Privacy Policy
GW2 Price Alert – price alerts for the Guild Wars 2 trading post
Last updated: 8 October 2026
In short
There is no user account. No name and no email address are asked for, no password and no Guild Wars 2 account. What is stored is what the purpose requires: an address a notification can be delivered to, and the alerts that have been set.
There is no advertising, no analytics or tracking services, no user profile and no sharing of data for advertising purposes.
All data can be deleted at any time in the app: below the alert list, in the section This device, with the Delete all data button. The details are in section 8.
Everything else is set out below.
1. Controller
Controller within the meaning of the General Data Protection Regulation (GDPR):
Markus Rath
Elversweg 72a
21037 Hamburg
Germany
Email: m.rath@posteo.de
No data protection officer has been appointed; the conditions of Art. 37 GDPR do not apply to a private, non-commercial service of this size.
2. What data is processed
2.1 On the server
| Data | Where it comes from | What it is needed for |
|---|---|---|
| Device ID – a randomly generated identifier (UUID) | assigned by the server | Links the alerts to the device. It replaces the user account and is pseudonymous: no name, email address or game account is attached to it. |
| Push token from Firebase Cloud Messaging | from Google, via the operating system | The address a notification is delivered to. Without it there is no push notification. |
Language setting (de or en) |
from the app | The notification is composed on the server, which needs to know the language. |
| Time of registration and of last use | set by the server | Running the service and clearing out stale entries. |
| The alerts that have been set: item, type of alert, threshold, on/off, time created and time last triggered | entered in the app | This is what the app is for. |
| IP address | technically present on every connection | To limit the number of requests per address so that nobody can overload the service. For that it is held in full only in memory – usually for one minute, and for at most one hour when a new device registers. It reaches the access log only in shortened form, see 2.3. |
2.2 On the device only
The following is stored locally. Beyond what is listed in 2.1, none of it is transmitted:
- the device ID and the push token,
- the chosen language,
- whether the notice on first launch has been shown,
- the alert list as last loaded, so that it can be shown without an internet connection.
In addition, the Firebase SDK included in the app stores its installation identifier on the device (see section 4).
This data is excluded from Android's backup and is not carried over when moving to a new device. On a new device the app therefore registers afresh; the alerts of the old device do not move with it and have to be set up again. The old device's entry is removed in the ways described in section 5.
Uninstalling the app removes all of it.
Storing this information on the device and reading it back is strictly necessary for the service the user has expressly requested, and is therefore permitted without consent under Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG).
2.3 Server access log and visits to this website
For every request to the server – from the app as well as when this website is visited – the server writes one line to its access log: time, method, requested address including any search term, status code, duration, amount of data and source port, together with the IP address in shortened form – for IPv4 without the last block, for IPv6 only the first 48 bits. Request headers are not stored, so neither the app's device ID nor the browser identifier (user agent). If the address contains the number of an alert, it is made unrecognisable before the line is written. A line therefore cannot be attributed to an individual device or connection.
The log serves troubleshooting and protection against abuse. Its size is limited and it is overwritten after a few days.
The website sets no cookies, uses no local storage and loads nothing from third-party servers – no fonts, no scripts, no embedded content.
2.4 What is not processed
Name, email address, password, Guild Wars 2 account or API key, location, contacts, calendar, advertising ID, device model, crash reports, usage statistics.
3. Purposes and legal bases
| Processing | Purpose | Legal basis |
|---|---|---|
| Device ID, push token, language, alerts | Providing the function requested by installing the app: watching prices and sending notifications | Art. 6(1)(b) GDPR – performance of the user agreement |
| IP address for rate limiting | Protecting the service against overload and abuse | Art. 6(1)(f) GDPR – legitimate interest in undisturbed operation |
| Access log with shortened IP (2.3) | Troubleshooting, protection against abuse | Art. 6(1)(f) GDPR – legitimate interest in secure and undisturbed operation |
| Time of registration and of last use | Detecting and deleting unused entries (section 5) | Art. 6(1)(f) GDPR – legitimate interest in keeping nothing longer than necessary |
| Daily database backup (section 5) | Protection against data loss | Art. 6(1)(f) GDPR – legitimate interest in reliable operation |
Providing this data is required neither by law nor by contract. Without a push token, however, no notification can be delivered – and that is the app's only purpose.
4. Who else gets to see the data
Nothing is sold, and nothing is shared for advertising purposes. Three third parties are involved on the technical side:
manitu GmbH, Welvertstraße 2, 66606 St. Wendel, Germany, provides the server the service runs on (see section 6). manitu processes the data there solely on behalf of the controller; a data processing agreement under Art. 28 GDPR is in place.
Google (Firebase Cloud Messaging) delivers the notifications. In doing so, Google receives the device's push token and the content of the message – the item name and the price reached. The Firebase SDK included in the app also creates an installation identifier (Firebase Installation ID), which Google uses to manage the push token; it goes to Google only, not to this service's server.
Google acts as a processor under Art. 28 GDPR. This is governed by the Firebase Data Processing and Security Terms, which form part of Firebase's terms of service.
This involves a transfer to the USA. It relies on the European Commission's adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework: Google LLC is certified under that framework. The current status of that certification can be checked in the public list at https://www.dataprivacyframework.gov.
Google's privacy policy: https://policies.google.com/privacy
ArenaNet / NCSOFT operates the official Guild Wars 2 API that the price and item data comes from. Those requests are made by the server alone, not by the device — including the item icons: the server fetches each one once, stores it, and serves it itself from then on. The device's IP address never reaches ArenaNet. ArenaNet's privacy policy: https://www.arena.net/en/legal/privacy-policy
Whichever app store the app was obtained from is operated by its respective provider and is outside the controller's influence.
5. How long the data is kept
- Alerts stay until they are deleted in the app.
- A device entry disappears in one of three ways:
- By deleting it in the app, in the This device section.
- By uninstalling the app. Google then reports the push token as invalid the next time a notification would be sent to that device, and the entry is removed automatically. If the device has no alerts, no notification is ever sent; then way 3 applies.
- After 365 days without contact it is deleted automatically, along with the alerts attached to it. Opening the app counts as contact, and so does every delivered notification – so this does not happen while the app is in use.
- Backups: once a day a backup of the database is made. It is kept for 14 days on the server and for 60 days on storage belonging to the controller in Germany, then deleted. Anything deleted in the app, or removed after the periods above, is therefore gone from the backups after 60 days at the latest.
- IP addresses are held in full in memory only and are gone within an hour at most, at the latest when the service restarts. The access log with shortened IPs (2.3) is overwritten after a few days.
- Price and item data from the trading post is not personal data. The price history is deleted after 30 days; the item catalogue stays.
6. Where the data is stored
The service runs on a rented server of manitu GmbH in Germany (see section 4), which the controller sets up and administers personally. The backups are also kept on storage belonging to the controller in Germany (see section 5). No data is stored anywhere else. The one exception is the delivery of notifications, which technically goes through Google (see section 4).
7. Permissions on the device
Exactly one permission is asked for: notifications (required on Android 13 and later). Without it the core of the app does not work – alerts can be created but not delivered. No other permissions are requested.
8. Rights of data subjects
Under the GDPR there are rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on a legitimate interest (Art. 21).
Deleting everything is possible directly in the app. Below the alert list there is a section This device with a Delete all data button. It removes that device and every alert attached to it permanently from the server – from the backups after 60 days at the latest, see section 5 – and clears what was stored locally as well. Afterwards the app is in the same state as immediately after installation – with one exception: the Firebase SDK's installation identifier (section 4) remains on the device and with Google until the app is uninstalled. Individual alerts can be deleted straight from the list.
For access and the remaining rights: because no user account is kept, the controller cannot identify the data subject unaided – the data is linked solely to the random device ID. Under Art. 11(2) GDPR, access is therefore only possible if that identifier is provided. It appears in the same This device section, together with a button that copies it to the clipboard. The same way – informally by email, quoting the device ID – applies to rectification, restriction and data portability; the data concerned is then provided in a structured, commonly used and machine-readable format.
Objection (Art. 21 GDPR): informally, to the contact address given above, quoting the device ID. No reason need be given. It concerns the processing that rests on a legitimate interest: rate limiting per IP address, the access log, the time of last use and the backups (section 3). Everything else rests on Art. 6(1)(b) and ends as soon as the data is deleted; the button in the app is enough for that, and no message to the controller is required.
There is also the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority responsible for the data subject's place of residence.
9. What does not happen
- No advertising and no ad networks.
- No analytics, statistics or tracking services.
- No crash or usage reports to third parties.
- No profiling and no automated decision-making within the meaning of Art. 22 GDPR.
- No selling or renting of data.
10. Changes to this policy
If the app changes, this policy is updated. The version bearing the date given above applies.
Note about the game
Unofficial fan project, not affiliated with ArenaNet or NCSOFT. Guild Wars 2 and associated marks are property of the NCSOFT Corporation.