded, and how many Companions check for an update (with their version and system, Windows or Linux). These numbers contain nothing about you.

Why

To build and correct the leveling routes (location of Forever's new quests, real time of each step), to compute anonymous community statistics and your personal report. Legal basis: your consent, given by ticking the box before sending or by answering "Yes" when installing FlowUp Companion.

Where and how long

The data is stored at Cloudflare (D1 database, European Union jurisdiction). It is kept as long as the project exists, unless you delete it.

When you delete your data

• Right away: your key is erased, and your uploads lose everything that links them to you (key, character fingerprint). Nobody, neither you nor us, can link them to you anymore.
• Within 30 days: the logs themselves are erased, automatically. This delay lets us finish extracting the quest information.
• What remains: the anonymous quest information drawn from all uploads (where NPCs stand, what quests ask for, the XP they give). It says nothing about you or your character.

Your rights

With your contributor key (shown after your first upload, or in the FlowUp Companion window), the FlowUp page lets you see your uploads and delete them (see above), and the "My characters" page shows your characters' statistics: the site sends your own logs back to you and the statistics are computed in your browser; nothing of that computation is kept. The "Community" page shows anonymous totals of every character (medians per race and class, and map cells): we compute them from the logs received, and a group or a cell only appears once at least 2 different characters are in it; no name, no key and no single character can be found there. To find a lost key again, the site keeps, linked to the key, a fingerprint of each character's secret code (that code is part of the log the Companion uploads, like the rest of FlowUp's data; it only works for FlowUp and cannot lead to your account or your character); the link given by /flow stats in game carries that code after "#", which your browser turns into a fingerprint before asking for the key. You can also link your key to your Battle.net account (optional, signing in on Blizzard's site): the site then only keeps an encrypted fingerprint of your account ID, linked to your key, never your BattleTag, e-mail or password; the access Blizzard gives us is used during the sign-in and then thrown away. Deleting your data deletes that link too. The "Contact and suggestions" form on the home page keeps your message and, if you give it, your e-mail, without any IP address; they are only used to read your suggestion and answer you, and are deleted once handled. Against bots, this form uses Cloudflare Turnstile (a check that is usually invisible, with no advertising cookie); e-mails sent to the contact address are kept the same way. For any other request (access, rectification, objection): Maks3180 on Discord. You can also contact your data protection authority (in France, the CNIL).