Privacy Policy
Last updated: 17 July 2026
Who we are
DIToolbox is a clan-management tool for Diablo Immortal (roster planning, stats tracking and event coordination) offered to multiple clans on a paid basis. It is operated by an individual (a sole trader) based in the United Kingdom, who is the data controller for the personal data described here.
Contact: our YouTube channel (@MarblesDI). This policy is governed by UK GDPR and the Data Protection Act 2018.
What we collect
- Discord identity — your Discord user ID and username, via OAuth. We request the
identifyscope only (no email, friends or server list). - Character & clan data — in-game name, class, role, team, tier access and clan membership, entered by you or maintained by your clan's officers.
- Stats — secondary stats (armor, AP, potency, resistance, resonance), submitted via a Google Form, in-app, a screenshot (OCR), CSV import, or synced from Discord.
- Availability & attendance — your responses to event availability prompts and officer-recorded attendance.
- Licence — for paying operators, a Lemon Squeezy licence key plus its product, status and expiry.
- Public feedback — DI-calculator inaccuracy reports; we store a one-way SHA-256 hash of your IP (never the IP itself) for abuse prevention.
- DI Calculator builds & preferences — kept in your browser (localStorage); never sent to our servers.
Why we use it & our lawful basis
| Purpose | Lawful basis |
|---|---|
| Your account and paid licensing | Contract |
| Roster / attendance / event operations, and error & performance monitoring | Legitimate interests |
| Stats submissions and Discord DM reminders | Consent (you can withdraw it at any time) |
| Bot-abuse protection on public feedback | Legitimate interests |
| Understanding site traffic, performance and engagement | Legitimate interests |
Who we share it with
We use the processors below to run the service. We do not sell or share your personal data for advertising, and we run no ad trackers or cross-site profiling. We do measure page traffic, load performance, and how people find and use the site, using Cloudflare Web Analytics, which uses no cookies and does not follow you across sites.
| Service | Purpose | Data received |
|---|---|---|
| Discord | Login, bot DMs & interactions | Discord user ID, username; roster / DM content |
| Railway (hosting) | App hosting, database, live updates | All app data, at rest and in transit |
| Sentry (EU region) | Error & performance monitoring | Discord ID + username, clan name; URLs are scrubbed |
| Google (Sheets / Forms) | Roster import, stats intake | Player names, Discord handles, stats |
| Lemon Squeezy | Paid licensing & checkout (Merchant of Record) | Licence key & status; we never see your card details |
| Cloudflare (Turnstile) | Bot protection on public feedback | Your IP (stored by us only as a hash) + a challenge token |
| Cloudflare (Web Analytics) | Cookieless traffic, performance & engagement measurement | Page URL, referrer, country, device & browser type; no cookies, no cross-site identifier |
| Ko-fi | Optional donations (outbound link) | Whatever Ko-fi collects if you choose to donate |
International transfers
Some processors above (for example Railway, Google, Lemon Squeezy, Cloudflare and Ko-fi) process data outside the UK. Where they do, transfers are protected by UK adequacy regulations or the ICO's International Data Transfer Agreement / Standard Contractual Clauses. Sentry is configured to store data in the EU.
How long we keep it
- Stats, roster & attendance — for the duration of your clan membership plus one season.
- Notification / nudge logs — 90 days, then deleted automatically.
- Licence key & status — while the licence is active.
- Hashed feedback IPs — short-lived, for abuse prevention only.
- Login session — cleared when you sign out.
Your rights
Under UK GDPR you can, at any time:
- Access & portability — download a machine-readable copy of your data from your Account page ("Download my data").
- Rectification — ask us to correct inaccurate data (e.g. wrong class or stats).
- Erasure & objection — request deletion, or object to processing based on legitimate interests, from your Account page or by contacting us.
- Withdraw consent — stop stats submissions or opt out of Discord DM reminders.
The quickest way to access or delete your data is your Account page. For anything else, contact us via our YouTube channel (@MarblesDI). We respond within one month. You can also complain to the UK's supervisory authority, the Information Commissioner's Office (ico.org.uk).
Cookies & local storage
- Session cookie — one secure, HTTP-only cookie (
authjs.session-token) for login. Strictly necessary; no tracking. - localStorage — your UI preferences, cached roster data and DI-calculator builds, kept on your device.
US residents (CCPA)
We do not sell or share your personal information, and we do not use it for cross-context behavioural advertising. You can request access to, or deletion of, your data through the channels above.
Changes to this policy
We may update this policy from time to time. Material changes will be communicated in-app or via Discord. The "last updated" date above reflects the most recent revision.