Privacy

UO Toolkit · last changed with v35.213.2

This site now has a server, and some of what you do here is stored on it. That is what lets you sign in on your phone and find the builds you made on your desktop, and it is what lets a message you send actually reach the person you sent it to.

What is stored, and what is not, is set out below. There is no advertising here, no analytics that follow you around the web, no third-party trackers, and nothing about you is sold or shared with anybody.

What is kept about your account

Your email address, so you can be sent a sign-in link and contacted about your account. There is no password, so there is no password to leak.
Your username, which is public and cannot be changed once chosen.
If you ticked Update emails: whether each update email was opened (a tiny picture in it loading) and which of its links you pressed. Only the site’s administrator can see this, it is used to learn which updates people find useful, and it stops the moment you unsubscribe.
An age band only. You are asked for a date of birth to check you are 13 or over; the date is checked and thrown away, and only “13–17” or “18 or over” is kept. There is no date-of-birth column in the database.

What is kept because you made it

Your own things: saved builds, the build you are working on, your profile, your settings, your trivia record. These are yours, follow you between devices, and nobody else can read them.
Things you publish: marketplace advertisements and their photographs, published builds, comments, ratings, and what you put on your public profile. These are meant to be seen — that is the point of publishing them.
Messages you send: stored so they can be delivered. They are private between you and the person you sent them to in the ordinary sense — nothing shows them to other players — but they are not encrypted end-to-end, and somebody with access to the database could read them. Do not put anything in a message here that would matter if it were read.

Time on screen

The app records how long is spent on each tab, per day, so the author can see which parts of the tool people actually use and which are wasted effort. It is a total per tab per day and never a log of when you were at your computer. Only the site's owner can see it.

Your Discord webhook, if you connect one

A webhook address is a password: anybody holding it can post into that channel. If you connect one it is encrypted before it is stored, under a key kept outside the database, and it is never sent back to a browser — not even yours. The site shows you only enough of it to recognise which channel it is. Posts to Discord are made by the server, which is what makes that possible.

What the server unavoidably sees

Like any website, requests arrive carrying an IP address, and Cloudflare — who host this site — use it to stop abuse and to count how many requests come from where. It is also used here to limit how fast an account can be created. It is not stored against your account or used to build any profile of you.

Deleting your account

You can delete your account from inside the app at any time, and it takes your profile, your builds, your advertisements, your messages and the ratings other people gave you.

Two things deliberately survive it, and it is fairer to say so here than to surprise you later: ratings you gave somebody else, and any moderation record against your name. A rating is another player's account of a trade they were part of, not yours to erase; and an account that could be deleted and remade to shed its history would make the ratings worth nothing. Your username also stays reserved, so nobody can take it and inherit what people said about you.

Cookies

One, and only when you are signed in: a session cookie so that signing in sticks. It carries no information about you, is not readable by script, is not sent to any other site, and is used for nothing else. The site also uses your browser's own local storage to keep a copy of your work so the app still runs when your connection does not.

Children

You must be 13 or over to make an account. If you are under 18 the marketplace and direct messages are still available to you; please use them sensibly and tell an adult if somebody makes you uncomfortable.

Getting in touch

Questions, corrections, a copy of what is held about you, or a request to delete something: hello@uotoolkit.com.