Overview
duners.win is a hobby fan project operated by a small team. We aim to collect only what we need to run the Site.
You do not need an account to use our tools. Tracker progress, hunt lists, and similar data stay in your browser unless you choose to sign in and turn on optional server sync.
We do not sell your personal information.
What stays on your device by default
Unless you enable optional server sync (see below), the following stay locally in your browser (for example, via local storage):
- schematic tracker progress (unlocks, permit counts, and related state);
- hunt list and hunt navigation state;
- characters and the active character selection;
- build editor drafts stored in the build create flow;
- cookie consent and similar site preferences.
This local data is not transmitted to us by default. You can clear it through your browser settings or, when signed in, through Clear stored data on your account page (which also clears your server backup if sync was enabled).
Optional accounts and sign-in
When public sign-in is enabled, you may create a free optional account by signing in with a supported provider (currently Google). You may also use the Site without signing in.
If you sign in, we store account information needed to operate authentication, including:
- a unique user identifier;
- your display name and email address as provided by the sign-in provider;
- whether your email is verified;
- profile image URL (if provided by the provider);
- account role (for example, standard user or admin, where applicable);
- account status fields used for moderation (for example, ban state), if applicable;
- account creation and update timestamps.
Sign-in is handled through Better Auth and provider OAuth flows. We do not ask you to create a separate password on duners.win for Google sign-in.
When you use Google sign-in, Google processes your authentication according to Google's Privacy Policy. We receive only the profile information Google shares with us for sign-in (such as name, email, and avatar).
If donations are in use on your account, we also store:
- the donation tier matched to your account, and its tier number;
- whether you have a verified donation (the Supporter flag);
- the lifetime support total reported for you, in cents, and when that total last increased;
- records of increases in that lifetime total (the increase, the new total, and the time).
Patreon
Donations, when enabled, are processed by Patreon. We do not receive your payment card number or Patreon password.
If you connect Patreon to your account, Patreon shares membership information with us so we can match a pledge. We store:
- your Patreon user id;
- OAuth tokens Patreon issues for that link (access token, refresh token, and related expiry and scope fields);
- the tiers Patreon says you are entitled to, which we turn into the donation tier on your account;
- the lifetime support amount Patreon reports, when that field is present.
Disconnecting Patreon removes the link we use to refresh membership. It does not by itself erase the stored lifetime total, Supporter flag, or past donation-increase records. Those stay on the account until you delete the account, subject to the retention notes below.
Patreon processes its own account, pledge, and payment data under Patreon's privacy policy.
Public profiles and donor boards
Signing in creates a profile row for your account. You choose whether it is public.
A profile can include a handle, display name, a setting for whether your full name is shown, a picture, a bio, picture frame, header style, and links (for example Steam, and, when a tier allows them, YouTube, Twitch, Kick, or other links you add).
If you publish the profile, that content is visible to other visitors and may appear in search. Donor boards on the donate page may publicly show a donor's display name, picture, and rank. Do not publish a profile, or connect Patreon, if you do not want that.
Comments, reports, and review
If you post a comment, we store the comment, the page it belongs to, your account id, the time, and the IP address of the request. We may also keep the text as submitted, including before any censoring, so a review can read what was written.
Readers can report comments and profiles. We store those reports and may hide the content while it is reviewed.
We may send display names, handles, bios, comments, and similar text you submit to an automated review (currently a model provider we configure) and to site staff, to apply our Community Guidelines. That review can approve, reject, hide, or restore the text. Do not put secrets or information you do not want reviewed into those fields.
Optional server sync
If you are signed in, you may optionally enable server sync on your account page. Server sync is off by default.
When enabled, we store a backup copy of selected tool data on our servers, linked to your account, including:
- character names and settings;
- per-character schematic tracker progress;
- per-character hunt list and hunt navigation state;
- account-wide build editor library drafts.
This backup is provided as a convenience only. See our Disclaimer and Terms of Use. We do not guarantee that synced data will be preserved, complete, or recoverable.
You can turn server sync off, clear stored data from your account, or delete your account (see Your choices).
Authentication cookies and sessions
When you sign in, we use session cookies (or equivalent browser storage mechanisms) so you can stay logged in. Session records may include technical metadata such as IP address, user agent, and session expiry time.
These are necessary to provide account features you request. They are not used for advertising.
What we host on our servers (non-account)
We operate a reference item database (schematic names, metadata, icons, recipes, and similar game reference content) that is served to all visitors. That reference data is not linked to your identity.
Shared builds you open or import on the Site are described in Shared builds below.
If you contact us by email, we receive the information you choose to send (your email address, message content, and any attachments).
Shared builds
If you create, share, open, or import a character build (for example through a view link with a ?b= parameter, a pasted import code, or a related share flow), the build data encoded in that link or code may be sent to and processed by our servers so we can render the preview and operate the feature.
Depending on how the feature is used, we may:
- store or cache share payloads to operate the build viewer and improve reliability;
- log technical data about requests (such as IP address, timestamp, and URL), consistent with our hosting logs;
- make shared builds publicly viewable on the Site and allow search engines or other visitors to discover them if the link is shared or indexed.
Shared build data may include a build name, author label, tags, skills, equipment selections, and timestamps you or the original creator included in the payload. It is not tied to a user account by default, but it may still identify you if you choose a recognizable author name or build title.
If you do not want a build to be processed or potentially made public, do not share its link or import code, and do not open shared links on the Site.
Security and audit logs
We may keep limited audit log records for security and abuse prevention (for example, when an account is deleted or a user clears stored server data). These logs may include your user identifier, name, email, IP address, user agent, event type, and a short description of the action.
We retain audit logs only as long as reasonably necessary for security, troubleshooting, and legal compliance.
Server and hosting logs
Our hosting provider may process standard technical logs such as IP address, browser type, request time, URLs visited, and error reports. That processing is governed by the host's policies.
We do not intentionally use those logs to identify individual players beyond what is necessary to operate and secure the Site.
Cookies and local storage
In addition to tracker and tool data in local storage, the Site may store:
- your cookie consent choice;
- authentication session data when you are signed in;
- other preferences needed for features you use.
Google Analytics cookies are described below and require consent before use.
Analytics
Page visits
We count page visits ourselves to understand which pages are used. This is first-party and anonymous:
- it sets no cookies and stores nothing in your browser;
- your IP address is not stored, and neither is the code derived from it beyond the hour it is used: to avoid counting the same visit twice, we turn the address into a temporary code that changes every hour, use it to ignore repeat visits to the same page within that hour, and delete it when the hour ends;
- only a per-route total is kept, and nothing links a visit to a person.
We keep this in aggregate to improve the Site. We do not use it for advertising or to sell your data.
Google Analytics 4
We use Google Analytics 4 on the public Site to understand how pages are used (for example, which tools are visited and how visitors move between pages). Google may set cookies or use similar technologies and process information such as pages viewed, approximate location, browser type, device type, and referral source.
We ask for your consent before enabling Google Analytics cookies. Your choice is stored locally in your browser and can be changed anytime via Cookie settings in the site footer.
We use this data in aggregate to improve the Site. We do not use Google Analytics for advertising or to sell your data.
Google's processing is described in Google's Privacy Policy. You can opt out of Google Analytics in your browser (for example, with a blocker extension or Google's opt-out add-on).
Third-party links and services
The Site may link to third-party websites (including sign-in providers and Patreon). We are not responsible for their privacy practices. Your use of Google sign-in is also subject to Google's terms and policies. A Patreon pledge is also subject to Patreon's terms and policies.
Children's privacy
The Site is not directed at children under 13, and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will take reasonable steps to delete it.
Your choices
- Local tool data: controlled via your browser; clear site data to remove it.
- Server sync: optional; enable or disable on your account page when signed in.
- Clear stored data: when signed in, use Clear stored data on your account to wipe your server backup (and optionally local browser data, depending on the options shown).
- Delete account: when signed in, you may delete your account from your account page. This removes your account and associated server-stored data (including sync backups, your profile, donation records tied to the account, and comments), subject to the retention notes below.
- Patreon: you can disconnect Patreon from your account. Billing and pledges are managed on Patreon, not on duners.win.
- Analytics: accept or reject Google Analytics cookies via the site banner; change your choice later with Cookie settings in the footer, or use browser privacy settings, a blocker extension, or Google's opt-out tools. Page visits are counted without cookies and without a stored identifier, so there is no per-visitor setting for them.
- Email: you may stop contacting us at any time.
We do not currently offer a separate automated data-export download. If you need a copy of synced data, enable sync before deletion or keep local backups in your browser.
Data retention
- Contact emails: kept only as long as needed to respond and maintain a reasonable record of support requests, unless law requires longer retention.
- Account, profile, donation, and sync data: kept while your account exists. Donation totals and the Supporter flag can remain after you disconnect Patreon. When you delete your account, we delete the associated account, profile, donation, comment, and cloud backup records from our application database, subject to normal backup and log retention by our host.
- Review copies: text sent for automated or staff review is kept with the content it belongs to, and in moderation logs, only as long as reasonably needed to operate review and handle abuse.
- Sessions: expire according to session settings and are removed when you sign out or delete your account.
- Audit logs: retained for a limited period for security and compliance, then deleted or aggregated where practicable.
- Page visits: the per-hour deduplication code is deleted within the hour it is used; only the anonymous per-route total it feeds is kept.
- Shared builds: may persist after you stop using the Site unless we remove them.
Because this is a hobby project, we do not guarantee immediate or complete erasure from all backups, caches, or logs maintained by infrastructure providers.
International visitors
The Site is operated from our hosting environment. If you access the Site from outside that region, your information may be processed where our servers and providers operate. By using account features, you understand that your data may be transferred and processed in those locations.
Where applicable law grants you rights (such as access, correction, or deletion), contact us via the Contact page. We will respond reasonably, consistent with the size and nature of this project.
Changes
We may update this Privacy Policy. Material changes will be reflected on this page. Continued use of the Site after changes are posted constitutes acceptance of the updated policy for new processing, to the extent permitted by law.
Contact
Privacy questions: Contact page.