GabbaCraft · GabbaBank · GabbaGuild Companion
Privacy policy
Updated: 18 October 2026
Contact and quick links
Nils Keller · Gabbajoe · mail@nilskeller.de
Controller and scope
Nils Keller (Gabbajoe) operates GabbaCraft, GabbaBank and the associated Discord integration. This policy also covers GabbaGuild Companion, the GabbaGuildCraft addon and the restricted GabbaZanza section. Contact for privacy questions and deletion requests: mail@nilskeller.de.
The information below describes how these services work and store data. Discord, GitHub, CurseForge, Wowhead and Raid-Helper also provide their own privacy notices for their respective services.
Discord sign-in and permissions
When you sign in, we receive your Discord ID, display name and information about your membership, server nickname and roles in the designated guild server. We use this to associate your recipe pages and requests with you and check access. Sign-in uses Discord’s identify and guilds.members.read permissions. These permissions do not request your Discord email address or password.
Discord access and refresh tokens are stored on the server for sign-in and role checks. The Companion app receives its own device credential. We store its owner ID, display name, authorized sections, creation and expiry times and technical verification values. A SHA-256 hash of the IP address is stored to limit pairing attempts; this is not a claim of complete anonymity.
Device authorization lasts 30 days. You can revoke it under My connected devices. You can also remove the application under Authorized Apps in Discord. Signing out or revoking access does not automatically delete previously published recipe pages or bank requests.
Recipes and crafter pages
When you upload an export, we store the character and realm, profession, recipes, materials, item and recipe IDs, available effects and level information, update time and your Discord ID as the owner reference. Recipe pages can be viewed publicly and shared. Only upload data that you want to publish and are authorized to provide.
Uploading the same character and profession again updates the existing page. You can delete your own pages under My workshop on the website. Uploading through the Companion app transfers the selected recipe export, not the entire SavedVariables file. With a manual file upload, the selected file reaches the server for processing.
Guild bank and requests
Bank uploads contain the guild, realm, bank characters, saved bag, bank and mail inventory, item variants, quantities, gold amounts and timestamps. The server history also records the acting user’s Discord ID and the outcome of up to the last 100 inventory or archive actions. Bank data is visible according to assigned access permissions.
Bank requests store your Discord ID and name, recipient character, requested item and quantity, purpose, processing status, timestamps and, where applicable, the assigned banker and generated GBank code. Request contents are sent to the guild’s designated Discord channel and updated there when the status changes. Anyone with access to that channel can read this information. Do not put confidential information in the purpose field.
Bankers can process the requests authorized for their role. Other users see their own requests on the website. The visibility of the Discord message is governed separately by channel permissions.
For service operation, the operator receives a daily Discord status report plus incident and recovery notices. These messages contain aggregate upload, synchronization and request counts and fixed error categories, not export contents, credentials or request purposes. Additional operational counters and delivery records are kept on the server for up to 14 days and cleaned up on the next run. Sent Discord direct messages remain in Discord until deleted.
Restricted raid supply planning
GabbaZanza reads sign-ups for a configured Raid-Helper event and matches Discord IDs, display names, sign-up status and roles against relevant bank inventory and requests. This produces stored supply reports. Access is restricted to explicitly authorized accounts. This feature does not send Discord direct messages.
Addon and Companion on your device
The addon writes settings and exports to the SavedVariables of your WoW installation. It does not publish that data to the internet itself. The Companion app reads selected export files, remembers paths and preferences and stores a local catalogue of item names and icons. If enabled, automatic bank upload can transfer newly saved bank data while the app is running and connected.
The device credential is encrypted locally using the operating system’s protected storage where suitable storage is available. Otherwise it is retained only until the app quits. This does not mean that all exports or other local settings are encrypted.
The app checks our website for Companion updates at startup and every six hours. Item IDs are sent to our server to resolve missing names and icons. Addon update checks and downloads that you start contact GitHub. The respective services receive connection information required for delivery, such as your IP address. App updates and addon installations start only after your click.
Uninstalling the app does not necessarily remove its user-data folder, WoW exports or addon backups. You can delete those files on your device yourself. A server-side deletion request does not remove copies on your computer.
Cookies, connection data and external content
The website uses a session cookie (gabbacraft_session) for sign-in and form protection. Your selected language is stored in the gabbacraft_lang cookie for up to one year. The browser session and server-side session storage are separate; expired server sessions are removed through PHP session cleanup. This application has no built-in advertising trackers or usage analytics.
Website requests produce technical connection and log data, including the IP address, time, requested path, response status and browser information. This supports delivery, troubleshooting and protection against abuse. The inspected server configuration rotates domain logs daily and keeps seven rotations; general Apache logs keep 14. Empty logs may not rotate, so this is not a guarantee of deletion after exactly seven or 14 calendar days.
Item icons on relevant pages and in the Companion app load directly from wow.zamimg.com, which establishes a connection to that provider. Links to Wowhead, Discord, GitHub or CurseForge open their respective services. Using CurseForge is subject to its own data processing; the Companion app is not required for that installation alternative.
Purposes, legal bases and recipients
We use the information to provide the guild features you request, associate content with your account and process requests (Article 6(1)(b) GDPR, where necessary for the agreed use). Role checks, abuse prevention, technical logs and troubleshooting serve the legitimate interest in a secure and functioning guild service (Article 6(1)(f) GDPR). Where processing requires separate consent, that consent is its basis; Discord device approval is not blanket consent to arbitrary data processing.
Depending on the feature, recipients include the operator and necessary technical service providers, visitors to public recipe pages, authorized guild members or bankers, and Discord for sign-in, role checks and bank requests you initiate. Your data is not sold.
External services may process data outside the European Economic Area. Their linked privacy notices describe their controllers, processing locations and any applicable transfer safeguards.
Storage and deletion
Recipe pages remain stored until deleted or updated. Device access expires after 30 days; expired records are cleaned up on the next access to device storage. Unfinished pairing requests expire after ten minutes. Revoking a device removes its record from active device storage.
Bank inventory, archived bank characters, requests and raid reports currently have no shared automatic time-based deletion period. Technically, they remain stored until overwritten or removed by the operator; archiving is not deletion. The need for retention depends on ongoing guild administration, processing or resolving requests and any applicable legal obligations. The operator must handle personal data that is no longer needed and valid deletion requests.
Backups may contain older data. There is currently no uniform automatic deletion period configured for existing backups. A deletion request may therefore also need to cover backups and Discord messages published by the application. We cannot remove copies that other people have already downloaded to their own devices.
Your rights and contact
Subject to the applicable legal conditions, you can request access, rectification, erasure, restriction of processing and data portability. You can object to processing based on legitimate interests on grounds relating to your particular situation. You may withdraw consent with effect for the future. You can also complain to a competent data protection supervisory authority.
Contact mail@nilskeller.de and, where possible, identify your Discord ID or the affected recipe page. Do not send passwords or access tokens. We may need to verify your authority appropriately to avoid disclosing or deleting someone else’s data. The self-service options described above are also available for your own recipe pages and device authorizations.
Protected features or uploads cannot be provided without the account and export data they require. Role checks automatically determine feature access; they do not assess creditworthiness or other personal characteristics.
Guild roster and character links
Gabbajoe and Prügelpriester can import a filtered Guild Roster Manager export. Stored fields include character name, realm, WoW GUID, class, level, rank, main-character hint, membership and death status, and import time. The Companion app removes notes and chat logs before uploading.
Signed-in guild members can request links to active characters. The two managers approve or decline these requests. We store the Discord ID, display name, decision and timestamp. Confirmed characters can be selected for a raid; this does not change a Raid-Helper signup.
Deceased, former and subsequently missing characters remain stored for traceability. Missing characters are not automatically treated as kicked. You can remove your own links; contact mail@nilskeller.de to delete roster and request history.
Discord slash commands read existing raid, bank, recipe or personal character data. Replies are visible only to the requesting user. Bank data remains role-restricted and Zanza is limited to the two managers.