Tabard Privacy Policy

Effective November 13, 2026

This policy explains what Tabard collects, why, how long it keeps it, and how to delete it. Tabard only collects what it needs to link Discord members to their World of Warcraft characters. It does not sell data or use it for advertising.

What we collect from Discord

• Your Discord user ID, and the IDs of the servers, channels and roles the bot is set up to use.
• Settings that server admins choose with /setup (connected WoW guilds, channels, roles, timezone and options).
• Your choices in the bot: your main character on each server, your group role (Tank, Healer or DPS), and your event signups, including the character and spec you signed up with, whether you play melee or ranged, and whether you are on a raid's bench.
• Event attendance: when an event starts, who signed up is recorded as present or absent, and whether you had signed up to attend. Officers can correct it, and a member who signed up and was marked absent shows up in the officers' no-show list.
• Saved raids: officers can save an event's title, description, size and channel as a template. These hold no personal data.
• When you open Tabard's signup screen inside Discord (the Sign up button on an event post), Discord tells Tabard who you are: your user ID, username and display name. It's only used to show and change your own signup. The login for that screen lasts up to 12 hours and isn't stored by us at all: it's a signed key that only that screen keeps. Class and spec icons on that screen are loaded by Discord straight from Discord's image servers.
• Characters you type in yourself with /link or "Ask an officer", and whether an officer approved them. If an officer marks you as not in the guild, we remember that so you keep the guest role until you become a member.

Tabard does not read or store your messages. It uses Discord's Server Members access only to give roles, set nicknames to your main character's name, and welcome new members.

If a server has a Tabard commands channel, Tabard is told when a message is posted there. It only checks who posted it (and their roles), never what it says, and deletes it unless it's from Tabard or from a role the server allows to type there. Nothing about the message is stored.

What we collect from Battle.net (only if you verify)

When you press Verify with Battle.net, you log in on Blizzard's own website. Tabard never sees your password. With your permission (the "wow.profile" scope), Blizzard gives Tabard a list of your World of Warcraft characters for the game versions the server uses, and your Battle.net account ID.

• We keep only the characters that are in a WoW guild connected to that Discord server: each one's name, realm, game version and region. Other characters on your account are not stored.
• We keep a one-way, salted hash of your Battle.net account ID. It cannot be turned back into your account ID. It is only used to stop one Battle.net account from verifying more than one Discord account.
• We do not store your BattleTag, email address, password, or any Battle.net login token. The login token is used once to read your character list and then thrown away.
• Login links expire after 30 minutes and can be used once.
• If your Battle.net account is already linked to another Discord account (for example one you deleted or can't use anymore), logging in with Battle.net proves it's yours. If that Discord account was deleted, the link moves to your new account automatically. Otherwise you're offered a one-time button, valid for 15 minutes, to move it. The old account loses its Battle.net characters, and the server's officers are told it moved.

Characters you verify with Battle.net are recognized on every Discord server that uses Tabard, so you do not have to verify again for each one.

The website dashboard (only if you log in)

Officers can log in to the dashboard on Tabard's website with Discord. Discord tells us your Discord ID, your name and which servers you're in. We use that only to show you the servers where Tabard is installed and you're an officer.

• We keep a login session for up to 4 hours: your Discord ID and name, and the IDs of the servers you were in that also use the bot. It's deleted when you log out, when it expires, or when you use /forgetme.
• The session is a cookie that only keeps you logged in. It isn't used for tracking or advertising. We don't keep your Discord login token: it's used once when you log in, then thrown away.
• The dashboard shows a server's officers the same things they can already see in Discord: the guild roster, who has linked a character, upcoming events, signups and attendance.
• Server icons on the dashboard are loaded by your browser straight from Discord's image servers, like they are in the Discord app.
• People with the Manage Server permission can change the server's settings on the dashboard. When they do, the bot posts what changed and their Discord name in the server's officer channel.

Feedback and bug reports

If you send feedback with /feedback, your Discord name and ID, the server you sent it from, your message and any screenshots are delivered to our team's private Discord channel so we can help. The website doesn't keep a copy. Screenshots can show anything on your screen, so leave out personal details you don't want to share. Ask us if you'd like a report deleted.

Our support server

If you join the Tabard support Discord server, Tabard checks whether you own a Discord server that uses Tabard (Discord tells every bot who owns each server it is in). If you do, you get the Guild Owner role there, and Beta Tester if your server is in the beta. We keep a list of the user IDs Tabard gave these roles to, so it can take them back if you stop owning a server that uses Tabard or leave the support server.

Beta requests

If you ask to join the beta on our website, we keep what you enter (server ID, guild name, game version, region, your Discord username and any notes) so the team can review it. It's deleted as soon as the request is approved or declined, or after 90 days.

Guild rosters

For each WoW guild a server connects, Tabard downloads the guild roster from Blizzard's public API: character names, realms, levels, classes and guild ranks. Officers can also upload a roster from the Tabard Sync in-game addon, which adds rank names, days since last online, and public notes. Officer notes are never collected.

Tabard keeps which raid bosses each guild has killed on each difficulty (from the guild news Blizzard publishes), so the raid progress news only posts what's new. When a server turns on raid progress, Tabard also reads some guild members' public raid boss kills from Blizzard's character profiles, once per raid, to count kills from before it was watching. On Retail, if a server turns on the Mythic+ news, Tabard reads guild members' public Mythic+ rating and best timed keys, and keeps each member's latest rating and best key for the season.

If a server turns on the weekly inactivity report, Tabard reads when each guild character last logged in from Blizzard's public character profile (about once a day per character) and keeps that time. An addon upload's "days since last online" is kept the same way. When officers send inactivity reminders, Tabard keeps who got one on that server and when, so nobody gets more than one a month.

How we use it

• to post guild news in channels a server chooses, such as new members, level milestones, promotions, boss kills, raid progress, Mythic+ milestones and achievements. These posts name the character and, if it's linked, the member's Discord account (without pinging them);
• to fill in your spec and item level when you sign up for an event, read from Blizzard's public character profile and kept with your signup (the spec is shown on the signup; item level only on posts shown as text);
• to give you the right roles and nickname in servers that use the bot;
• to show your characters to members of that server (for example with /whois and on event signups);
• to show a character card with /whois: the character's picture, level, race, class, spec, guild, item level, achievement points, last time online, equipped gear, raid progress and, on Retail, Mythic+ rating. It is read from Blizzard's public character profile when someone asks, kept in memory for up to 10 minutes so repeated looks don't ask Blizzard again, and never saved in the database. Anyone in the server can look up a linked member, or a character on the guild roster;
• to show a server's officers who in their guild has not joined the Discord yet, and who hasn't been in game for a while;
• to send a guild member one friendly direct message when that server's officers press "Remind them by DM" on the inactivity report (at most once a month per server). It names the server, the guild and the character;
• to send event reminders to people who signed up, and to ping them when an officer moves the event to a new time or cancels it from the event screen;
• to draw each event's signup post as a picture (who signed up, with which character, class and spec), which Discord stores like any image posted in the channel.

Who can see it

Members of a Discord server can see the characters linked to other members of that server, as well as event signups there. That server's officers can also see its guild roster. We do not sell or share data with anyone else, except with the services that run the bot:

• Discord, which delivers the bot's messages and roles;
• Blizzard Entertainment, whose APIs provide the game data;
• our hosting provider (Scaleway), which stores the database and server logs;
• our backup storage provider (Cloudflare), which stores encrypted copies of the database. It cannot read them: the key stays with us.

How long we keep it

• Guild rosters are refreshed from Blizzard about every hour. Characters that leave a guild are removed at the next refresh, along with their saved Mythic+ rating and last login time. Characters from addon uploads that Blizzard cannot see are removed after 7 days without a new upload.
• Character links and your Battle.net hash are kept until you remove them, or an officer or we remove them.
• When Tabard is removed from a Discord server, that server's settings, rosters, events, mains and officer-made links are deleted. Battle.net verified characters stay linked to you, so other servers can still recognize them.
• The record of an inactivity reminder is kept until the server removes the bot or you use /forgetme.
• Event signups and attendance are kept with the event until the event is deleted, the server removes the bot, or you use /forgetme.
• If verification can't find your characters, we note the time of that first try (so we can offer officer help an hour later). It's deleted when you verify successfully, or after 30 days.
• A copy of the database is backed up once a day. Copies on our host are deleted after 7 days. Encrypted copies with our backup storage provider are deleted after 30 days, except the one from the 1st of each month, which is deleted after a year. Data you delete (for example with /forgetme) can stay in these backups until they are deleted, and is only used from them if the database has to be restored after a failure.
• Server logs on our host are kept only for a short time, for fixing problems. When something goes wrong, the log notes an error code and reference, the server and Discord user ID involved, and technical details (for a failed verification, the names of the characters Blizzard returned), so the problem can be traced. Bot errors and permission problems (with the error code and reference, the server name and ID, the Discord user ID if there is one, and the technical details) are also posted in a private channel in our support server that only the people who run the bot can see. Failed verifications caused by your own Battle.net login are not posted there.

Your choices

• Remove a typed-in character with /unlink.
• Delete everything Tabard has stored about you, on every server, with /forgetme.
• Log out of the website dashboard at any time with the Log out button.
• Ask a server's officers to remove your Battle.net verification there with /roster unverify.
• Deleted your Discord account before unlinking? Press Verify with Battle.net on your new account: your Battle.net verification moves to it, and the old account's characters are unlinked.
• Disconnect Tabard from your Battle.net account at any time in your Battle.net account settings, under Connections.
• Ask us for a copy of your data, or to delete it, using the contact details below.

Security

All web traffic uses HTTPS. Battle.net account IDs are stored only as salted hashes, and no login tokens are stored. Off-site backups are encrypted (AES-256) before they leave our host. Access to the database and the bot's credentials is limited to the people who run the bot.

Children

Tabard is meant for people who meet Discord's minimum age and Blizzard's account requirements. We do not knowingly collect data from anyone younger.

Changes

We may update this policy. The date at the top shows when it last changed.

Contact

To contact us, join our support Discord server at https://discord.gg/sxVwCTBGD2.