Privacy Policy

Effective ยท Version 1

The short version

  • You can browse the site and use its tools without an account. You only need one to save or submit.
  • If you sign in, you do it with Google or your Project Diablo 2 account. We never see or store a password.
  • We keep your Google ID and email address, or your Project Diablo 2 account ID and username, privately. They are never shown to anyone else.
  • We use no cookies, no ads and no third-party trackers. We don't sell your data.
  • We count visitors with a one-way hash that is deleted after two days. We never store your IP address.
  • You can delete your account at any time.

  1. Who we are

    Hiim PD2 (hiimpd2.com) is a free, fan-made resource for Project Diablo 2 players. "We", "us" and "our" in this policy mean Hiim PD2. You can reach us at hiimpd2@gmail.com. This policy explains what data the site handles and why.

  2. What we deliberately don't collect

    We built the site so that it doesn't need the following, and we don't collect them:

    • Passwords. Sign-in is handled by Google or Project Diablo 2.
    • Cookies. The site sets no cookies of any kind.
    • Advertising IDs. There are no ads and no ad networks.
    • Precise location. We only record roughly which city a visit came from, never your exact location. See Analytics below.
    • Your IP address. We never store it. See Analytics below.
    • Your Google profile photo. We don't store it.

  3. What we collect and why

    If you only browse, we collect anonymous visit counts (see Analytics). If you sign in, we also keep:

    • Your Google account ID and email address, to recognise you when you sign in, to help you recover your account and, if needed, to contact you about your submissions, if you sign in with Google.
    • Your Project Diablo 2 account ID and username and the date you linked them, if you sign in with Project Diablo 2, to recognise you when you sign in.
    • A display name you choose the first time you sign in. We never fill it in from your Google account, and you can change it any time.
    • Your Discord account ID, username and the date you linked it, only if you link your Discord account, and whether you turned off Discord DMs.
    • Your YouTube channel link, only if you add it, and your Twitch account ID, username and the date you linked it, only if you link your Twitch account.
    • A public profile ID: a random short code for your profile page link, so the link never shows your Google account ID.
    • Your role (user, moderator or admin) and the dates your account was created and last used.
    • What you create: builds, custom items, favorites, +1 votes, reports and submissions (map clears, boss kills and builds, with the video links and notes you enter).
    • Issue reports, if you use "Report an issue": the category, summary and details you write, the page address you report from, your browser's user-agent string (shortened), your account ID and your display name at the time, plus the ticket's status, moderator notes and dates. Only you, moderators and admins can see them. We count how many you send per day to limit spam; that count is deleted after two days. No email address is stored with a report.
    • Moderation records: when a moderator approves or rejects a submission, hides a build or changes a tier, we log who did it and when.

    Our servers keep short technical logs (the page requested, the result and how long it took) for 14 days to fix problems. They don't contain your IP address.

  4. Signing in with Google

    When you sign in, Google tells us your Google account ID, your email address and your name. We keep your Google ID and email address. We don't store your name: at sign-in we only check that your display name isn't still your Google first name, and ask you to choose an alias if it is.

    Your email address is used only to help you recover your account and to contact you about your submissions. It is never shown publicly, never shown to other users and never shared.

    Google's own handling of your sign-in is covered by Google's Privacy Policy.

  5. Signing in with Project Diablo 2

    When you sign in with your Project Diablo 2 account, Project Diablo 2 tells us your account ID and username. We keep both privately, only to sign you in: your username is shown only to you, on your account page, and stays hidden there until you show it. We get nothing else from Project Diablo 2: no email address, password, characters or game data.

    You can link both Google and Project Diablo 2 to one account and unlink either on your account page, as long as one stays linked. If the sign-in you link already belongs to another Hiim PD2 account, you can choose to merge that account into yours; nothing is merged unless you confirm it.

  6. Your Discord username

    Showing your Discord username is optional, and the only way to add it is to link your Discord account, so every Discord name on the site is verified. Your linked username is visible to other signed-in users so they can contact you about your builds and submissions. It is never shown to visitors who aren't signed in. Our server removes it from every response to someone who isn't signed in.

    Linking sends you to Discord, which asks you to let us see your basic account details (the identify permission). We store only your Discord account ID, your username and the date you linked it, and use them only to show your Discord name and to send you the DMs below. We never see your email, servers or messages, and we don't keep the access Discord gives us: we revoke it as soon as we have read your username. You can unlink at any time on your account page, which removes all of it.

    Once you link Discord, our bot sends you a direct message when a moderator updates one of your own issue reports or decides one of your own submissions: what it is, its new status and the moderator's note. It never messages you about anything else. Discord only delivers these if you share the Hiim Discord server with the bot and allow DMs from its members. To stop them, untick "Send me Discord DMs" on your account page, or unlink Discord.

  7. Your linked Twitch account

    Showing your Twitch channel is optional, and the only way to add it is to link your Twitch account, so every Twitch name on the site is verified. Linking sends you to Twitch, which asks you to let us see your public account details. It asks for no other permissions. We store only your Twitch account ID, your Twitch username and the date you linked it, and we revoke the access Twitch gives us as soon as we have read your username.

    A linked Twitch username is public: it shows as a Twitch icon next to your name on your builds, parties and profile page, linking to your channel. You can unlink at any time on your account page, which removes all of it.

  8. What is public

    Anyone, signed in or not, can see:

    • your display name and the +1 count on builds you make public;
    • your profile page, which shows your display name, when you joined, the "About me" text you write, your public builds, your linked Twitch name and the YouTube channel you add (your linked Discord username is shown there only to signed-in users);
    • your linked Twitch name and your YouTube channel, as icons next to your name on your builds and parties;
    • your display name and times on approved clears, tier lists and leaderboards;
    • builds you set to "unlisted", if they have the link.

    These are not public: your email address, your favorites list, which builds you gave a +1, your reports and your private builds. Moderators can see who voted on a build when they are looking into vote abuse.

  9. We don't send email

    The site never sends you email: no notifications, no marketing and no newsletters. Whether your submission was approved or rejected, with the moderator's note, is shown on your account page. If a moderator hides one of your builds, a notice is shown on the build. There is nothing to opt out of.

  10. Analytics: counting visitors without tracking them

    We don't use Google Analytics or any third-party tracker. Each page sends one small, anonymous message to our own server when it loads, and some pages send a named event (for example, "build saved"). This uses no cookies, no local storage and no device ID.

    From each message our server counts, per day:

    • which page was viewed or which event happened;
    • roughly where the visit came from: the country, the state or region, and the nearest city, as estimated by our hosting provider (Amazon CloudFront) from your connection. We keep only the city name and map coordinates rounded to about 10 km, counted once per visitor per day and added into totals. We never use GPS or anything more precise;
    • the kind of site that linked you here (such as Google, Reddit or YouTube), not the full address;
    • your browser's main language.

    To count unique visitors, the server mixes your IP address with a secret value and your rough device type (such as "Windows / Chrome") and turns that into a one-way hash. The IP address itself is never stored, and the hash can't be turned back into it. Each hash is deleted after two days. The daily counts are deleted after about 13 months.

    When someone opens a shared build, we count the open once per visitor per day using the same kind of salted, one-way hash of the IP address. That hash is deleted after two days.

  11. Local storage

    The site stores a few things in your browser's local storage, on your device only:

    • your sign-in session token, while you are signed in. Signing out removes it;
    • Planner drafts, so you don't lose unsaved work.

    The analytics message uses no local storage at all. You can clear local storage in your browser at any time.

  12. Sharing

    We don't sell your data, and we don't use it for advertising. We share it only with the services that run the site:

    • Amazon Web Services (AWS) hosts the site and stores its data in the United States.
    • Google and Project Diablo 2 handle sign-in.

    We may also disclose data if the law requires it.

  13. Retention and deleting your account

    We keep your account data until you delete your account. You can delete it from your account page.

    Deleting your account removes your email address, your linked Google and Project Diablo 2 sign-ins, your YouTube channel link, any linked Discord and Twitch accounts, your profile page, builds, custom items, favorites, votes and pending submissions. Approved clears stay on the tier lists and leaderboards, but without your name.

    Moderation records may keep your account ID after deletion so we can keep an honest history of moderation decisions. They don't hold your email address.

    Issue reports are anonymized when you delete your account: we remove your account ID, your display name and your browser's user-agent string from them, and they show as sent by "deleted user". The category, summary, details, page address, status, moderator notes and dates stay, so we can finish fixing what you reported. Your daily report count is deleted too.

    Reports you made about other people's builds are kept for moderators and also show as sent by "deleted user". Your builds, saved items, favorites and +1 votes are deleted.

  14. Security

    The site is served only over HTTPS. Secrets such as signing keys are kept in encrypted storage, not in our code. Every change to your data needs a valid sign-in, and moderator and admin rights are checked on every request. No system is perfectly secure, but we keep what we store small so there is less to lose.

  15. Your rights

    You can:

    • see and change your display name and your YouTube channel link, and link or unlink your Discord and Twitch accounts and your Google and Project Diablo 2 sign-ins, on your account page;
    • delete your account and the data listed above;
    • ask us for a copy of the data we hold about you, or ask us to correct it.

    Email hiimpd2@gmail.com for anything you can't do yourself. We will reply within 30 days.

  16. Children

    Hiim PD2 is not for children under 13, and they must not create an account. If we learn that a child under 13 has an account, we will delete it. If you think this has happened, email hiimpd2@gmail.com.

  17. Users outside the US

    The site is run from the United States and its data is stored there. If you use it from another country, your data is sent to and handled in the United States. Where your local law gives you rights over your data, such as in the EU or UK, contact us and we will help you use them.

  18. Changes

    If we change this policy, we will update the effective date and version at the top. For important changes, signed-in users will be asked to agree to the new version the next time they visit.

  19. Contact

    Questions about this policy or your data: hiimpd2@gmail.com.