Privacy policy
What is AlbionCore
AlbionCore is a free companion website for players of the MMORPG Albion Online. It helps players track bank inventory, plan crafting routes, monitor market prices, and coordinate party compositions through a Discord-authenticated dashboard. The project is in Open Beta and source code is publicly available.
What we collect
Discord identity
Your Discord user ID, username, avatar URL, and guild memberships. Obtained via Discord OAuth on first login, with your explicit consent on Discord's authorization screen.
Encrypted Discord OAuth tokens
Refresh + access tokens, encrypted at rest with Fernet. Used so the bot can sync your guild list without re-prompting OAuth. Plaintext is never stored or logged.
In-game data you upload
Bank inventory items, character names + UUIDs observed by the desktop companion, manually-entered wallet balances. You provide this voluntarily, typically by syncing the desktop companion or typing values into the dashboard.
Companion session credentials
SHA-256 hashes of bearer tokens for paired desktop companions. The plaintext token is returned to your computer once at pairing time and never stored server-side.
Funnel telemetry (with your consent)
If you accept the analytics banner, we record opaque funnel events (page_view, signup_started, oauth_completed, companion_paired, first_value_seen, first_bank_item, patron6_continuation_consumed) along with the page path and the surface that triggered them. Events are stored anonymously when you're signed out, or stamped with your Discord ID when you're signed in. A random 16-character `albioncore.telemetry_session` token lives in your browser to dedup events across page loads, purely client-side, no third-party trackers, no DNT bypass. You can revoke consent at any time by clearing `localStorage["albioncore.consent"]` (a one-click toggle is planned for the Profile page). Raw events are retained for 90 days.
Why we collect it
Discord identity is required to authenticate you and associate your data with your account. Albion-side data (characters, bank, wallet) is the core function of the service: you upload your own gameplay data to view it on the dashboard.
The desktop companion
The optional desktop companion application (Windows) reads your own Albion network traffic locally via Npcap, parses the public Photon protocol, and uploads bank snapshots to AlbionCore over HTTPS. It is read-only and never modifies the game client or sends anything back to Albion. The companion's source code is public alongside the rest of the project.
Third parties
Discord
OAuth login + guild listing.
Albion Online Data Project
Live market prices. We send the items + cities you query; we do not send your account identifiers.
Vercel
Frontend hosting + CDN. Standard web access logs (IP, user-agent) per their privacy policy.
Railway
Backend hosting + Postgres. Same standard hosting logs.
How long we keep data
We retain your data for as long as your account is active. You can delete it at any time:
- Companion-imported bank rows + linked charactersClick Disconnect & purge on
app.albioncore.com/companion. - Manual bank entriesDelete row-by-row from
app.albioncore.com/bank. - Full account deletionContact us (see below). We will purge every row associated with your Discord ID across the database.
Security
- All transport is HTTPS / TLS 1.3.
- Discord OAuth tokens are Fernet-encrypted with a server-side key never accessible to the frontend.
- Companion bearer tokens are stored hashed (SHA-256).
- Database access is restricted to the application backend.
Legal bases for processing (GDPR)
For visitors in the EU/EEA and the UK, we rely on the following legal bases under the GDPR (Art. 6):
- Contract (Art. 6(1)(b)) — processing your Discord identity and the in-game data you upload is necessary to provide the dashboard you asked for.
- Consent (Art. 6(1)(a)) — funnel telemetry is collected only if you accept the analytics banner. You can withdraw consent at any time.
- Legitimate interests (Art. 6(1)(f)) — keeping the service secure (e.g. rate-limiting, standard hosting access logs) and preventing abuse.
Your rights
Under the GDPR and similar laws you can exercise the following rights over your personal data. To exercise any of them, email us at contact@albioncore.com. We respond within 30 days and never charge for requests.
Access
Request a copy of the data we hold about you.
Rectification
Correct inaccurate or incomplete data.
Erasure
Delete your account and all associated rows.
Portability
Receive your data in a machine-readable format.
Object / restrict
Object to or restrict certain processing.
Withdraw consent
Turn off analytics telemetry at any time.
EU/EEA users also have the right to lodge a complaint with their local data protection supervisory authority if they believe their data has been mishandled.
International data transfers
AlbionCore is operated by Subeleven LLC and hosted on infrastructure provided by Vercel (frontend/CDN) and Railway (backend + database). Depending on the region these providers serve, your data may be processed on servers located outside your country, including in the United States. Where required, such transfers rely on the providers' Standard Contractual Clauses or equivalent safeguards. We do not store the personal data of any specific national group in a dedicated in-country database; if you are subject to a data-localization law that requires this, please do not upload personal data to the service.
Children
Albion Online's terms restrict play to ages 13+ and AlbionCore matches that. We do not knowingly collect data from children under 13.
Contact
For questions, data export requests, or full account deletion:
Source-code level detail of any data flow described above is available in the public GitHub repository linked from the homepage.