Privacy Policy

This policy explains what data Baghound collects, why, and how it is handled. Baghound is a Realm of the Mad God companion app: a desktop sniffer that tracks your loot, characters, fame and DPS, plus a public website that lets you and your friends compare profiles.

Who runs Baghound

Baghound is operated as a sole trader by Skydraex (UK). Contact us at baghoundsupport@gmail.com or on the Baghound Discord server for anything privacy-related.

What we collect — and why

Account & subscription

• Your email address — your unique account identifier. Used to start your trial, verify your subscription, send sign-in codes, and prevent duplicate trials.
• Subscription status — trial / active / expired / cancelled. Provided by Stripe.
• Rotating session tokens — random identifiers tied to your signed-in devices. Contain no personal information. Used to keep you signed in and detect account sharing.
• IP address and approximate country at sign-in — recorded against each session and each login attempt. Used for security (detecting unusual sign-ins, rate-limiting verification codes per IP). Never shown publicly.

Gameplay data (uploaded by the desktop sniffer)

If you sign in to Baghound and run the desktop sniffer, it will upload the following while you're on an active subscription or trial. If you're on the free tier the sniffer stops uploading — historical data remains in our database (so it's still there if you resubscribe) but no new data is pushed.

• Collection log — the items you've found, with lifetime and currently-owned counts. Visible to other subscribers on your public profile.
• Character roster — your characters' class, level, fame, EXP, base stats, currently-equipped gear, pet (name, type, skin, rarity), and the last time the sniffer saw them in-game. Always public.
• DPS history — per-run damage you dealt, damage taken, whether you cleared the run, dungeon name, duration, and party size. Per-boss breakdown is included. Visibility is controlled by the "Share my DPS history publicly" toggle on your profile.
• Other players' damage during your runs — only included in the public DPS breakdown if you turn on the "Include other players' damage when shared" toggle. Off by default.
• Fame history — fame snapshots per character over time, used to draw the fame graph on your profile. Always public.
• Dungeon stats — completion counts, peak DPS, and which bosses you've fought, per dungeon. Visibility is tier-gated: only subscribers see other subscribers' detail.
• Public display name — the name you pick for your profile page (e.g. your RotMG character name). Visible to everyone.

Crowd-sourced sprite assets

When your sniffer encounters a boss whose sprite isn't yet on our server, it uploads a small PNG of that sprite so future visitors to any profile see proper boss icons. These uploads contain no personal information — they are tiny images of game art extracted from your local RotMG installation. The contributor isn't identified anywhere; only the asset itself is stored.

What we do not collect

Payment data

All payment processing is handled by Stripe. We never see, receive, or store your card details. Stripe is a PCI-compliant payment processor and operates under its own privacy policy: stripe.com/privacy. When you subscribe, Stripe shares with us only:

• The email address used at checkout.
• Your subscription status (active / trialing / cancelled / payment failed).
• A Stripe customer ID we use to look up your subscription.

Where your data is stored

• Account, sessions, gameplay data, display name, sprites: Cloudflare D1 (SQLite), region automatically chosen by Cloudflare based on the user's location. For EU/UK users this is typically a European region.
• Payment data: stored by Stripe, not by us.
• Local sniffer state (sign-in token, per-character chat logs you've enabled, cached settings): stored only on your own device in ~/.rotmg-sniffer/. Never uploaded.

How long we keep your data

• Active subscribers and trial users: for the duration of your account.
• Cancelled, expired, or free-tier users: gameplay data is retained indefinitely so you can return and pick up where you left off. Account and Stripe linkage are retained for 12 months in case of refund disputes.
• Sessions / login history: 90 days, then purged.
• Verification codes: 10 minutes from issue, then purged whether used or not.
• Stripe payment records: retained by Stripe according to their policy (typically 7 years for tax purposes).

Your rights

Under UK GDPR you have the right to:

• Access — request a copy of the data we hold about you.
• Deletion — request that we delete your data. This will cancel any active subscription.
• Correction — request correction of any inaccurate data.
• Portability — request your data in a machine-readable format (JSON export).
• Objection — object to how we process your data.

To exercise any of these rights, email baghoundsupport@gmail.com. We will respond within 30 days.

Profile privacy controls you own

Two toggles on your own profile let you control what visitors see, without contacting us:

• Share my DPS history publicly — when off, your per-run DPS breakdown is hidden from all visitors. Your own view is unaffected.
• Include other players' damage when shared — when off (the default), only your contribution to each run is visible on the public page. Other players in your runs are hidden.

Third parties we use

• Stripe — payment processing (stripe.com/privacy).
• Cloudflare — hosts our worker API, D1 database, and Pages-hosted website (cloudflare.com/privacypolicy).
• Resend — sends sign-in verification codes and other transactional emails (resend.com/legal/privacy-policy).
• GitHub — hosts the desktop app downloads and update files (GitHub Privacy Statement).

Changes to this policy

If this policy changes, the updated version will be published on this page and the date at the top updated. Material changes will be announced on the Baghound Discord and via in-app notice.

Complaints

If you believe your data has been mishandled, you have the right to complain to the UK Information Commissioner's Office: ico.org.uk.