Privacy policy

Last updated 1 November 2026.

Lasthavens is a free, independent fan project run by a small volunteer team. It is not affiliated with Blizzard Entertainment. This page explains what we collect when you use lasthavens.com and play on the realm, why, and what you can ask us to do with it. Questions or requests: email [email protected] or open a ticket on our Discord.

What we collect

Your account

Account name, and an email address if you chose to give one. We only use it to send a password reset link when you ask for one.
Your password never reaches us. The game turns it into a one-way verifier on your device, and we store only that.
Who recruited you, if you signed up through someone's link or entered a name under Recruited By.
When the account was made, when it last logged in, and any bans on it.

Your characters and play

Your characters, their items, progress, mail, guilds and friends, and any tickets you send to staff in game, as the game server keeps them.

The support bot

Our Discord helper is an automated bot. It keeps its conversations with you for up to a year, along with short notes about you written by the bot or by staff, such as which device you play on. It only keeps conversations it took part in. You can ask us to delete them at any time.

Chat

Messages in the World channel are posted to our Discord's World chat channel with your character's name, level, race and class. Replies from that Discord channel appear in game under the Discord member's name.
The game server may keep logs of chat and actions, which staff use to deal with reports, spam and cheating.

Connections and security

Each time you log in we record the time, the account and your IP address. We use it to stop abuse (limits on sign-ups and logins, IP bans) and to investigate cheating.

Crashes, freezes and performance

When the game freezes or crashes, the page sends us a report so we can fix it: your browser and its version, the kind of device, your graphics card's name, memory use and what was loading. Chrome can also send its own crash reports for the game page to us.
We count things per day (page views, Play clicks, device types, connections) without addresses or IDs, and for each play session we keep the time spent in the world and the average frame rate, under a random ID that isn't linked to your account.

Your settings and screenshots

Your game settings, key bindings, chosen addons and their saved data, and screenshots you take in game are stored on our server, so they are there next time you play in the same browser. They are filed under a random ID kept in a cookie (below), not under your name.

Site analytics

We run our own copy of Umami, which uses no cookies. It counts pages viewed and steps such as opening the game, creating a character, entering the world and the level you reach, with your device type. It uses your IP address to estimate your country. This data stays on our own server.

Creator Program

If you apply, we keep your channel link, Discord name and the name you want shown. Approved creators' chosen names may appear publicly on this site; the counts stay private.

Discord

Discord's own privacy policy covers your use of Discord. In our Discord server, our bot reads messages that mention it so it can answer, keeps contribution points by Discord ID, and logs moderation actions (warnings, mutes, bans) in a staff-only channel.

Stored on your device

Cookie wowuser (1 year): the random ID your settings and screenshots are filed under. It is needed for the game to work. Staff also have a session cookie for the admin page.
Saved logins: if you tick Remember, your account name and password are kept in your browser's storage, on your device only, so the game can log you in. Don't use Remember on a shared computer.
Small flags in browser storage: auto-login, the referral code you arrived with, whether you've seen the app or controller tips, and short crash diagnostics used to recover after a crash.

We use no advertising or tracking cookies.

Who else is involved

Cloudflare carries all traffic to lasthavens.com and protects it. Its Turnstile check at sign-up and password reset receives your IP address to tell people from bots.
Resend delivers password reset emails, so it receives your email address and the message when you ask for a reset.
Our AI provider writes the support bot's replies. When the bot answers you, your message and any pictures you attach, recent messages in that channel and what it remembers about you are sent to our AI provider, which may be outside your country. In-game tickets are sent the same way. Please don't share passwords or personal details with the bot.
Discord, for World chat, announcements and the community.
Your browser's speech service, only if you use voice typing: the browser (Google's service, in Chrome) turns your speech into text. Lasthavens never receives the audio, only the text you send as chat.
The company that hosts our server.

We don't sell your data, show ads, or use third-party analytics. We share data otherwise only if the law requires it.

We take no payments or donations and have no cryptocurrency, token or coin, so we never ask for or hold payment details or crypto wallet addresses.

Why we use it

To run the game and your account, keep the realm safe and fair, fix crashes, moderate chat, and understand how the game is used so we can improve it. We rely on our legitimate interest in doing those things, and on your consent for optional things like giving an email address or applying to the Creator Program.

How long we keep it

Your account and characters: until you ask us to delete them, or until the realm closes.
Login records and crash reports: 30 days, then deleted automatically. Your account itself keeps only the address of its most recent login, which is replaced each time you log in.
Daily counts: kept as counts only, which can't identify you.
Moderation records: as long as needed to enforce a ban.

Your choices and rights

You can ask us for a copy of what we hold about you, to correct it, or to delete your account and its data. Email [email protected]from the address on your account, or open a Discord ticket, and tell us your account name. We may ask you to prove the account is yours. Depending on where you live, you can also complain to your data protection authority.

Children

Lasthavens isn't meant for children under 13, and players under 18 need a parent's or guardian's permission. If we learn that a child under 13 has an account, we'll delete it. Parents can contact us at [email protected].

Security

Passwords never leave your device, and the site is only served over HTTPS. No system is perfect, so use a password you don't use anywhere else. Staff will never ask for your password.

Changes

If we change this policy we'll update this page and the date at the top, and say so on Discord for big changes.