Privacy Notice

This notice describes the site's data paths. The dated changes at the end list revisions.

Scope

This notice covers the public pages, server functions and Talent plugin served at wowforeverguides.com. It also covers the Talent plugin email contact. WoW Forever Guides is an independent fan publication about World of Warcraft: Forever. It is not Blizzard Entertainment's privacy policy, and it is not affiliated with or endorsed by Blizzard.

Talent Planner in ChatGPT and Codex

Classic MMO Talent Calculator (formerly the WoW Forever Guides Talents plugin / WoW Forever Talent Calculator) is an independent fan-made calculator from WoW Forever Guides, not affiliated with or endorsed by Blizzard Entertainment. It supports the published World of Warcraft: Forever beta snapshot, not Classic or Retail trees. It needs no sign-in. Its /mcp endpoint receives class, level, tree name, talent IDs/ranks, build codes or site links, search text and result limits to return public talent data, validation, comparisons and build links. Cloudflare receives the requesting client's IP address and headers; the caller may be a chat host or a local client. The endpoint's code does not fetch user-supplied URLs, connect to game accounts, use payment data or an inference API, store builds, or log request bodies. The host, such as OpenAI for ChatGPT and Codex, receives tool inputs and results under its own policies. Enter no personal or sensitive information.

The server processes tool arguments in memory to answer the request. It returns these results to the caller; there is no conversation-transcript field in its tool schema. The tool interface is:

Search text and other free-text inputs can contain personal information if you put it there; the code does not remove it before processing. Error results may repeat supplied tree names or invalid talent IDs. Do not enter personal or sensitive information. The results include the dated dataset and its source limits.

The widget keeps allocations, per-class builds and undo in page memory, without cookies or browser storage; closing or reloading clears them. This differs from the legacy class/spec calculator's localStorage described below. Use build in chat, when available, sends the class, level, ranks, code, link and dataset build number to the conversation. Copied links and chat context survive outside the widget. Icons, backgrounds and, if the host connection is unavailable, the dataset load directly from this site; Cloudflare receives those browser requests.

Build links contain the class, allocation code and any level below 60. Recipients can read them; browser history or hosting metadata may record them. Opening a build link, Open on the site or a footer site link loads a page where Clicky, Google Analytics and Microsoft Clarity can run (see Your analytics choice); they can then receive its address including the build. Those site pages may also show affiliate links, as described below. Updated Druid links reopen in the standalone planner, which bypasses those site analytics. Copying a link writes it to your clipboard without sending it to a new recipient; sharing it is your choice. External dataset-attribution and Blizzard-source links leave this site when followed, and the destination receives the resulting browser request under its own policies.

The widget source contains no analytics scripts or affiliate offers. The standalone preview bypasses the shared shell and its analytics. Cloudflare can inject its Insights beacon; the preview's security policy blocked it in a Chrome check on October 1, 2026. Cloudflare serves the endpoint, assets and preview and may process request/security metadata; stored HTTP request records, the saved Web Analytics setting and their documented reporting windows are described under Other network requests. Retention and deletion of other provider records and copies remain unverified. Serving requests and assets, answering tool calls and diagnosing availability or security problems are the hosting purposes. The plugin code has no database writes, analytics calls or third-party inference requests; the site's D1-backed Ask, name, macro, addon and affiliate features below are separate services, not destinations for /mcp tool arguments. The plugin keeps no server-side build record to delete. Closing or reloading does not delete tool results already held by a chat host, copied links, browser history, hosting records or support emails. You can avoid sending a build to chat, opening or sharing links, and clear widget memory by closing or reloading. Provider opt-outs below apply to site browsing. For support with the plugin or its widget, or a privacy question or request about the plugin, email [email protected]. See Talent plugin email contact for email data handling and request controls.

Ask the Numbers on the Stats Page and Guide Pages

The Ask the Numbers box on /stats, and the Ask box on some guide pages, send the question you type to this site's /api/ask function (first named /api/ask-numbers). If the same question was answered on the same page in the last 30 days, the stored answer is returned. Otherwise the function sends your question, with the stats page's published tables, the text of the page you asked from and the guide sections that match the question, to Anthropic's AI service, which writes the answer; Anthropic handles it under its commercial terms and privacy policy. Follow-up requests can also send up to three previous question/answer turns held in page memory to Anthropic. Answers come from an AI model and can be wrong, so check the linked data before quoting one.

The site stores each question and answer, the page it was asked on, the guide sections it read, whether it was answered and what the AI call cost in its Cloudflare D1 database. Cleanup targets question logs older than 90 days and answer text older than 30 days, but does not run on a fixed schedule; see Retention and privacy requests. It does not add a raw IP address or a separate name field to those question records, but the stored question and answer can include personal information you type or the model repeats. To limit how often one visitor can ask, it keeps counters under a hash derived from the IP address and date. Each Ask question also gets a daily tag derived from that hash, so the team can read one visitor's questions together. These are pseudonymous identifiers, not a guarantee of anonymity. Counter expiry and cleanup are described below. Enter no personal or sensitive information in the box. A link to an answer puts the question in the page address (?ask=), so anyone you share it with can read it. When site analytics are on, including cookieless mode, asking also sends an ask_numbers event to Google Analytics with categorical outcome (answered, not found or an error type), chart, stored-answer and follow-up indicators; it does not include the question text.

Name Generator

The name generator sends your choices (race, class, gender, vibes, a kept name part) and anything you type about your character or in Check My Name to this site's /api/names function, which passes them to Anthropic's AI service to write names; Anthropic handles them under its commercial terms and privacy policy. The name generator's handler does not write your character text, checked name or generated names to D1. It writes rate-limit counters under hashes derived from the requesting IP address and date, without the raw IP address in those counters. It does not create the Ask box's question log or daily question tag. Counter expiry and cleanup are described under Retention and privacy requests. Your shortlist stays in your browser's localStorage, and a Share Link puts the shortlisted names in the page address after #names=, so anyone you share it with can read them. When site analytics are on, including cookieless mode, the generator sends a name_generator event to Google Analytics with the action (forge, check, save, copy or share), AI/local source and any categorical failure reason; it does not include the names or typed character text.

Macro Builder

The macro builder sends your choices, what you type and any macro you paste to /api/macro, which passes them to Anthropic's AI service on the terms above. The handler caches the finished response, including generated macro code and explanations, under a hash of the request. It does not store the raw request as a separate prompt field, but cached output can repeat text or macro code you supplied. Cached responses are reused for up to 30 days; physical deletion depends on the cleanup described below. Rate-limit counters use hashed IP/date keys. Recent macros and your class stay in localStorage. When site analytics are on, including cookieless mode, a macro_builder event sends categorical action, source (cache, AI or none), success and failure reason; it does not include the macro or prompt text.

Addon Maker

The addon maker sends what you type, a pasted error, and the files of a saved project to /api/addon. That function passes them to Anthropic on the terms above. A build that passes the checker is saved in D1, with its prompt, generated files, version and check result, under a hash of an owner key kept in this browser's localStorage as wfg-addon-owner. Projects made with the same owner key can be linked by that hash. Outputs can repeat details you supplied. The share address uses ?a= and does not include that key. It shows the latest files, the prompt for that version, and the check result. Delete sends the key in the request body, not in the address. Cleanup removes projects and versions older than 90 days since the last change, and build-cache entries older than 30 days, when it runs successfully. The API invokes it on read/build requests; the repository also configures a cleanup worker every two minutes, whose current live schedule is unverified. Delete removes the project and all its versions but leaves the separate build cache until cache cleanup. Counters work as above. If browser storage is blocked, a successful build can still be saved on the server, but its owner key lasts only in page memory and can be lost on close/reload. Without that key you cannot use the page's owner-delete control. A short list of your projects stays in localStorage under wfg-addon-keep. With full analytics, an addon_maker event sends only the action and its outcome.

The addon maker is configured to load Cloudflare Turnstile from challenges.cloudflare.com when attempting a build or other POST action, to check for bots. The checked page security policy blocks this script; if it is blocked, generation cannot proceed. When validation proceeds, the server sends the challenge token and requesting IP address to Cloudflare's Siteverify service; D1 keeps a token-hash replay counter with a 10-minute expiry timestamp, subject to shared counter cleanup. Cloudflare's Turnstile Privacy Addendum describes IP addresses, TLS fingerprints, user-agent headers, site keys and associated origins used for bot detection and improvement. Turnstile is a functional anti-abuse check, separate from the analytics choice; Pass does not disable it. Avoiding addon build actions avoids this page-triggered check. Site-specific Turnstile retention and deletion controls are unverified. Cloudflare's Siteverify documentation describes token validation; token expiry is not a promise that provider records are deleted then. This service is not used by the Talent plugin.

What the Site Does Now

The site is an editorial publication with static pages and server functions for link redirects, the talent plugin and the Ask, name, macro and addon tools described above. Its current routes (listed on the HTML sitemap) contain articles, guides, source links, navigation, images, video embeds, and a talent calculator. The checked public pages have no contact form, newsletter signup, comments, account creation, login or payment flow. The addon maker accepts the project text and files described above; the AI tools receive typed input.

The legacy talent calculator on the class and spec pages stores data in your browser's localStorage. Builds you save with "Save build" (the "My builds" list) are kept under wft-my-builds, and the "Show original Classic" setting under wft-compare-classic. These values stay in your browser; the calculator code on this site does not send them anywhere.

The current calculator at /talents keeps edits and undo in page memory, without saving builds in browser storage. Closing or reloading clears that memory. It loads its dataset and assets from this site. Copying a build puts its class, encoded ranks and planning level in a share URL on your clipboard; copied or shared links survive outside the page and can be read by their recipients.

Normal public pages, including the homepage, can show a RestedXP offer when you move to leave. Legal, error, admin and embedded app pages are excluded. After 10 seconds, moving your pointer out through the top triggers it on desktop; on touch screens, scrolling back up quickly after reading 40% triggers a bottom sheet. To show it at most once a week, the site stores the time it last appeared under wfg-exit-offer-seen, and the time you last followed an affiliate link from any page under wfg-affiliate-clicked, so the offer stays away for 30 days after you have already visited RestedXP or Zygor. Both are timestamps kept in your browser's localStorage and sessionStorage (a fallback across page changes); the site's scripts do not send those stored values anywhere. The seen time also goes in a first-party wfg_exit_offer_seen cookie, returned only to this site across its pages and subdomains. That cookie expires after seven days. The cap lasts from the first successful display; dismissal does not restart it. If both stores are blocked, the cookie can retain the preference. If neither a cookie nor durable storage can retain it, the offer stays hidden for that page view. Clearing site data or using another browser or device can remove the cap. When analytics consent is granted and providers are loaded, the offer's views, closes and clicks are reported as exit_offer_view, exit_offer_close and exit_offer_click, with the page path and which offer it was.

The class-guide button wording experiment wfg_class_cta_v1 is disabled by default. If enabled, it runs only with full analytics: by default outside the regions under Your analytics choice, only after Need inside them. It stores the assigned wording and experiment start/end times in localStorage under wfg:experiment:wfg_class_cta_v1, with no visitor ID. The assignment is valid only until the experiment's fixed end, at most 42 days after its start; repeat visits do not extend it. Browser storage has no automatic expiry, so the unused value can remain afterward until active-page cleanup removes it or you clear site data. Without full analytics, the experiment does not read or create an assignment, change the button, or send experiment events. Pass removes any previous assignment without reading it, even while the experiment is disabled; after enrollment it also restores the original button and stops experiment tracking.

From its replacement deployment on October 3 through October 31, 2026 at 06:40 UTC, the RestedXP popup design experiment wfg_exit_offer_design_v2 assigns eligible browsers equally to two popup layouts. Both use the same copy, artwork, affiliate links, triggers and frequency limits. It uses the same full-analytics rules, stores only the assigned design and fixed run times in localStorage under wfg:experiment:wfg_exit_offer_design_v2, and reports categorical exposure and RestedXP affiliate-click events to GA4 and Clicky. It sends no visitor ID or purchase information. Returning visitors keep their design; Pass removes the assignment and stops its events. After the fixed end, assignments are unused and removed on an active visit, and the original popup design returns for everyone. Outside full analytics, or with blocked allocation storage, the original popup remains available without experiment enrollment. Explicit preview addresses do not enroll or send analytics. The earlier popup-versus-no-popup experiment wfg_exit_offer_v1 has stopped on replacement pages; its old provider records remain separate. Its unused local assignment may remain until Pass or you clear site data.

When active with full analytics, the experiment sends categorical exposure and affiliate-click events identifying the experiment and assigned variant. GA4 also receives the canonical page path and, for clicks, the affiliate name. Clicky receives a categorical event path, and Clarity receives experiment events and tags. The experiment sends no site-generated visitor ID, names, email addresses, link text or destination query strings. Each analytics provider uses its own visitor/session measurement, subject to the limits described below. The same analytics setting controls the experiment and the three analytics services. It does not stop hosting/security processing, functional AI requests or their storage, or the separate off-site and social redirect records described below. Those redirect handlers do not check Pass, Do Not Track or Global Privacy Control; avoiding those links avoids their request records. On-site /link/<name> counts do honor those controls as described below.

The legacy calculator is adapted from WoW Forever Talents and served from this site's /assets/talents/ path. Its code also contains that site's build-voting feature, which is switched off here: the vote buttons do not appear, and the code that would set the feature's cookies (wft-consent, wft-voter, wft-seen) or send requests to /api/builds/ does not run. This site has no /api/builds/ endpoint. The code still reads document.cookie to look for its own wft-consent and wft-voter cookies, reads the unused wft-builds and wft-vote-pause storage keys, and removes older wft-votes, wft-counts, and wft-api-stop keys if a browser has them.

The site's own scripts also use fetch for files on this site. The talent tooltips on the home page, the class and spec pages and /talents fetch one JSON file per class, such as /data/talents/warrior.json, the first time a tooltip for a talent in that class is needed. The calculator's loader fetches its stylesheet from /assets/talents/. These requests go only to wowforeverguides.com and carry no page text or reader input.

The site's own scripts do not create analytics cookies; the consent control expires known first-party analytics cookies on withdrawal. The third-party analytics scripts described below run their own code once analytics are on. With full analytics, Google Analytics sets first-party cookies, and Microsoft Clarity can set first-party and third-party cookies. The site's own video-track.js passes video actions to Clicky, and affiliate-tracking.js calls the analytics APIs described below, only while analytics are on.

The contact page lists [email protected] for editorial and site questions. Talent plugin support and privacy inquiries can be emailed to [email protected]. No separate privacy-request process for other site data has been established. The site has no submission form; the talent plugin endpoint described above processes tool requests without storing builds. Do not send private information to an address guessed from repository or account records.

Analytics

The site uses Clicky, Google Analytics 4, and Microsoft Clarity, and shows no consent pop-up. In the US and every other country outside the EU and EEA, the UK, Switzerland, Canada and Brazil, all three run by default, with Google Analytics and Clarity cookies. Inside those regions, and when the country is unknown, only cookieless measurement runs by default: Google Analytics with every consent type denied and Clicky with its cookies turned off; Clarity does not load. Pass or a Do Not Track or Global Privacy Control signal stops all of it in every region. With JavaScript disabled, none of these analytics scripts or a fallback tracking pixel loads. The talent plugin widget and its standalone preview bypass the shared shell and do not load these services.

Automated browsers (webdriver, or a crawler, headless, test-runner or Claude app user agent) and the team's own browsers load none of the three. ?wfg_internal=1 flags a team browser with a wfg:internal localStorage key and a 400-day wfg_internal cookie, holding no visitor ID; ?wfg_internal=0 removes both. Clicky's beacon path drops flagged and automated requests, Google Analytics filters out a flagged browser's late hits as internal traffic, and all three dashboards ignore the team's home IP range.

Your Analytics Choice

Pages get your country from this site's /api/geo function (the country Cloudflare assigns to the request) or Cloudflare's /cdn-cgi/trace, and, outside those regions, keep it in sessionStorage under wfg:analytics-region until the tab closes.

In any region, Analytics settings in the footer lets you choose Need (full analytics with cookies, Clarity included) or Pass (Clicky, Google Analytics and Clarity off). The choice, decision time and expiry are stored in localStorage under wfg:analytics-consent:v1 for 180 days; visits do not extend that period. This record contains no visitor ID. While Pass is saved, a wfg_analytics=pass cookie, sent only to /link/ addresses, keeps your affiliate link requests from being counted. After expiry your region's default applies again. If browser storage is unavailable, a choice applies only to the current page. Do Not Track or Global Privacy Control keeps Clicky, Google Analytics and Clarity off in every region, even after Need.

Pass stops the site's Clicky, Google Analytics and Clarity calls and removes the experiment assignment and known first-party analytics cookies; if analytics were running, it also reloads the page to unload the trackers. In a cookieless region, Need turns full analytics on from the same page. If storage cannot preserve your decline, a wfg_analytics=denied page-address flag keeps analytics off through that reload; choosing Need again removes it. Requests already sent or in flight cannot be recalled, and this does not delete provider records or cookies on other companies' domains. Earlier views and clicks are never replayed when analytics turn on. Provider opt-outs below remain available. The analytics control preserves saved talent builds, the Classic comparison setting, offer-frequency timestamps and Clicky's owner ignore settings. Hosting requests, fonts, user-initiated videos and off-site links have the separate data paths described below.

Clicky

The site loads Clicky's script for site ID 101511659 from the first-party path introduced September 17, 2026:

<script async data-id="101511659" src="/ec7d027e7a22afc140d.js"></script>

This is Clicky's anti-adblock proxy setup. Two paths on wowforeverguides.com, /ec7d027e7a22afc140d.js and /12ea1074db75be5031f, pass requests through to Clicky's servers. For each tracking request, the site's host forwards the query string, the visitor's IP address, and browser headers such as user agent, language, and referrer to Clicky. Cookies are not forwarded, apart from Clicky's own _cky_ignore and _cky_osa owner cookies when a browser has them. Because the requests go to this site's domain, blockers that filter Clicky's domains do not stop this measurement. A one-line setting before the script turns on Clicky's HTML5 video and audio tracking; the checked pages contain no native video or audio elements.

Pages with YouTube videos show a still image from this site until a reader presses play. Then the functional video player loads from www.youtube-nocookie.com. With full analytics, video-track.js can also load YouTube's IFrame Player API from www.youtube.com to send subsequent plays, pauses and ends to Clicky with the playback position, the video's YouTube address and its title. Playing a video does not turn analytics on.

The consent loader initializes the script at most once per page. The account's Visitor privacy setting is All visitors (dashboard check, October 2, 2026). Clicky's privacy guidance says that setting anonymizes IP addresses, uses no tracking cookies and honors its global opt-out, for every visitor in every region; Clicky still logs the full address of a VPN such as iCloud Private Relay. The site never sets Clicky's visitor_consent option, which would override it, so Need does not. In the cookieless regions the site also sets Clicky's documented cookies_disable option, which Clicky says disables all tracking cookies.

When analytics run and a visitor activates a marked affiliate link, the site's affiliate-tracking.js makes one Clicky custom-action call with a sanitized path such as /affiliate/restedxp/22/sitewide-square/from/news/wow-forever-announced, the generic title Affiliate click, and the documented click type, then declares the repeatable manual goal 8621. This is a Clicky Content Event, not an outbound action or a purchase/conversion event. The action path contains only the registered affiliate, link, placement, and canonical source-page values; it does not contain the destination URL, query string, page text, or a purchase amount. If Clicky's script is blocked or still loading, the site retries for up to 1.5 seconds while analytics stay on, without delaying the link's normal navigation, so a click can be absent from Clicky.

Clicky's privacy policy says its end-user tracking can include the page URL and title, clicked-link URL and title, referrer, user agent, screen resolution, language, mouse-event coordinates, and an anonymized IP address. The same policy describes full IP addresses or tracking cookies where visitor privacy is disabled or certain security conditions apply. This site does not pass names, email addresses, account IDs, or custom data to Clicky in its own HTML or scripts.

Clicky also provides a global opt-out page. Clicky says that setting is browser- and device-specific and requires third-party cookies to be enabled for the opt-out page to work. This site's Analytics settings control does not require that provider page.

Google Analytics

Google Analytics 4 has been used since September 14, 2026, with measurement ID G-73RWMQT25P. Its Google tag (gtag.js) starts with every consent mode type denied. With full analytics, analytics storage is then granted. In the cookieless regions it stays denied, so, in Google's words, the tag will not "read or write first-party analytics cookies" and sends cookieless measurements instead. In both cases advertising storage, advertising user data and personalization remain denied, with Google signals disabled. Enhanced measurement is on, which Google describes as automatically measuring page views, scrolls, outbound clicks, site search, form interactions, video engagement, and file downloads. This site does not pass names, email addresses, account IDs, or custom user data to Google Analytics. Google Ads linking is not configured.

When analytics run, the site's affiliate client also sends one affiliate_click event to GA4 for each primary, keyboard, or middle-button activation of a marked affiliate link. The event fields are the registered affiliate slug, stable link ID, stable placement, the legacy page_path field, the explicit affiliate_source_page field used by the Affiliate clicked page custom dimension, a UTC click timestamp, and a random per-click diagnostic ID. It does not send the RestedXP or Zygor destination URL, its query string, or the link's visible text. The timestamp and diagnostic ID are event values for troubleshooting; they are not registered custom dimensions. If the Google tag is blocked or unavailable, the event is not sent and the site does not delay navigation.

Google's cookie usage page says the tag sets two first-party cookies by default: _ga, used to distinguish users, and _ga_<container-id>, used to persist session state, each with a default expiration of two years. Google notes that browsers can shorten the lifespan of first-party cookies. Google's data safeguarding page says Google Analytics collects first-party cookies, device and browser data, IP address, and on-site activity, and that it does not log or store IP addresses. This is Google's description of its service. The project has not independently verified Google's processing or retention.

Google also provides a Google Analytics opt-out browser add-on that stops Google Analytics measurement on sites the browser visits. This site's Analytics settings control is available without that add-on.

Microsoft Clarity

Microsoft Clarity has been used since September 17, 2026, for project yizaa11y9q. Its script from www.clarity.ms loads only with full analytics, never in the cookieless regions without Need. In the words of Microsoft's disclosure guidance, Clarity captures how visitors use and interact with a website "through behavioral metrics, heatmaps, and session replay." This site uses it to see which parts of its class guides get read and where a page layout gets in the way. The site does not send names, email addresses or account IDs as explicit custom Clarity properties; session replay can capture unmasked page text, including details a reader causes to appear in tool output. It sends exit-offer events with full analytics and, when enabled, the categorical experiment events and tags described above.

The project uses Clarity's Relaxed masking mode, so unmasked page text can appear in recordings. Pages include public guide content and tool results, and the site has no accounts. Clarity's masking documentation says input boxes and drop-down menus stay masked in every mode. The site also masks its forms and talent calculator with data-clarity-mask. That does not mask every output area: Ask can echo the question outside its form, and macro results can repeat supplied code or text. Such unmasked output may reach Clarity when full analytics runs; provider receipt of a particular replay was not verified. Enter no private or sensitive information, and choose Pass to stop this site's analytics. The Talent plugin widget and standalone planner do not load Clarity.

Clarity's cookie list names two first-party cookies: _clck, which keeps the Clarity user ID, and _clsk, which joins page views into one session recording. It also lists third-party Microsoft cookies, including MUID, which Microsoft says identifies unique browsers visiting Microsoft sites and is used "for advertising, site analytics, and other operational purposes." The same page says Clarity does not set cookies when a browser has cookies disabled. Clarity's cookie setting is on for this project, which is Clarity's default.

The site uses Clarity's ConsentV2 API to grant analytics storage and deny advertising storage when it loads. Until then the script stays unloaded; the site does not use Clarity's limited no-consent tracking mode. On Pass both consent values are denied and the page reloads to unload the tracker. Microsoft's FAQ says Clarity keeps recordings for 30 days, except favorited recordings and a random sample, which are kept for up to nine months.

Clarity's terms of use say Microsoft and the site owner are independent controllers of the personal data processed through Clarity. They say Microsoft may use personal data it collects through Clarity for any purpose allowed by the Microsoft Privacy Statement, including improving its products and creating user profiles for purposes that include advertising, and that Microsoft collects or receives personal data through Clarity to provide Microsoft Advertising. The Microsoft Privacy Statement explains how Microsoft collects and uses that data and the choices it offers. You can turn this site's analytics off with Pass in Analytics settings.

Other Network Requests

Until the Discord giveaway closed on October 20, 2026, its card asked this site's /api/giveaway-count function for the entry count once a minute while the card was visible, with no cookies and no request body. That function fetched the count from a separate worker on the site's Cloudflare account and returned only the campaign ID, count and two timestamps. Closing the Discord card stores wfg:discord-community:dismissed in session storage until the tab closes. We have not verified whether Cloudflare logs these requests.

All fonts come from this site's /fonts/ path: Inter, the body font (the official Inter release, under the SIL Open Font License), and the display fonts Accidental Presidency and Expressway. Reading a page sends no request to a font provider. Until October 2, 2026, Inter loaded from Google Fonts (fonts.googleapis.com and fonts.gstatic.com), which received each reader's IP address and browser headers under Google's policies.

The live canonical response checked on September 13 included a Cloudflare Insights beacon from static.cloudflareinsights.com; September 25 checks found it still injected into live HTML, including /privacy. An authenticated dashboard check on October 17 found Web Analytics / Real User Monitoring (RUM) saved for automatic injection with the EU excluded, and recent aggregate data was present. This is the saved hosting configuration, not proof that the beacon runs on every current page. The site's current page security policy blocks that script on pages using the shared shell. The separate talent-preview policy also blocks it, and its Cache-Control: no-transform header prevents automatic injection according to Cloudflare's Web Analytics FAQ.

Where the beacon executes, Cloudflare's collection documentation describes page-load timing and Core Web Vitals used to measure site performance. Its reporting dimensions include country, host/path, referrer, device type, browser and operating system. For a site proxied through Cloudflare, its documented reporting destination is the site's /cdn-cgi/rum endpoint. This describes the provider's beacon behavior, not an observed payload from every current visit.

The site's Need/Pass control manages Clicky, Google Analytics and Clarity, not Cloudflare's saved RUM setting or hosting/security records. The dashboard's recent totals do not establish which visits or pages supplied them, or override the checked browser-script restrictions. Cloudflare's FAQ says Web Analytics data is accessible for the previous six months; that is an access window, not a guarantee that all underlying data, backups or exported copies are erased then. This correction changes no beacon, security policy or provider setting. See Cloudflare's privacy policy for its general disclosures.

Most pages show a RestedXP affiliate image. The RestedXP and Zygor Guides affiliate images are served from this site, so loading one sends no request to RestedXP or Zygor. Every link to RestedXP or Zygor carries this site's affiliate tag. Some go through /link/ addresses on this site, such as /link/restedxp and /link/zygorguides, which redirect to RestedXP's or Zygor's referral address; the rest go straight to a RestedXP or Zygor page with the referral tag (/ref/Decarebia/) in the address. On a few guide pages, the Zygor redirect links send Zygor a campaign label naming the page, such as wfgsitezygorvsrestedxp, read from the address your browser sends with the click. Requests to these /link/ addresses are also counted, as described under Affiliate links on this site. The redirects themselves set no cookie. When a reader arrives through one of these links, RestedXP's and Zygor's sites set their own referral cookies (in a browser check on September 30: affwp_ref, affwp_campaign and a visit ID).

Cloudflare Pages and its edge network serve the site's files and run its server functions, including /mcp and /api/geo. Cloudflare's Pages Functions logging documentation describes a live diagnostic stream that can include request URLs, methods, headers, Cloudflare request metadata, response status, timestamps, exceptions and custom logs. Cloudflare says this stream is not stored and does not persist. The talent plugin's server code does not log request bodies or save builds. Build share links carry the allocation code in the page URL, so opening one sends that code to Cloudflare.

That live-stream limit does not mean Cloudflare stores no request records. The authenticated October 17 dashboard audit found HTTP request records with IP addresses and paths accessible through Security Analytics (httpRequestsAdaptive), on this site's Free plan. Cloudflare's dataset limits explicitly list 31 days of historical retention for this dataset on Free, with a separate 30-day maximum query window. This does not establish when every other Cloudflare record, backup or exported copy is deleted.

The same audit found no account Logpush jobs or OpenTelemetry (OTel) destinations. Manual JSON/CSV export controls were available, but no export was made during the audit; this does not establish whether earlier exports exist or how long they are kept. No per-record deletion control was exposed in the checked interface. These observations do not establish that every export mechanism is disabled or that all Cloudflare copies can be individually deleted. Other record and copy retention/deletion limits remain unverified under Cloudflare's privacy policy.

Affiliate Links on This Site

Each GET request to a /link/<name> address on this site, such as /link/restedxp/, records a Cloudflare D1 row with:

• the UTC time
• the link name and its guide, RestedXP or Zygor
• the site page you came from, if published
• the campaign label sent to RestedXP or Zygor
• an estimated traffic class

The page comes from the address your browser sends with the click; any other page is stored as unknown. The row stores no IP address, user agent, full referrer, query string, cookie or visitor ID, and no request is linked to another.

Nothing is recorded for HEAD requests, unknown link names or other methods. Nothing is recorded when your browser sends Do Not Track, Global Privacy Control or the Pass cookie. A saved Pass sets that first-party wfg_analytics=pass cookie, which only /link/ addresses receive. It holds no visitor ID and lasts as long as the Pass choice.

The request's headers and address sort it into likely browsers, unknown, bots, prefetches, tests, the team's own browsers and preview copies of the site. These classes are only estimates. Counts measure link requests, not unique people or sales. The redirect works the same if logging fails. Records older than 365 days are excluded from counts. Recording a new request deletes expired rows in batches of up to 500, so a backlog or inactive period can leave older records stored longer.

Off-Site Affiliate Links

Links under /link/offsite/ record a Cloudflare D1 row ID, UTC time, article, platform, which guide the link points to, and traffic class. Headers classify requests as browser candidates, bots, prefetches, tests, or unknown; this is only an estimate. The table stores no IP addresses, raw headers, referrers, or cookies. HEAD requests are not recorded.

Counts measure link requests, not unique people, readership, or sales. Redirects set no cookies and work if logging fails. Records have no automatic expiry and are separate from GA4 and Clicky. Zygor receives an article campaign label for its own affiliate reporting.

Social and Video Affiliate Links

Links posted on YouTube and other social platforms use one address per platform and guide, such as /yt/restedxp/. Older YouTube descriptions use /link/<platform>/<code>/<partner>/, such as /link/yt/channel/restedxp/, which still works. Each GET request on this site's own address records a D1 row with the UTC time, platform, the video code if the older link has one, whether that code is registered, which guide the link points to, and the same estimated traffic class. The table stores no IP addresses, raw headers, referrers, or cookies, and HEAD requests are not recorded.

A video code says where the link was posted, not that the visitor watched that video. RestedXP and Zygor receive a campaign label for the platform, such as wfgyt for YouTube, for their own affiliate reporting. The redirects set no cookies and work if logging fails.

Links to Other Sites

Articles link to sources, chosen as the editorial policy describes, and other sites, including Blizzard and Battle.net, X, Reddit, YouTube, Wowhead, and other publishers. Following a link takes you to that provider. Their own privacy notices, cookies, accounts, and terms apply there; the site usage terms cover this site's own conditions. The site does not embed a form or social widget from those services in the checked HTML and does not control what an external page does after navigation.

Retention and Privacy Requests

Off-site and social link records in D1 have no automatic expiry or scheduled purge. On-site affiliate request rows older than 365 days are excluded from counts and deleted in batches of up to 500 on subsequent recorded requests.

Ask, name, macro and addon requests use D1 rate-limit counters keyed by hashes derived from the requesting IP address and date. Rate-limit rows have expiry timestamps no more than two days after creation; those timestamps do not themselves delete rows. The shared cleanup deletes expired counters and cache rows older than 30 days, removes answer text and chart titles from Ask logs after 30 days, and deletes Ask question logs after 90 days. It runs on a random 5% of completed uncached, nondegraded Ask requests. Name and macro requests do not run it. Inactive periods or failures can leave expired rows stored longer. Addon project/cache cleanup and its separate Delete control are described above. Clearing browser data removes local copies and keys, not server records or copies held by recipients.

The site has no game-account database. Talent plugin tool calls do not write to the site's separate D1 databases; the Ask, macro, addon and link records described above have their own retention. TJ personally handles privacy requests received at the plugin contact. Messages are kept in Gmail and deleted manually, with no fixed deletion schedule; they can remain until TJ chooses to delete them. Cloudflare says the Pages Functions live diagnostic stream does not persist. The Security Analytics historical-retention limit and Web Analytics access window described above apply to those datasets only. Retention and deletion of other Cloudflare records, backups and earlier/manual exports remain unverified; neither reporting window guarantees erasure of every copy.

A provider's rights tools, such as Clicky's opt-out page, Google's opt-out add-on, or the choices in Microsoft's privacy statement, cover only that provider's data. The plugin email contact below covers Talent plugin inquiries only; other site privacy-request processes remain unestablished.

Talent Plugin Email Contact

For support or a privacy question or request about Classic MMO Talent Calculator (formerly the WoW Forever Guides Talents plugin), email [email protected]. Describe the issue or data path and approximate date or time concerned. Do not send passwords, access tokens, private chat transcripts or payment information.

WoW Forever Guides receives your sender address, message content, mail metadata and any attachments you send, to handle the inquiry. Google's Gmail service also receives and processes them, including sender and recipient addresses, timestamps and routing information, under its own policies. Email is separate from widget memory and may include builds you choose to send. Google's privacy policy describes its service's data handling. TJ personally handles privacy requests received at this address. He deletes messages manually, with no fixed deletion schedule, so a message can remain until he chooses to delete it. Gmail Help says deleting a message moves it to Trash, where it remains for up to 30 days unless permanently deleted sooner. Removing it from the mailbox does not guarantee immediate removal of every provider copy: Google's retention documentation describes separate deletion processes, backups and longer retention for some purposes. These are provider limits, not a shorter retention promise by this site.

Use this address to request access, correction or deletion of information you emailed about the plugin. Requests involving hosting records require a check of the relevant service's records and controls. Your chat host may keep tool inputs and results, and any build sent with Use build in chat, with the conversation; use its controls for that data. This contact does not promise a response, a response time or any particular outcome, including deletion. Google and other providers may keep their own records under their policies.

Children

The checked site has no age gate and does not ask for a person's age. The project has not adopted or verified a separate age policy, so this observation should not be read as an age-based promise.

Changes to This Notice

October 20, 2026: Recorded that the Discord giveaway card stopped requesting its entry count when the giveaway closed on October 20, and described the request in plain terms. No collection or configuration changed.

October 17, 2026 hosting follow-up: Added authenticated observations of IP/path request records, the Free-plan Security Analytics dataset, saved RUM automatic injection excluding the EU and recent aggregates, and account export/deletion controls. Matched the exact dataset to Cloudflare's documented 31-day historical-retention limit and distinguished Web Analytics' six-month access window from deletion. Identified TJ as the privacy-request handler and disclosed manual mailbox deletion without a fixed schedule, separately from Gmail Trash and provider backups. No collection or configuration changed.

October 17, 2026: Renamed the Talent plugin to Classic MMO Talent Calculator, stated its independent fan status and beta compatibility, listed each tool's inputs and outputs, and clarified memory, clipboard, chat, external-link and separate site-service data paths. Also corrected Ask/Names/Macro retention and analytics claims, addon storage/deletion and configured Turnstile handling, possible Clarity capture of unmasked output, and affiliate cleanup limits. Rechecked Cloudflare's Pages live-stream documentation. The hosting follow-up above adds newly available provider evidence and the owner's existing manual mailbox-deletion practice.

October 11, 2026: Disclosed anonymous counts of /link/ affiliate link requests on this site, their 365-day deletion, and the wfg_analytics=pass cookie that keeps a Pass reader's requests out.

October 3, 2026: Replaced the popup holdout with two popup designs under a new experiment ID, keeping the same October 31 end and historical records separate.

October 3, 2026: Expanded the RestedXP exit offer to normal public pages, added session storage for its frequency cap, and disclosed the 28-day popup holdout and its existing-provider measurement.

October 2, 2026: Added the disclosure for the disabled class-guide button experiment, the footer Analytics settings with 180-day choice storage, cookieless measurement in the regions above, the exclusion of automated and team traffic, and Clicky's checked visitor-privacy setting.

When the site adds a form, account, advertising, additional analytics, embedded service, or another data path, this notice is updated before that feature goes live. The checked date moves with it.