Privacy policy

1. Privacy at a glance

Brick is a guild companion for World of Warcraft. It uses Discord to check guild access, keeps Advance Raid Tools updated, and brings shared streams and raid recordings into one place.

• Your roster, presence, shared streams, and review information are available to authorized members of the relevant guild.
• You choose which public YouTube channel, individual video link, or Twitch channel to share with each guild. An unlisted video can be watched by anyone who obtains its link.
• Public YouTube channel sharing needs no Google account authorization. Personal provider viewing sessions and optional Twitch account credentials stay on your device. Shared channel and video identifiers are sent to Brick’s service.
• We do not sell personal data, use it for targeted advertising, or use Google/YouTube data to train AI models. This website uses no analytics, tracking cookies, or embedded players.

To ask about your data or request access, correction, export, or deletion, email brick@lusaggo.com. You do not need an active Brick account.

2. Who is responsible for your data

Brick is operated by Lucas Thoolen, based in the Netherlands. He is the data controller: the person responsible for deciding why and how Brick processes personal data. Contact him at brick@lusaggo.com.

This policy covers the Brick website, desktop app, and hosted service. It also covers information about people who do not use Brick but appear in a guild roster, shared recording, or raid report. References to “we”, “us”, and “our” mean Brick’s operator.

Guild members and officers decide what they contribute and how they use information available to their guild. They are responsible for their own uses outside Brick. This does not remove our responsibility for the processing described here. Connected services explain their own processing in their privacy notices.

3. What we access and why

• Discord identity and guild membership: your Discord user ID, display name, avatar, eligible guild memberships and roles. Brick uses Discord OAuth and guild information to sign you in, verify access, and show your guild roster. Guild roster information can include eligible members who have not opened Brick.
• Presence and profile: your last-seen time, Brick/addon version information provided by the app, and the display name or raid role you or an authorized officer set. These support the guild roster and readiness features.
• Streams and recordings: links you submit, provider and video/channel identifiers, titles, broadcast times, live status, available live viewer counts, and their association with your guild profile. These let guild members find streams and review recordings.
• Raid review: Warcraft Logs reports, encounter and pull times, character information and combat events you access through the integration; recording timing measurements and report clock corrections used to align perspectives.
• Device and settings: selected WoW folders, installed addon versions, app preferences, credentials, and review caches are stored on your device as needed. Brick accesses the WoW folders you select to install and update the managed addon package.
• Service and support information: network addresses and request information are processed to deliver and secure the service. Bounded operational logs may record errors and security events. If you email us, we receive your address, message, and any information you choose to include.

Content-based video alignment

In versions that support video alignment, Brick can prepare recent and visible recordings in the background while Warcraft Logs is connected, as well as when you open a recording. Brick reads the relevant report using your Warcraft Logs authorization on your device. It sends the service a complete, limited boss timeline: the exact report and fight identifiers, report start and fight bounds, boss and ability identifiers and names, boss cast events, and available boss health measurements. Player identities and player combat-event details are excluded from this upload. Your Warcraft Logs access and refresh tokens are not sent to Brick’s service.

The service compares this timeline with bounded temporary samples of the selected YouTube or Twitch recording to find the fight’s position without an on-screen timestamp marker. These samples can include visible names, chat, or other information present in the original recording. The uploaded boss timeline and processing job are encrypted and restricted to the requesting guild member. Verified recording-to-report timing is available to authorized viewers of that recording in the same guild, so they can reuse its alignment across pulls without uploading another boss timeline. This shared timing does not include another member’s uploaded cast or health events. Reuse assumes a continuous recording with a fixed offset; conflicting measurements disable that reuse. This feature does not add Google OAuth scopes or require you to stream video to Brick.

Where the information comes from

We receive information from you and your device; Discord’s identity and membership services; profile changes made by authorized members; Google/YouTube and Twitch channel and broadcast services; and Warcraft Logs reports uploaded by players. Sources include public channel information and content available only through a user’s authorization. A recording or combat report can contain information about participants who did not submit it themselves.

What you need to provide

Discord identity and membership checks are necessary to use Brick’s restricted features. Without them, those features are unavailable. You provide a WoW folder to use addon installation. Provider account connections, stream sharing, and support correspondence are optional; declining them does not prevent use of unrelated Brick features.

Brick does not sell personal data, use it for targeted advertising, or use Google/YouTube data to train AI models.

4. Why we may process personal data

Under the EU General Data Protection Regulation (GDPR), each use of personal data needs a legal basis. Brick relies on the following bases for the purposes identified below.

• Contract — Article 6(1)(b). Processing necessary to provide the services you request: signing you in, checking your guild access, delivering updates, saving your preferences, and providing your roster and raid-review features. This basis concerns the service provided to you; it does not establish a contract with other people appearing in a report or recording.
• Consent — Article 6(1)(a). Optional provider account connections and channel sharing. These are separate choices from Discord sign-in and acceptance of the terms. You may withdraw consent at any time; withdrawal does not affect the lawfulness of earlier processing.
• Legitimate interests — Article 6(1)(f). Protecting access, preventing abuse, investigating faults, recovering the service, answering enquiries, and maintaining an accurate guild roster and shared raid history. The latter can include limited information about non-users. We must balance these interests against the rights and reasonable expectations of the people concerned.
• Legal obligation — Article 6(1)(c). Complying with applicable duties, including handling data-protection requests and legally binding disclosure requirements.

You have a separate right to object to processing based on legitimate interests. Brick does not make solely automated decisions that produce legal or similarly significant effects. Automated Discord role checks determine access to guild features; contact us if you believe a check is wrong.

5. Provider sign-in and viewing sessions

The Video Player Sign In controls in Streams open the selected provider’s website inside Brick. This optional viewing session is separate from sharing a channel in Your streams. Signing in to watch a video does not register or share your channel.

Each provider has a separate browser session for your Brick account. Brick does not import cookies from your usual browser or send your personal viewing-session cookies to the Brick server or other members. Persistent viewing cookies are stored using Linux Secret Service or Windows DPAPI, without a plaintext fallback, so they can survive app restarts and updates until they expire or the provider revokes them. Session-only cookies remain in memory. The browser uses decrypted cookies in memory while playing videos or signing in. Sign out clears the selected provider session in Brick; it does not sign you out elsewhere or revoke a separate channel connection. Browser engines and operating systems can retain runtime artifacts.

The provider receives your sign-in and viewing activity and applies its own cookies, consent choices, account rules, advertisements, and subscription benefits. See the Google Privacy Policy and Twitch Privacy Notice.

6. YouTube channel access

Brick uses YouTube API Services for stream and recording discovery and the official YouTube player for playback. The features available depend on your Brick version. Manual video links do not require you to connect a Google account. This website does not sign you in, receive account connections, or have access to Brick’s application data.

Public channel and video sharing

In versions with public channel sharing, you can enter a public YouTube channel link, channel ID, or @handle in Your streams. You can also share an individual video or live-stream link. These features do not request Google OAuth permissions, identify channels through your Google account, or access private broadcast metadata. Brick does not upload, edit, or delete videos, manage subscriptions, or access Gmail.

Brick’s service resolves the channel and retrieves publicly available metadata using its own YouTube Data API key. This includes channel IDs and names, video IDs, titles, broadcast times, live status, visibility, and embedding availability. Public channel discovery checks recent uploads and may miss or delay live broadcasts. Unlisted broadcasts are not automatically discovered; you can share an unlisted video by providing its link.

What you share with a guild

You choose a channel or video separately for each guild. Its identifiers, link, and available metadata become visible to authorized members of the selected guild. Sharing a public channel does not prove that you own it. Unlisted links are not private once shared, and anyone who obtains one may be able to watch it outside Brick. Public channel discovery may continue on Brick’s service while your app is closed.

Where channel data is stored

The server stores the channel and video identifiers you share, available provider metadata, guild associations, and recording timing information to provide discovery and raid review, as described under storage and retention. Public channel sharing needs no personal Google access or refresh token. Optional viewing sessions are separate and are described under provider sign-in.

Earlier Google account connections

Earlier Brick versions offered channel discovery using Google’s read-only YouTube permission. That account-based discovery has ended. Update Brick to use public channel or video sharing. Updated versions automatically remove the obsolete saved YouTube channel credentials for your signed-in Brick account without using them to contact Google. This leaves your separate viewing session unchanged. A grant made in an earlier version may remain in your Google account until it is revoked. Removing locally saved credentials alone does not revoke the grant; you can remove Brick’s earlier authorization in Google Account permissions. Earlier versions stored those access and refresh tokens in Windows DPAPI or the Linux Secret Service keyring, separately from viewing sessions, and did not send them to Brick’s server or other guild members.

Playback and recording alignment

Loading a YouTube player connects your device to Google, which may receive your network address, device and playback information and use cookies under the Google Privacy Policy. Short video samples and frames may be processed temporarily to recognize an in-game timestamp or compare visible encounter information with the limited boss timeline described above to align a recording with a raid report. This public website loads no embedded players.

Limits on use and disclosure

Google/YouTube data is used for the features described above and their necessary operation and security. We do not sell it, use it for advertising or credit decisions, disclose it to data brokers, or use it to develop, improve, or train generalized AI or machine-learning models. Human access is limited to your specific agreement, necessary security investigations, or legal obligations. Brick’s use and transfer of information received from Google APIs is subject to the Google API Services User Data Policy, including the Limited Use requirements where applicable.

Stopping sharing and deleting data

Use Stop sharing in each relevant guild to remove its saved YouTube channel or current video link and stop further channel discovery there. Sharing an individual YouTube video also replaces the channel selection for that guild. These actions do not erase recording history, revoke an earlier Google authorization, or sign you out of the separate viewing session.

To request deletion of Google/YouTube data held by Brick, email brick@lusaggo.com. Your Discord ID or channel helps us find the records; you do not need to identify each one. You may request deletion of particular records or all data associated with your account, including shared links and historical records. Deleting Brick’s data does not delete the original content on YouTube. Applicable YouTube data-deletion requirements take precedence over the general retention criteria below.

7. Twitch channel access

You can share a Twitch channel by entering its link in Your streams. Where an optional account connection is offered, Twitch authorization lets Brick identify your own channel so you can select it. This connection does not request your email, subscriptions, chat history, or publishing permissions.

Account identifiers and names are read on your device. Access and refresh tokens use the operating system’s protected storage and are not sent to the Brick server. The channel you choose to share is sent to that guild; the service can then discover its live streams and recordings using its own Twitch credentials. Remove the channel to stop sharing it. You can review and revoke app permissions in Twitch Connections.

8. Who receives information

• Authorized members: people with access to the relevant guild panel receive its roster, shared streams, and review information. Access is restricted to that panel’s eligible members. Sharing an unlisted video does not make its provider link private.
• Hetzner Online GmbH: hosts Brick’s website and backend on the VPS in Germany. Hosting involves storing service data and processing connections needed to deliver it. Hetzner privacy information.
• Proton AG: hosts our privacy and support inbox. It processes email addresses, message content, attachments, and delivery information when you contact us. Proton Mail privacy policy.
• Cloudflare: provides domain and DNS services, which resolve the service’s address. DNS queries and related network information are processed by that infrastructure. The current Brick website and API connect directly to the VPS; email is delivered to Proton. Cloudflare privacy policy.
• Integrated services: Discord receives authentication and membership requests; Google/YouTube and Twitch receive channel, video, and playback requests; Warcraft Logs receives authorized report requests; GitHub receives update and release-download requests. Your device’s direct connections can disclose its IP address and technical request information to the service involved.

Lucas Thoolen administers the service and handles support, privacy requests, and necessary security investigations. Personal data may be disclosed to competent authorities or professional advisers where a specific legal duty or necessary legal claim requires it. We do not sell personal data or disclose private panel data to unrelated guilds or advertisers.

9. Where information is processed

Brick’s operator is in the Netherlands and its hosted service is on a VPS in Germany. Proton is based in Switzerland and states that Proton Mail stores data in Switzerland, Germany, or Norway. Germany and Norway are in the European Economic Area (EEA); Switzerland is covered by an EU adequacy decision.

Cloudflare and connected services operate internationally, including in the United States. Their involvement can therefore involve processing outside the EEA. A connection made directly to Discord, Google, Twitch, Warcraft Logs, or GitHub is also subject to that provider’s own privacy and transfer arrangements.

Where we arrange a transfer subject to GDPR restrictions, it must have a valid transfer mechanism, such as an applicable adequacy decision or contractual safeguards. Cloudflare’s data-processing addendum includes EU Standard Contractual Clauses for covered transfers. Contact brick@lusaggo.com for the arrangements relevant to your data and a copy of applicable safeguards, with confidential information redacted where necessary.

10. Security and retention

How information is protected

Connections to Brick’s service use HTTPS. Desktop credentials use Windows DPAPI or the Linux Secret Service keyring. Private review caches are encrypted separately by guild and account. Hosted guild data is protected by access controls and encryption, and recovery backups are encrypted. The running service must be able to process this information; these measures do not provide end-to-end encryption against the operator or a compromised host.

How long information remains

Retention depends on what the information is used for, whether that purpose still exists, your choices, and any legal requirement to keep or delete it. The current storage arrangements are:

• Presence. Last-seen entries have a 14-day cleanup threshold. Cleanup runs when further heartbeats are saved, so entries can remain longer in an inactive guild.
• Profiles and shared channels. Stored to maintain your guild profile and the sharing choices you have made, until changed, removed, or erased following a request.
• Recording history. Kept for shared raid review until removed or displaced by the current 10,000-entry limit per guild. That limit is a record count, not a maximum age. Removing a current stream or hiding a recording from the review screen does not erase its history.
• Recording alignment. Calibration and report-clock records use a 180-day cleanup threshold. Cleanup depends on later processing; some timing records and stored media timelines can remain longer. Temporary video samples and frames are normally removed when the analysis job ends.
• Content-based alignment jobs. The uploaded boss timeline is deleted when the job reaches a terminal state, or within 24 hours. Compact job tickets are retained for no more than seven days. Successful alignments are saved separately as compact encrypted timing and scope metadata for as long as the recording remains in Brick. The service checks the recording timeline and exact fight inputs before reusing them; removing the recording or erasing the source account removes its saved evidence. Saved results are not removed merely because their job tickets expire. Bounded temporary media samples and analysis evidence are erased when processing completes, is explicitly canceled, or the account is erased. Switching fights or closing the viewer stops local polling but can leave an already submitted bounded job running; returning to it reuses that job. These limits are separate from legacy recording calibration records.
• Guild VOD cleanup. Brick can use your connected Warcraft Logs account on your device to check whether an older recording has matching raid logs. The server receives only a check result and its own short-lived verification ticket, not your Warcraft Logs credentials, report codes, or report contents. After a recording has ended for 12 hours, three distinct currently authorized guild members reporting no matching raid logs can hide it from the guild’s recording list. Any current matching-log report keeps or restores it. Only completed checks count. Votes are encrypted separately for each guild and account, expire after seven days, and are removed by background cleanup. Hidden recordings remain eligible for rechecking; videos are not deleted from Twitch or YouTube.
• Local app data. Settings and caches remain on your device until cleared or removed. Signing out or uninstalling does not necessarily remove every local file. Optional provider viewing sessions are described above.
• Logs and support. Operational logs rotate by size. Support correspondence is retained to resolve your enquiry, handle relevant follow-up, and meet any applicable legal duty or need to establish or defend a claim.
• Recovery copies. Encrypted backups can retain earlier information until the relevant backup is retired. Access is restricted to recovery purposes; backups are included when we assess an erasure request.

There is currently no fixed maximum age enforced across all history, support correspondence, and recovery copies. The limits above describe how storage works; they do not authorize unnecessary retention. Information must be deleted or irreversibly anonymized when it is no longer needed, unless an applicable legal exception requires retention. You can request erasure without waiting for automatic cleanup.

11. Cookies and device storage

This public website uses no cookies, browser local storage, analytics, advertising trackers, or third-party embeds. Images and styles are served with the pages. Normal network information, including an IP address and request details, is still processed to deliver the site. The website has no access to Brick’s application data or credentials.

The desktop app stores settings and credentials needed for the features you use. Provider sign-in pages and YouTube or Twitch players can use separate cookies or similar technologies and receive device and viewing information. The website’s no-cookie statement does not apply to those provider services. Their privacy notices and consent controls explain their processing; accepting Brick’s terms is not consent to optional tracking.

12. Report a security concern

Email brick@lusaggo.com with the affected feature and steps to reproduce the issue. Please use an account and data you control, and keep reports involving private data out of public issue trackers. Do not send passwords, session cookies, or authentication tokens.

13. Your data-protection rights

You can exercise your rights by emailing brick@lusaggo.com. You do not need an active Brick account or a particular form. Describe what you want us to do and, if known, include your Discord user ID or another identifier that helps locate your data. We may request additional information only where necessary to verify your identity. Do not send passwords or session tokens.

• Access: ask whether we process your personal data, obtain a copy, and receive information about its use.
• Correction: have inaccurate information corrected or incomplete information completed.
• Erasure: have personal data deleted where the GDPR requires it, including when it is no longer necessary, is processed unlawfully, or consent is withdrawn and there is no other lawful basis.
• Restriction: ask us to limit use of your data in the circumstances set out in Article 18.
• Portability: receive data you provided in a structured, commonly used, machine-readable format where automated processing is based on consent or contract; request direct transfer where technically feasible.
• Withdrawal of consent: withdraw consent at any time, without affecting earlier lawful processing. You can also revoke access through your provider’s account settings.

Your right to object

You may object, on grounds relating to your situation, to processing based on legitimate interests. We must stop that processing unless we establish compelling overriding grounds or need it for legal claims. Brick does not use your data for direct marketing.

How we handle requests

Requests are normally free of charge. We respond without undue delay and within one month of receiving your request. Where the GDPR permits an extension because of complexity or the number of requests, we explain the reason within that month; an extension cannot exceed two additional months. If we refuse any part, we explain the reason and your complaint and judicial-remedy rights.

What deletion covers

A request concerns your personal data wherever Brick holds it, including historical records and recovery copies. Data in shared records is also considered; being part of a shared record does not remove your rights. Where necessary, we remove your identifying information while preserving information that is not about you. We notify recipients of required erasure, correction, or restriction unless this is impossible or involves disproportionate effort, and identify those recipients if asked.

If a specific legal exception requires us to retain information, we explain what remains, its purpose, legal basis, and retention period or criteria. A minimal record of a request or exclusion from re-import remains personal data; it cannot be treated as anonymous or retained for unrelated use. Signing out or uninstalling is not an erasure request. Deleting Brick’s copies does not delete the original accounts or content held by Discord, Google/YouTube, Twitch, or Warcraft Logs.

Complaints

You can complain to the Autoriteit Persoonsgegevens, the Dutch supervisory authority, or to the authority in the EEA country where you live, work, or believe an infringement occurred. You also have the right to seek a judicial remedy. You do not need to complete Brick’s support process first. The European Commission’s guide explains these rights in more detail.

14. Children and younger users

Brick is not directed to children under 13. Users must meet the age requirements of their country and each service they connect. Where processing relies on a child’s consent, permission from a parent or guardian is required below the applicable age of digital consent; in the Netherlands, that age is 16. Permission to use Discord or another platform is not, by itself, permission for Brick’s separate optional processing.

If you believe Brick holds a child’s information without the permission required by law, email brick@lusaggo.com so we can investigate and take the appropriate action, including deletion where required.

15. Rights outside the EEA

You can contact us about your data wherever you live. If UK data-protection law applies, you may also complain to the Information Commissioner’s Office. Other applicable local laws may provide additional rights, including a right to appeal a decision on a privacy request. Tell us where you live if it is relevant to your request; we will consider those rights as well. Nothing in this policy limits a right or remedy provided by applicable law.

16. Changes to this policy

The date at the top identifies this version. If we materially change the purposes, recipients, or other handling of personal data, we will provide appropriate notice before the change takes effect. Where a new use requires consent, we will ask for it before that use begins. An update to this page or continued use of Brick does not replace consent where it is required.