Privacy notice

When you upload a combat log, Pizza Logs processes:

• The file's base filename, byte size and SHA-256 hash.
• The required uploader character name, optional guild label, and selected realm, host and expansion values.
• In-game character and pet names, timestamps, combat events, raid composition, encounters and derived performance statistics.

Pizza Logs also stores public PizzaWarriors roster information and cached Warmane character equipment and profile data. It does not intentionally request or store visitors' Battle.net/Warmane passwords, email addresses, payment information or real-world identity documents.

Private administration stores the designated administrator's email and name, a password hash, encrypted authenticator and recovery-code material, and session records that can include IP address and user agent. Short-lived authentication challenges, rate-limit records and keyed code-reuse fingerprints support sign-in security. Plaintext login passwords are not stored. No email is sent and no external authentication provider receives these credentials.

Data is used to detect duplicate uploads, parse and display raid reports, calculate records and weekly summaries, provide player and gear views, and operate or troubleshoot the service.

Raw upload bytes are written temporarily by the parser during processing, then removed after completion or cleanup. The database keeps the parsed report and upload metadata; it does not keep a downloadable copy of the raw combat log.

Each upload requires acknowledgement of the current upload rules and public visibility notice. The server checks the submitted policy version before processing. This is a request-level acknowledgement, not a verified identity or a separately retained consent record. Upload admission counters are held in process memory; this upload throttle does not store IP addresses or add tracking cookies. Original upload filenames remain in administrator metadata and are omitted from public encounter APIs.

Raid reports, in-game character names, roster data, gear snapshots and performance statistics are public. Do not upload a log if those game identifiers should not appear publicly. Admin diagnostics and maintenance controls are not public. Read the upload rules before sharing a log.

• Railway hosts the application, parser and production infrastructure and may process ordinary request logs such as IP address and user agent. PostgreSQL stores application data within the deployed environment.
• Pizza Logs servers query Warmane for public roster, character, model and gear information. Your browser also requests game icons directly from cdn.warmane.com and, for some item icons, wow.zamimg.com.
• When a 3D character model is displayed, its browser viewer loads jQuery from Google's ajax.googleapis.com and rendering scripts, models and textures from cdn.warmane.com. These are direct browser requests, separate from the server-side Armory queries.
• Direct browser requests disclose ordinary connection information, including your IP address and browser request headers, to the provider receiving them. Those providers control their own handling and retention. Pizza Logs does not send raw combat logs or administrator credentials to these image or model providers.
• GitHub hosts the source repository, issues, pull requests and private security reports. Following a GitHub link takes you to that service.

The site's interface fonts are served by Pizza Logs. Pizza Logs does not sell personal information and does not include a third-party advertising or behavioral analytics SDK.

Ordinary public report browsing does not require an application account cookie. Admin sign-in uses essential session and temporary challenge cookies with HttpOnly and SameSite=Strict; public HTTPS cookies are always Secure. Full admin sessions expire after eight hours and sign-out revokes the stored session.

Pizza Logs does not store behavioral analytics identifiers in browser storage. Third-party browser requests are described above.

Parsed reports and cached game data remain until a maintainer deletes them; there is currently no automatic public-report expiration period. Temporary or incomplete parser uploads are cleaned after processing or abandonment. Hosting-provider logs and backups follow the provider's operational retention.

The private administrator identity and credentials remain until replaced or removed through operator maintenance. Session expiration ends authorization but does not promise immediate physical deletion of every expired database row. Expired challenge and code-reuse records, and rate-limit records older than 24 hours, are removed opportunistically during authentication requests. Password changes, session revocation and operator recovery invalidate the relevant current authentication records. Backups can retain older records until those backups expire. Operator restore procedures require renewed admin enrollment before restored administration is exposed.

To request removal of a report or raise a privacy concern, contact Neil privately through a GitHub security advisory and identify the report URL and relevant in-game name. A request may require enough information to distinguish the report from unrelated guild data. Keep private raw logs and credentials out of public issues.

Material changes to data collection, public visibility or retention will be reflected on this page and in the project changelog. See also the terms of use.