Privacy Policy
Effective 26 October 2026
Anyone can read the Runic Wiki without an account. An account is optional: it lets you favourite runes and pin up to 10 of them. This policy covers what the wiki stores when you use one, why, for how long, and the choices you have.
Who runs the wiki
The Runic Wiki is run by Varension, the data controller for everything described here. For any question or request about your data, email privacy@varension.org. The wiki's administrators look after accounts for Varension.
What is stored, and why
| Information | Why it's needed | Lawful basis |
|---|---|---|
| Your username | To identify your account and sign you in | Contract |
| Your password, kept only as an Argon2id hash | To check it's you when you sign in. The password itself is never stored | Contract |
| Your email address, if you add one, and when you confirmed it | To send the emails listed below, such as the password reset links you ask for | Contract |
| An email address waiting for confirmation | To send its confirmation link | Contract |
| Your favourite runes, with the date you saved each one, and your pinned runes in your chosen order | To show your saved runes across the wiki | Contract |
| When the account was created and when it was last used | To delete accounts left unused for two years | Legitimate interests |
| Whether the account belongs to an administrator | To give the wiki's administrators their tools | Legitimate interests |
| Your sign-in sessions: a hash of each session's random token, when it started and when it ends | To keep you signed in on each browser | Contract |
| Confirmation and reset links: a hash of each link's token and when it expires | To make each link work once, for a limited time | Contract |
| Counts of recent sign-in, registration and reset attempts for each connection (IP address), username and email address | To stop password guessing and abuse. The counts live in the server's memory for up to an hour and are never written to disk | Legitimate interests |
Contract means the information is needed to provide the account you asked for (Article 6(1)(b) of the UK GDPR and the EU GDPR). Legitimate interests means it keeps accounts secure and the database free of abandoned accounts, which we have weighed against your rights (Article 6(1)(f)).
The wiki has no analytics, advertising or tracking, and it loads no scripts, fonts or embeds from other sites. IP addresses are never stored with your account, and the web server keeps no record of the pages you visit. There are no public profiles, so other visitors can't see your username or saved runes. Only the wiki's administrators can see account details, as described below. Your information is never sold or used for marketing.
Emails
The wiki only emails an address you added to your account, and only for these reasons:
- to confirm the address, with a link that works for 48 hours;
- to send a password reset link you asked for, or one an administrator sent for you, which works for one hour;
- to warn you 30 days before an unused account is deleted;
- to tell you when an administrator changes your username or deletes your account.
There is no newsletter and no marketing email.
Cookies and local storage
One essential cookie keeps you signed in, and your dark or light mode choice is remembered in local storage once you use the toggle. The Cookie Policy lists both. Neither tracks you, so the wiki has no consent banner.
How long it's kept
| Information | Kept for |
|---|---|
| Your account, favourites and pins | Until you delete the account, or two years after it was last used. If the account has a confirmed email, a warning arrives 30 days before deletion, and signing in keeps the account |
| A sign-in session | Until you sign out. A browser session ends when the browser closes, after 7 days at most. With "Keep me signed in" it lasts 30 days from your last visit |
| An unconfirmed email address | 48 hours |
| A password reset link | One hour, or until it is used |
| Attempt counts for rate limits | Up to one hour, in memory only |
| Daily backups of the accounts database | 14 days, so a deleted account is gone from every backup within 14 days |
| Web server error logs, which can include a connection's IP address when a request fails | 14 days |
| Records of administrator actions, in the server log | 14 days |
Administrators
A few accounts belong to the wiki's administrators, who look after accounts for Varension. An administrator can find any account by its username, or by the exact email address it confirmed, and see:
- its username, its confirmed email, and any address waiting for confirmation;
- when it was created and when it was last used;
- how many runes it has favourited and pinned, and how many browsers are signed in to it.
An administrator can also download the account's data, send a password reset link to its confirmed email, sign it out on every device, change its username, or delete it. Administrators use these tools to answer requests sent to privacy@varension.org, to keep accounts secure, and to remove accounts that misuse the wiki, such as ones made in bulk by automated software. When an administrator changes your username or deletes your account, an email tells you, if the account has a confirmed email.
Every change an administrator makes, and every data download, is recorded in the server log with the administrator's username, what they did, and the account's username. Administrators are appointed on the server itself, and nothing on the website can make an account an administrator.
Who handles it for us
- Hosting: IONOS runs the server, in Spain. The accounts database and its backups are stored there.
- Email delivery: IONOS delivers the emails listed above. It receives the address and the message for each one.
Both act only on our instructions, under data processing agreements. If either handles your information outside the UK or the European Economic Area, the transfer is covered by an adequacy decision or standard contractual clauses.
How it's protected
- Passwords are hashed with Argon2id, so nobody can read your password back, including us.
- Session, confirmation and reset tokens are stored only as SHA-256 hashes.
- The wiki is served over HTTPS only, and the sign-in cookie is HttpOnly, Secure and limited to this site.
- Sign-in, registration and reset attempts are rate limited.
- Administrators enter their password again before they change a username or delete an account.
- Deleted records are overwritten inside the database file.
Your rights
Most of your rights work straight from Account settings:
| Right | How to use it |
|---|---|
| Access and portability | Download my data gives you a JSON file with everything stored about your account |
| Rectification | Change your username, email or password |
| Erasure | Delete account removes the account and everything saved with it at once |
| Restriction and objection | Email privacy@varension.org |
For anything else, or if you can't sign in, email privacy@varension.org. We reply within one month.
An account without an email gives nobody a way to prove it is theirs once its password is lost, so such an account can't be changed or deleted on request. It is deleted automatically two years after it was last used.
You can also complain to a data protection authority: in the UK, the Information Commissioner's Office; in the EU, the authority in the country where you live or work. We'd welcome the chance to put things right first.
Age
Accounts are for people aged 13 or older, and registration asks you to confirm your age. If we learn that an account belongs to someone younger, we delete it.
Changes to this policy
When this policy changes, the new version appears here with a new effective date. Accounts with a confirmed email are told about significant changes by email.