1. Controller and contact
Warframe Collection is an independent fan project operated by Warframe Collection. Privacy questions and data-subject requests can be sent to privacy@warframecollection.com.
2. Data we process
- Account information such as display name, email address, email-verification status, and securely hashed password credentials.
- Collection progress, item ranks, farm targets, material and relic inventories, mastery extras, sync revision, and privacy preferences saved to the cloud.
- Session, request-security, rate-limit, and limited technical log data needed to operate and protect the service.
- A random public-profile link and the collection information displayed through it, only when the user explicitly enables public visibility.
- Anonymous Web Vitals and limited client-error events only after the user opts in to analytics.
3. Purposes and legal grounds
Data is processed to create and secure accounts, provide cloud synchronization and requested public-profile features, respond to support or rights requests, prevent abuse, and maintain the service. Processing relies, as applicable, on performance of the requested service, compliance with legal obligations, legitimate interests in service security, and consent for optional analytics.
4. Recipients and international transfers
Infrastructure and service providers may process limited data on our behalf, including Vercel for hosting, the configured PostgreSQL provider for account and sync storage, Resend for transactional email, and Upstash for distributed request protection. These providers may operate outside the user's country. Their own terms and safeguards also apply.
- Have I Been Pwned password screening is used through the authentication system to reject known compromised passwords. The application does not intentionally send the user's plain-text password to project logs.
- External links such as Warframe, Warframe Wiki, and Warframe Market are governed by the destination site's privacy practices.
5. Retention and security
Account and cloud-sync data is retained while the account remains active and is removed or anonymized when deletion is completed, except where limited retention is required for security, dispute resolution, or law. Sessions expire automatically. Reasonable technical and organizational safeguards are used, but no internet service can guarantee absolute security.
6. Your choices and rights
Users can keep their profile private, withdraw analytics permission, export locally stored progress, and request access, correction, deletion, restriction, or information about their personal data where applicable. Requests may be sent to the contact address above. Identity verification may be required before completing a request.
7. Local device data
The service is local-first. Collection progress can be stored in the browser without an account. Browser storage remains on the device unless the user signs in and synchronizes it. Clearing browser data may permanently remove an unsynchronized local collection.
8. Changes
This notice may be updated when the service, providers, or legal requirements change. Material changes will be communicated through the site where appropriate.