Grimlight’s Depot

Privacy

Last updated October 8, 2026

Logging in with Battle.net

The Depot offers Blizzard’s Battle.net sign-in. You enter your password on Blizzard’s site, never ours. Blizzard shares only your BattleTag and an account number with us. We don’t receive your Battle.net email address.

What we keep when you log in

• An anonymous key made from your account number. The account number itself isn’t stored.
• Your BattleTag, so the menu can show it. It’s refreshed each time you log in and deleted 30 days after your last Battle.net sign-in.
• Your Auction House watchlist and shopping list (item numbers, planned quantities, when you added each item and the last recorded market price before that, so each device can show how a price has moved since) and dressing-room choice, so they follow you between browsers and devices.
• When you first and last logged in and how many times, plus a sign-in cookie that lasts up to 30 days.

We never use Battle.net information, including your BattleTag, for advertising or marketing, and we never sell or share it.

The Grimlight Depot app for iPhone (optional)

The app works without an account. If you choose Sign in with Battle.net in the app, the same login above runs in a system web view and the app receives its own sign-in key, kept in your phone’s keychain. With it the app reads and updates the same watchlist and shopping list as the website, and it can sign out or delete your Depot data. We store a scrambled copy of that key, when it was issued and when it was last used; it expires 30 days after the app last used it. The app key cannot pair a companion, change email settings or see anything the website wouldn’t show you. The app itself stores nothing about you beyond your lists and settings on the device, and sends no analytics.

The Grimlight companion (optional)

Companion keeps a small, rotating local error log with app versions, error categories and limited code locations. It excludes exception messages, personal paths, credentials and game data. Save support report exports a JSON file for you to review and share; reports are never uploaded automatically.

The Companion can download market prices without a website account. If scan sharing is enabled, it submits only the supported market, item numbers, asking prices, quantities and scan times. Raw saved files, character names, account names and private profiles stay on your PC. Submitted scans wait for review before publication.

Scan sharing uses a random installation key; the server stores its hash and submission receipts. Daily salted hashes of internet addresses enforce request limits and expire after two days. Pending scans expire after seven days; rejected payloads are cleared and their receipts expire after thirty days. Published market observations and review records are retained for price history and correction. Revoked installation-key hashes remain blocked. These records are separate from your optional Depot account.

Turn off Share auction scans in Settings to stop new submissions, or use Pause or Quit. Already published anonymous market history remains available.

If you connect the Grimlight companion on your PC, the Depot shows you a one-time code that lasts ten minutes. The companion trades it for a key that reads your website shopping list so it can appear in the Grimlight Auctions addon. If you separately enable saved game lists on the website, connected PCs may also upload item IDs, planned quantities and addition dates from your saved game list to your private account. We store one current snapshot per connected PC, with recorded market prices from at or before addition for price comparisons. Raw saves, character names, recipe names and profiles are not uploaded. We keep a scrambled copy of that key, when the companion was connected and when it last checked. The key can’t see your BattleTag, watchlist or email, and it cannot change account preferences or your website-created items. Disable game list sharing to remove uploaded game snapshots and stop further uploads. Disconnect, on the shopping list or in the companion, removes the connection and its uploaded game snapshot. Website-created items remain until you remove them.

Depot update emails (optional)

If you choose to sign up, we keep your email address, when you agreed, and the wording you agreed to. We use it only to send Grimlight’s Depot updates. We don’t sell it or share it with advertisers. You can turn emails off from the account menu or with the link in any Depot email, and turning them off deletes the address.

Site numbers

We count logins, new players and email sign-ups per day. These are totals only. We also count API calls per key per day, as described under Developer API.

Page visits are measured with Cloudflare Web Analytics, which doesn’t use cookies, and with Google Analytics 4, which sets a first-party cookie (_ga) to tell returning visitors from new ones. Google receives the page you viewed (the item, market or search you were looking at), your rough location from a shortened IP address, and your browser and device type. It never receives your BattleTag, account key, watchlist or shopping list, and Google Signals and ad personalization are turned off. Analytics is skipped altogether when your browser sends Global Privacy Control or Do Not Track. How Google uses this data.

Discord sign-in and connected accounts

You can sign in with Discord or Battle.net, and connect both to one Depot account. Discord is asked for your identity and email. We keep a scrambled (HMAC) account identifier, your display name, and your email only when Discord marks it verified. We do not store your Discord password, access token or refresh token, and do not request your servers, friends, messages or permission to join a server. Discord profile details expire after 30 days without a fresh Discord sign-in.

A Discord email is account contact information, not a subscription to Depot updates. Marketing always requires the separate, unticked consent box. We never connect accounts just because their names or emails match. Connecting requires signing in to the other provider and explicitly confirming the link. If both sign-ins already have Depot data, the confirmation explains how lists combine. Disconnecting a sign-in does not split merged lists; a working sign-in method must remain.

Connected accounts shows the stored email in masked form. Disconnecting Discord removes its identity, name and contact email from the Depot. Deleting your Depot data removes both connected identities and pending links. A scrambled record of an explicit disconnect is retained until account deletion to prevent accidental reconnection during migration. Sign-in and linking proofs expire after ten minutes; only hashes are stored. Discord handles your authorization under Discord’s privacy policy. Provider profile data is not sent to analytics.

Private staff sign-in alerts

When you successfully sign in with Battle.net or Discord, the Depot sends a registration or sign-in notice to its private staff channel on Discord. The notice includes your display name or BattleTag, Discord username when supplied, sign-in provider, event time, account creation date, sign-in count, connected sign-in methods, a shortened Depot account reference, and a masked verified Discord email if supplied. Battle.net does not provide an email. We do not send passwords, access tokens, raw provider account IDs, internet addresses, browser details, saved-list contents or marketing contact information in these notices. They do not subscribe you to marketing.

These notices help staff support accounts and understand website activity. They are stored with Discord and visible only to staff with access to the private channel. We remove them after 30 days, or queue their removal when you delete your Depot account or disconnect that provider. Removal normally runs within a few minutes; Discord or service outages may delay it. Queued profile data is erased immediately on account deletion or disconnection, and sent profile data is not retained in the delivery queue. Discord’s privacy policy also applies to data handled by Discord.

Developer API

The developer API is free. To use it you sign in with Battle.net or Discord (the same login as above) and create an API key on the Your API keys page. The first time, we ask for an email address. It’s required for a key, so we can reach you about your keys and about changes to the API that could break your tool.

What we keep for the API:

• Your contact email, and when you entered it. We use it only to write to you about the API: your keys, outages and changes to the API. It doesn’t sign you up for Depot update emails.
• Your keys. A scrambled copy of each key (we can’t read the key back), its first few characters so you can tell your keys apart, the name you gave it, a plan label (every key is free), when it was created, when it was last used and whether you revoked it.
• Usage counts. For each key, per day: which part of the API was called, the tool name your program sends (or the first word of its user agent), whether the call worked, and how many calls there were. These are counts, not a list of individual requests. We keep them for 400 days. Calls made without a key are counted together under “no key”, with no address or identity attached.
• Short-term request logs. Cloudflare keeps a log of each request for a few days so problems can be fixed. Those logs show the key’s ID (never the key), the tool name, the answer and how long it took, plus the request details Cloudflare records for any website request.
• While the API changes over to keys, calls made without a key are still counted by internet address for a short time, only to enforce the request limit for keyless calls. Calls with a key have no limit.

We use this to improve the Depot and its API: to see how many people and tools use the API, which parts they use and when something breaks, and to stop a key that is being abused by revoking it. We don’t sell, rent or share any of it. We never use your BattleTag or any other Battle.net information for marketing.

Depot update emails are separate. The API key page has its own unticked box for them. Only if you tick it is your address added to the Depot update list described above, with the same rules and the same one-click way out.

Your keys can’t see your watchlist, shopping list, BattleTag or email. Anyone holding a key can make API calls that count against it, so keep it private and revoke it if it leaks. Revoking takes effect within about a minute.

If you don’t log in

Your watchlist, shopping list and dressing-room choice stay in your own browser’s storage and aren’t sent to us.

Where it’s stored

Account data is stored with Cloudflare, which hosts the Depot. The private staff sign-in notices described above are also stored with Discord.

Your choices

Sign out any time. Delete my Depot data in the account menu immediately removes your key, BattleTag, watchlist, shopping list, settings, email, sign-ins, app sign-in keys and any companion connection, plus your API contact email, API keys and their usage counts. You can revoke any API key on the Your API keys page; keys you revoked, and their usage counts, are deleted 400 days after you revoke them. Blizzard’s own handling of your account is covered by Blizzard’s privacy policy.