Skip to content
ParabellumLog inSign up

Privacy policy

Short version: we keep what the game needs, nothing to track you, and you can download or delete it all yourself.

Last updated: 23 October 2026

Who we are

Parabellum is a free, non-commercial World of Warcraft fan server run by a private individual. Nothing is sold and nothing is advertised. The data controller for this website, the account service and the game server is Parabellum, reachable at logon.parabellum@gmail.com.

No tracking

No analytics, no advertising, no social media plugins, no fingerprinting, no third-party cookies. Fonts and images are served by this site itself. We don't sell, rent or share your data with anyone for their own use.

What we store and why

Your e-mail address
Signing in to the website and the game, and account e-mails (confirmation, password reset, security notices). Never newsletters or advertising.
Your password
Never stored as such. The website keeps an Argon2id hash; the game server keeps an SRP6 verifier (salted, stretched with PBKDF2-SHA512), the only form the game client's login protocol accepts. Neither can be turned back into your password, by us or anyone.
Account dates
When the account was created and confirmed, your last sign-in on the website and in the game.
Game data
Your game account and characters: names, race, class, level, play time, items, achievements, arena and War Front results and the rest of the game state.
Game connection data
The game server records the IP address of your last game login, failed login attempts, your client's language and operating system. Server logs keep sign-in failures (with the IP address) and anti-cheat detections for at most 5 weeks.
Security counters
To stop password guessing and spam, the account service counts recent attempts per IP address and per (hashed) e-mail address. The counters disappear after at most 1 hour.

Legal bases (GDPR art. 6): running your account and the game is the service you ask for (contract, art. 6(1)(b)). Security logs, abuse limits, anti-cheat and bans protect the players and the server (legitimate interest, art. 6(1)(f)).

Anti-cheat: the game server checks movements automatically. Repeated violations lead to warnings and then a ban. You can contest any ban on the Discord or by e-mail: a person reviews it.

Who else handles it

Only these providers, each for the job listed, under a data processing agreement:

OVH SAS (France)
Hosts the game server, the account service and its database, in a data centre in Germany (EU).
Vercel Inc. (USA)
Hosts this website. Processes your IP address to deliver the pages. EU-US Data Privacy Framework and standard contractual clauses.
Cloudflare, Inc. (USA)
Delivers the launcher and game client downloads. Processes your IP address to deliver the files. EU-US Data Privacy Framework and standard contractual clauses.
Sendinblue SAS (Brevo, France)
Delivers the account e-mails: receives your e-mail address and the message. Opens and clicks are only counted anonymously, never linked to you.

When you choose a password, the account service checks it against known data breaches with Have I Been Pwned. Only the first 5 characters of the password's SHA-1 hash are sent (k-anonymity): neither the password nor anything that identifies you leaves our server. The Discord server is run on Discord's platform under Discord's own privacy policy; joining it is optional.

How long we keep it

Website account, game account and characters
Until you delete them (or we close the server).
Account never confirmed
Deleted after 7 days.
E-mail links
1 hour (password reset) or 24 hours (confirmations), and they work once.
Sign-in session
Until you close the browser or after 2 hours without activity.
Security counters
1 hour at most.
Server logs (game sign-ins, anti-cheat)
5 weeks at most. Access logs of the account service: 14 days.
Delivery log at Brevo
1 month (address, date, delivered or not). The content of the e-mails is not kept.
Database backups
14 days on the server and 30 days on an offline copy. A deleted account disappears from them within 30 days.

How it is protected

  • Everything travels over HTTPS (TLS). The game login uses SRP: your password never travels to the game server.
  • Passwords are hashed with Argon2id (64 MiB of memory per attempt), the current recommendation for password storage.
  • E-mail links contain a random secret of 256 bits; we only store its SHA-256 hash, and the link expires.
  • The sign-in cookie can't be read by scripts (HttpOnly), only travels over HTTPS (Secure) and is never sent by other websites (SameSite=Strict).
  • Sign-in attempts, registrations and e-mails are rate-limited; the server bans IP addresses that keep guessing passwords.
  • The account service's database user can only touch the tables it needs. The database isn't reachable from the internet.

Your rights

Under the GDPR you can access, correct, export, delete, restrict or object to the processing of your data. Most of it is self-service:

  • Access and portability: your account page → Download my data (a JSON file).
  • Correction: change your e-mail or password on your account page.
  • Erasure: your account page → Delete my account. The website account is erased at once, the game account and characters within a minute, backups within 30 days.
  • Anything else (restriction, objection, a question): write to logon.parabellum@gmail.com. We answer within a month.

If you think we mishandle your data, you can complain to the French data protection authority, the CNIL (cnil.fr), or the authority of your country.

You must be at least 15 years old to create an account.

Cookies and local storage

This site uses only what is strictly necessary for it to work, so it doesn't need your consent (ePrivacy directive, art. 5(3)):

__Host-pbsid (cookie, api.para-bellum.eu)
Keeps you signed in. Only set when you sign in; deleted when you sign out, close the browser or after 2 hours idle.
pb-cookie-notice (local storage, this site)
Remembers that you closed the cookie notice. Stays in your browser; never sent to us.

No other cookie is set, by us or by anyone else. You can delete them at any time in your browser settings.

Changes

If this policy changes, the new version is published here with its date. Important changes are announced on the news page and the Discord.