Privacy Policy

Last updated 27 October 2026

Conquest Reborn is a non-commercial, volunteer-run game realm. We keep as little about you as an account system can work with, and this page says exactly what that is. It describes what the software actually does — not what we intend to do later.

The short version. We store your account name, your email address, and a cryptographic verifier derived from your password. We never store your password, and we cannot recover it — not for you, not for anyone. We do not sell anything and we run no advertising. Outside this site, only the services named under Services that handle your data for us see any of it, each for its own job — for example the one that delivers our password-reset emails — and, if you let your launcher share the game, other players see your IP address. Ask us and we will delete your account.

Your characters' dungeon and raid performance, with the gear and build they had in each run, is shown to other signed-in players on Conquest Logs, and their equipped gear in the Gear Planner's armory, with their names, unless you hide them — one switch per character on your account page.

Who is responsible

The realm and this website are operated privately by the Conquest Reborn project. For anything on this page — a question, a correction, or a deletion request — email privacy@conquestreborn.com. It reaches a person, not a mailbox nobody is watching.

What we store, and why

DataWhyKept for
Account name It is how you log into the game and this site. In the game you may type your email address instead of the account name (see the next row but one). Until you ask us to delete the account.
Email address Password resets, and contacting you if something happens to the realm. We also email you when your account's password is changed on the account page, and the old address when the account's email address is changed, so you notice if it was not you. These emails are sent through Resend (see below). We do not send newsletters or marketing of any kind. Until you ask us to delete the account.
Password verifier and salt Proves you know your password without us ever holding it. This is how the game's own login protocol (SRP6) works. Until you ask us to delete the account.
A second verifier and salt, for your email So the game can check a login typed as your email address instead of your account name. The game's login protocol mixes the name you type into the proof, so the email needs a verifier of its own. This site makes it — the only place your password is ever seen, for the moment it takes — when you register, sign in, change your password or reset it, and again when you change your email address; it is thrown away with the account. It is not your password, and the website's database login can write it but not read it back. An email typed into the game's login screen travels over the network in the clear, exactly as an account name does (the password never does); the game servers do not write the typed email to their logs — they log your account name. Until you ask us to delete the account, or until you change the email address.
IP addresses The game server records the address of your last login and last login attempt, as standard for this server software, and the address you bought Conquest Casino lottery tickets from, which that day's draw needs. The website's account and statistics services use your address only in memory: to rate-limit registration, login and password reset requests and the game masters' balance page, to cap how many pages and character look-ups one address can ask for, and to cap how many password-reset emails one IP address can trigger in a day. The last-login records are overwritten each time you log in. A lottery ticket's address is erased when that day's lottery is drawn. In the website's services the address is kept only in memory, for at most a day, and is never written to disk. One exception: an IP address's count of reset emails can stay in memory a little past the day, until the site next checks its email limits (a reset request, an account notice or the reset page's mail check) or restarts.
Web server access log The web server writes one line per request: the time, your IP address, the page or file requested, and your browser as it describes itself. We use it to find faults, such as a launcher that could not fetch its update list, and abuse. Requests for Conquest Logs', Meta's and the Gear Planner's data — including the Gear Planner's catalogue and icon files under /data — are left out of it, so which runs, characters, leaderboards or gear you looked at is not in it. There is no fixed limit. The log is deleted automatically in parts: a part goes once it is more than 14 days old, but only when the log next fills up or the web server restarts, which can take weeks. The log holds no account name. The one time we match it to an account is when you ask us about a launcher problem: we look up the address your account last logged in from, to see what your launcher fetched from this site. The game files themselves come from Cloudflare (see below), not from this site.
Launcher failure report Only after a start that failed (or that the launcher's own check of your PC had to stop), your launcher asks this website for one small file and adds a few facts to the address: what kind of failure it was, the launcher and game-file version, your Windows build number, the names of your antivirus programs, whether the Visual C++ runtime is installed, how a quick connection test to our realm went (and how many milliseconds it took), what kind of drive the game is on (fixed, network or removable), and what the launcher did about it. It never sends your account name, a character, a file path, your computer's name or your Windows user name; as with every request, the web server sees your IP address. Nothing is sent when a start works, and the same kind of failure is reported at most once a day. It is on by default; untick Send anonymous failure reports in the launcher's Settings and nothing is sent. It is one line of the web server access log (above) and is kept exactly as long as that row says: no fixed limit, deleted in parts once older than 14 days, when the log next fills up or the web server restarts. We read those lines to see which failures are common.
Characters and play data Your characters, their progress and their possessions — the game cannot work without them. Until you ask us to delete the account. A character you delete in the game is kept for 30 days, so the Help menu's Recovery Service can bring it back, and then erased.
Unstuck moves When you press Unstuck beside a character on your account page, the realm moves that offline character to its inn and writes down which account and character it was, when, and the position it was saved at and the one it was moved to. That record is how the limits (once an hour for a character, three times a day for an account) are enforced, and how we check a report of misuse. Nothing else sees it, and it is shown to no other player. 90 days, then it is erased the next time anyone's character is moved. The character's new position is part of the character, kept as under “Characters and play data”.
Refer a Friend When you open the Refer a Friend card on your account page, the realm gives your account a random invite code. When someone creates an account with it, the realm writes down that the two accounts are linked, and when; the number of different days the friend has logged in; the highest level and the most time played on any of their characters; when they reached each of three milestones; whether one of your five counting places is theirs; and one flag number that says the two accounts share a login address or an email address, which makes the milestones take longer (the address itself is not kept in this record). It also keeps which rewards were paid, and an audit of account numbers and short reason codes — no name, no email and no address. You see your friends on the card only as numbers with how far along they are, never by name, and the card shows “joined” only as a count for the month. The code in a link sits after the # in the page address, which a browser does not send to any server; it is sent to us once, when your friend creates the account. Until you ask us to delete the account, which removes its code, its links (as the one who invited and as the one invited) and its reward record. The audit is erased after 90 days.
Performance records For every dungeon and raid run, the realm records what each character in it did: damage, healing, damage taken, deaths, abilities used and boss attempts. It also records the gear (with its enchantments and gems) and Character Advancement build each character had when it entered a run, at a key start and at each boss pull. And it keeps the last moments before each death: the hits and heals, who or what dealt them, and the health left. It also counts the spells each character cast, and its interrupts and dispels. It also records how long buffs and debuffs were up: the buffs on each character and the ones it kept on others, and its debuffs on bosses. It also keeps each character's damage, healing and damage taken over the course of the run. It also records the guild each character was in at the time. The rankings also show each character's item level and gear bracket as recorded for that kill or key. Conquest Logs shows them as run reports, leaderboards, rankings and character pages; Meta turns them into totals per spec. It also remembers which account each of its characters belonged to — never shown — so they can be taken off when that account is deleted. Full run reports: 95 days. Leaderboard places, rankings, personal bests, records, scores and the character names on them: permanently. The gear and build of each ranked kill and timed key: permanently; a hidden character's are kept but shown to no one else. Meta's daily totals: 100 days.
Current builds Each night the Gear Planner works out, per spec, what share of level-60 characters of that spec have picked each node of their build, and shows those shares as a spec's “current builds” once at least six characters count. Hidden characters are left out of them from the next nightly update, within a day of switching Hide on. The current Character Advancement pick rates: each night's figures for 100 days.
Builds in runs and support credit Each night the Gear Planner also works out, per spec, what share of characters took each node of their build in the dungeon and raid runs of the last 95 days (“builds in runs”) and in the best quarter of each ranked board this season (“top players' builds”). They are counted per specialisation, shown only once at least six characters count, and never taken from a hidden character (from the next nightly update, within a day of switching Hide on). On the rankings of support specialisations and on a character's best ranked kills, Conquest Logs shows beside a ranked result what that character's buffs, debuffs, interrupts and dispels came to in that kill or key; Meta shows a support spec's typical figures. The nightly build figures: 14 days. Support credit: 95 days, like the full run report.
A build many top characters ran Each night the Gear Planner also looks, per specialisation and per kind of content (all content, raids or Mythic+), for one build that at least six different characters of the best quarter of the ranked boards this season ran exactly: the same nodes at the same ranks (the free passives a specialisation grants are not part of it). When there is one, the Talents builder and Meta show it as “a build 6 or more top characters ran” with the number of characters, and the builder offers to copy it as your plan. Where there is none yet they say it is still collecting, and until this part of the website is switched on they show nothing about it. What is kept is the list of nodes and ranks, how many characters ran it and how many the quarter holds — never a character, a name, a guild or an account. A build that fewer than six characters ran is never kept or shown. Hidden characters are left out before anything is counted (from the next nightly update, within a day of switching Hide on). The nightly figures: 14 days, and only the newest is shown.
What players wear Each night the Gear Planner also counts, per specialisation, which items, enchantments and gems characters wear: from the equipped gear of level-60 characters, from the gear recorded in the dungeon and raid runs of the last 95 days, and from the top quarter of each ranked board this season. They are shown as “worn by players” and “worn by top players” only once at least six characters count, and an item only once at least two characters wear it. They are totals: no list shows who wears what. A hidden character is never counted (from the next nightly update, within a day of switching Hide on). The nightly totals: 14 days.
All Stars and Performance Average Conquest Logs also ranks the characters of a specialisation by season points on its ranked boards (the sum of each character’s best percentile on the boards it is on) and shows a Performance Average from three boards, on the All Stars tab and on a character page. They are worked out from the same rankings, listed only for characters that are not hidden, and only for boards with at least ten characters. A hidden character leaves the list at once, for everyone but its owner. The nightly figures: 14 days, a hidden character’s row included, shown to no one else. The rankings they come from: permanently.
Guild pages Conquest Logs also lists the guilds that ran in the last 95 days and gives each its own page: the guild the realm last noted for a character during a run, the number of players and runs, the raid progress and the best timed keys as counts and durations, and the players seen under the tag. A guild appears once at least three players have been seen under its tag, a run counted for it and it has runs on at least two days. A hidden character is not counted among a guild's players (from the next nightly update) and, until then, is listed only for its owner. Opening a guild page counts toward the same daily lookup limit as looking at another player's character. The guild noted for each character in a run: 95 days, like the full run report. The nightly figures: the previous night’s are kept up to 3 days.
Saved gear sets The sets you save in the Gear Planner: a name, a spec, the items with their enchants and gems, your stat weights, and the character you made it for. They are kept per account, on our server. A set you share can be opened by any signed-in player who has its link; they see the set, never its character or your account. They do see the set's name: the planner never suggests a character's name for one, and asks first before it shares a set named after one of your characters. Until you delete the set, or ask us to delete the account: deleting the account deletes its saved sets, shared ones included.
Your “Hide me” choices One setting per character, chosen on your account page, that takes its name out of what other players see: off the Mythic+ score board and the rankings, and shown only as “Hidden” and its spec everywhere else. Until you change it, or until the character moves to another account or is erased with nothing on Conquest Logs to hide. When an account is deleted its characters' switches stay on, so the deleted characters stay hidden.
Password reset tokens So a reset link can be used once and then stop working. Only a hash of the token is stored in the database, never the link itself. The link is emailed to the address on the account, through Resend; if several accounts share that address, one email lists a link for each of them. If the email is not sent — email delivery is switched off, the sending service fails, the address cannot receive email, the email address or your connection has had as many reset emails as we allow for now, or the day's email limit is reached — the link is written instead, with your account name and email address, to a file on the web server that only we can read, so it can be passed on to you by hand. When the email address itself has had too many emails, the file gets a one-way keyed hash in place of the address. The link stops working after one hour, or sooner once it is used or a newer one is asked for. The stored hash stays in the database, unusable, for at least a week after that, and is deleted the next time anyone asks for a reset link. A line in the file is deleted once it is 14 days old, and only the newest 2,000 lines are kept. The clean-up runs when the service starts and, at most once an hour, when a new line is written, so while nothing new is written a line can stay a while past 14 days. The email itself stays in your mailbox until you delete it.
Email limits To cap how many emails go to one account or one email address, and how many the whole site sends in a day: the account's number in our database, a one-way keyed hash of the email address (never the address itself), and the times an email was sent or a reset link was made for the account. They are in a file on the web server that only we can read. Each entry counts for at most a day. It is removed from the file the next time the file is updated (when a reset link is made or an email is sent), so while that does not happen an expired entry can stay in the file longer.
Database backups Every night, and before each update to the realm, the realm server makes a copy of the account, character and website databases, which hold your account name, email address, password verifier, last-login address (and the ticket addresses of a lottery not yet drawn), characters, performance records, “Hide me” choices and saved gear sets. The copies stay on the realm server and are used only to restore the realm after a failure. About two weeks: each copy is deleted automatically by the first nightly run after it is 15 days old.
Chat translation Public chat you type in the World channel, in say and in yell is read by a program that runs on the realm's own server. If it finds a message in Spanish, German, Russian, Turkish, Italian or Dutch, it makes a machine translation into English, and players nearby or in the channel see it as an extra line under your message, labelled like [ES>EN]. The message is never sent to any other company or service, the program has no internet access, and it is never told your name or account. Translations are machine generated and can be wrong. Private chat (whispers, party, raid, guild) is not translated. .translate off in the game stops it for your account: your messages are not translated for others and you see no translations. Normally no chat text is kept anywhere; the realm only counts how many messages were translated and into which language. Now and then, for about two days at a time, the translator also saves the text of the public lines it looks at, without names or accounts, in a file only we can read, so we can check that it translates well. We delete it as soon as a sample has been read, and always within 14 days. This page is updated before such a check starts. Not kept. The translator keeps the last few thousand translated lines in its memory to answer a repeated line quickly; they are gone when it restarts.
Developer copies To fix problems and tune the game, game data — character names and game records — may be copied to a secured developer machine. These copies never include passwords or email addresses. No fixed limit: a copy is kept while that work needs it. When an account is deleted at its owner's request, its characters are taken out of these copies too.

Conquest Logs, Meta and your characters

Conquest Logs, Meta and the Gear Planner are open only to signed-in players. Inside them, any signed-in player can see:

Bags and bank are shown only to their owner: the Gear Planner shows your own characters' bags and bank, the personal bank included, to you and to no one else.

Your account name, email address and IP address never appear there, and no page says which characters belong to the same account.

The “Hide me” switch. Each character has one on your account page. A hidden character is left out of the Mythic+ score board and the rankings straight away, and the characters below it move up. On the group leaderboards (timed keys, raid clears, boss kills and first recorded kills) its group's run keeps its place, and the character shows only as “Hidden” and its spec, with no name and no link; it shows the same way in other players' run reports. The first recorded kills name no one: every player there, hidden or not, shows only as a spec and a role. It has no character page for anyone else, and its gear, build and guild in run reports are shown to no one else: a search for it or a link to it answers “Not found”, and so does its armory. A hidden character's spells and buffs in a run, those of the items it uses included, still show under “Hidden” and its spec, as its damage and healing do. You still see everything about your own characters. Hidden characters still count toward Meta's per-spec totals, which never show a figure drawn from fewer than six characters, but not toward the Gear Planner's current Character Advancement builds (from the next nightly update, within a day). Hidden characters are also left out of the builds in runs and the top players' builds, and their support credit is shown to no one else. Hidden characters are also left out of the build many top characters ran. Hidden characters are also left out of what players wear. Hidden characters are also left out of All Stars and the Performance Average, at once. Hidden characters are also not counted among a guild's players (from the next nightly update); until then a guild page lists them only for their owner. Hidden characters still count toward the rankings' percentiles, which are shown only where at least ten characters have a ranked kill.

Leaderboard places, rankings and records are permanent and keep the name the character had, also after the character is deleted, unless it was hidden before it was deleted. Full run reports are deleted after 95 days; the run's summary and its group stay, and so do the gear and build of each ranked kill and timed key.

Apart from the fonts described below, everything on these pages is served from this site, including the item, spell, class, spec and Character Advancement icons of Conquest Logs, the Gear Planner and Meta, which we serve behind the sign-in.

What we do not do

Cookies and local storage

We set no advertising or tracking cookies. Two things are stored in your browser, and a third if you use the Gear Planner:

Clearing your browser's site data removes them all and signs you out.

If you open a Refer a Friend link (an address ending in #register= and a code), the code is kept in your browser's session storage under cr_ref, for that tab only, so it is still there if you click to another page before you create your account. It is sent to us once, with the sign-up, and is forgotten when the account is made or the tab is closed.

Services that handle your data for us

We run the realm and this website ourselves, on two servers rented from Hetzner Online GmbH in its data centres in Germany. A few outside services each do one job for us. These are all of them, and what each one gets:

Sharing in the launcher. The launcher asks once whether it may share the game files with other players, and you can change your answer at any time under Settings → Sharing. If you allow it, your launcher shares while it is open (slowly while you play, unless you choose full speed), and stops after a week of sharing or once it has shared twice the game's size. While it shares, other players' launchers, our tracker, and anyone who asks our tracker can see your IP address. Our tracker keeps its list only in memory and forgets an address 20 minutes after that launcher last checked in. If your computer cannot look up our addresses, the launcher asks Cloudflare's and Google's public DNS services instead (the same two companies as in the connection test above).

Your rights

If you are in the UK or EU, the GDPR gives you the right to see what we hold about you, to correct it, to have it deleted, and to object to how it is used. We will honour those requests wherever you live, because there is no reason not to. If you think we handle your data wrongly, you can also complain to a data protection authority, for example the one in the country where you live.

Our legal basis for your account, your characters and the emails about your account is the contract we have with you: it is what running an account you asked us to create requires. The access log, the rate and email limits, the fonts, the game downloads and our answers to what you send us by email or through the Help menu rest on our legitimate interest in running the realm and this site, keeping them safe from abuse and answering you; you can object to any of them by emailing us. Launcher sharing rests on your consent, which you can withdraw at any time under Settings → Sharing.

Security, honestly stated

Traffic to this site is encrypted with HTTPS, and the connection between the website and the game database is encrypted as well. Our emails leave the web server encrypted, to a sending service whose certificate is checked; from there they travel to your email provider encrypted whenever it supports that, as most email does. The launcher's check-ins with our sharing tracker are not encrypted. The web server is deliberately unable to read any account's password verifier, so a break-in there does not expose password material for accounts that already exist.

That said: this is a hobby project run by volunteers, not a company with a security team. Use a password you do not use anywhere else. The game client's own limit is 16 characters, which is not long by modern standards — that is the client's constraint, not our choice.

Children

This service is not directed at children under 13, and we do not knowingly create accounts for them. If you believe we have, contact us and we will delete the account.

Changes

If this policy changes in a way that affects what we collect or why, we will say so on the news page and the changelog rather than quietly editing this one.