Website delivery and server logs

When you access the service, the web and API servers process connection data required to deliver and secure it. This can include your IP address, date and time, requested URL, referrer, browser and operating-system information, response status, and technical security events.

Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, provides content delivery, DNS, and security services as a processor. Cloudflare may process IP addresses, routing data, and request metadata and may set strictly necessary security cookies when a security challenge requires them. Processing is based on Art. 6(1)(f) GDPR and the legitimate interest in providing a reliable and secure service. Log data is retained only for as long as required for operations, security, abuse prevention, and legal claims, then deleted or anonymised.

Cloudflare participates in the EU–US Data Privacy Framework and also provides the EU Standard Contractual Clauses for relevant international transfers. See Cloudflare's Privacy Policy.

Public website and API

The public website requests price, league, item, and chart data from api.poe.watch. If you use account or character search, the entered account or character name is sent to that API to return the requested public result. Requests may be included in the technical logs described above. The legal basis is Art. 6(1)(f) GDPR and the legitimate interest in providing the requested information.

Item artwork is loaded from web.poecdn.com, operated for Grinding Gear Games. Loading an image causes your browser to send connection data, including your IP address and request metadata, to that service. The purpose is to display the requested Path of Exile item artwork; the legal basis is Art. 6(1)(f) GDPR. See Grinding Gear Games' Privacy Policy.

Connected Path of Exile account

Connecting an account is optional. If you choose to connect, you are redirected to Grinding Gear Games and asked to authorise the scopes account:profile, account:stashes, account:leagues, and account:characters. poe.watch then processes your Path of Exile account identifier and name, leagues, character and stash metadata, selected stash contents, groups, holdings, snapshots, and tracking-session settings to provide the app.

OAuth access and refresh tokens are encrypted at rest and used only server-side. The legal basis is Art. 6(1)(b) GDPR because this processing is necessary to provide the connected features you request. Disconnecting the account removes OAuth credentials and active sessions. Existing snapshot history is retained until you delete the relevant group or ask for erasure.

Snapshot summaries are retained as history. Detailed item rows are limited to the latest 20 snapshots per group, plus a protected active-session baseline. Current holdings are replaced by the latest successful capture. Data is otherwise retained until you delete it, disconnect where applicable, request erasure, or retention is required for legal claims.

Cookies and browser storage

The service does not use advertising or analytics cookies. The connected-account app uses only storage required for authentication and the feature explicitly requested by the user:

poe_oauth_transaction — Protects and completes the OAuth login flow — 5 minutes

backend_session — Authenticates the connected-account session — 30 days

poe-watch:profit-session — Local browser storage used to restore an active tracking-session view — Until the session is cleared or browser storage is deleted

The cookies are HttpOnly and SameSite=Lax; in production they are also Secure. Consent is not requested because this storage is strictly necessary to provide authentication or a feature expressly requested by the user (§ 25(2) no. 2 TDDDG).

Recipients and transfers

Data is disclosed only where necessary to hosting and infrastructure providers, Cloudflare, Grinding Gear Games when you request assets or connect an account, professional advisers, or public authorities where legally required. Some providers may process data outside the EEA. Where required, transfers rely on an adequacy decision, the EU Standard Contractual Clauses, or another lawful safeguard.

Your rights

Subject to the applicable conditions, you have rights of access, rectification, erasure, restriction, data portability, and objection. Where processing relies on consent, you may withdraw it at any time for the future. To exercise your rights, email mail@poe.watch.

You may also complain to a data-protection supervisory authority. The authority responsible for the controller is the Hessian Commissioner for Data Protection and Freedom of Information.

Controller and contact

The controller responsible for this service is Mark Wetter, Röhrborngasse 54, 60388 Frankfurt am Main, Germany. You can contact the controller at mail@poe.watch.

This notice applies to poe.watch, api.poe.watch, and app.poe.watch.