Privacy notice
Updated 9 September 2026 · 2026-09-09-WP2R1
This notice explains how DevD2 handles information across devd2.com, account.devd2.com, the DevD2 launcher and our game realm. Reading it is not blanket consent to unrelated uses of your information.
Who is responsible
DevD2 is the public name of this independent UK fan project and is the service responsible for the information described here.
For a private conversation with DevD2 staff, use the DevD2 Discord. State that your message concerns privacy, without posting account credentials or other sensitive information in a public channel. A game restriction does not remove your privacy rights. You do not need to use a particular form or legal terminology to make a request; requests received through another available contact route will also be considered.
Blizzard and Project Diablo 2 are separate from DevD2. Following an external link takes you to a service with its own privacy arrangements.
Information used for accounts and the realm
When you register or claim an account, we receive your realm account name, email address, game password, account type and confirmation that you agree to the rules and have read this notice. For applications submitted using this version, we record the rules/terms and privacy-notice versions, acknowledgement timestamps, account status, the selected realm and technical registration details such as browser information and a protected IP-derived identifier.
The account platform stores email addresses encrypted, together with an email hash used for matching. The password needed for account creation or claiming is encrypted while it awaits the private realm agent. Authorised server code must decrypt it to complete that operation. The pending account field is cleared after successful provisioning or claiming; related job or backup records may remain until reviewed. Encryption does not make this information anonymous.
The legacy game server uses its own account and password-verification records. Its compatibility limitations include case-insensitive passwords. Use a unique game password, not the password for your email or another service.
The realm also holds characters, inventories, shared stash and gold, progression, game activity and connection records. Account pages can show character names, classes, levels and recent activity. Other players can see information the game exposes, such as your account or character name, chat and actions in shared games.
Launcher, device and preference information
Approving a launcher links a device record to your account. This includes a device identifier, the device name supplied by the launcher (normally the Windows computer name), approval and use timestamps, a token hash, connection information and the launcher version, client version and release-manifest hash used for launch checks.
We store graphics and loot-filter preferences that you choose to save, including the selected profile, filter identifier and level, and custom filter name or checksum where supplied. The launcher also keeps local settings, installation paths and protected sign-in credentials on your own computer.
Release checks examine the game files needed to install, repair and verify DevD2. The supplied launcher is not a general-purpose scan of your documents or browser history. If you choose a third-party filter or send us a diagnostic report, the information involved depends on that action; review a report before sharing it.
Connection, email and support records
Cloudflare receives technical request information when serving and protecting these websites, including IP addresses and browser/request details. Turnstile performs anti-abuse checks. The account application keeps security, rate-limit and audit records; hashing an IP address reduces direct exposure but does not make a linked record anonymous.
Resend receives the email address, subject and message content needed to deliver verification and sign-in messages and provides delivery/error information. Project administrators receive the contents of support messages you choose to send. Email links and approval codes are credentials: do not share them publicly.
Discord support and appeals
If you use Discord to contact DevD2, staff may see your Discord name and user ID, messages, attachments, account name and the information you provide about a report or appeal. We use the relevant material to answer you, investigate the issue and record the moderation decision. Keep unrelated personal information out of reports.
Discord provides its own platform and processes information under its privacy policy. A message to staff is not the same as a public channel post, but neither should be used to send passwords, verification links, API keys or launcher tokens. Review Discord’s privacy controls before sharing.
Why we use it and our legal bases
Providing the requested service — contract:
setting up or linking your account, authenticating you, connecting your approved launcher to the realm, keeping character progression and applying preferences you ask us to save.
Protecting and maintaining the service — legitimate interests:
preventing abuse, investigating faults and rule breaches, controlling access, protecting other players, maintaining backups and answering support requests. Our interests are a secure, reliable and fair community service. We consider the impact on individuals and limit access to what the task needs.
Legal obligations:
handling valid legal requests or complying with applicable data-protection duties where required. We do not use the registration acknowledgements as consent to advertising or to an unspecified future use of your data.
Account details and the required security checks are necessary to use the account service. Without them we cannot create or link the account. Optional support material and custom preferences are your choice.
Who receives information
Access is limited to the project administrator and any authorised people who need it for support, moderation or operation. Hosting and security are provided by Cloudflare; transactional email is provided by Resend. The private realm agent transfers account operations to the selected game server.
Discord, external filter sources, linked sites and the email provider you use process information under their own policies. Discord is a separate service provider, not the operator of the DevD2 realm. We do not sell account information or use it for targeted advertising. Disclosure may also be necessary for a valid legal requirement or to protect people and service security.
International processing
Cloudflare and Resend operate internationally, so service data may be processed outside the United Kingdom. Their data-processing terms provide transfer mechanisms, including standard contractual clauses and UK provisions where applicable. Information about the safeguards applicable to DevD2’s arrangements can be requested through the privacy contact.
Provider information:
Cloudflare data-processing terms
and
. A provider’s general terms are not a promise that every record remains in a particular country. For information you choose to send through Discord, its own privacy policy explains its international processing arrangements.
How long information is kept
Verification links are usable for 30 minutes and require confirmation on the website; email sign-in links and launcher approval codes for 15 minutes. A website session normally lasts 30 days, subject to the configured session duration and revocation. Device authorisation remains until revoked in the current implementation. Expiry of a link or session is not a promise that its database or log record has already been deleted.
Account, character and preference records are kept while needed to provide the account service. After closure, we assess what can be removed and what limited information is still needed for an unresolved support request, security investigation, restriction or legal duty. The reason, age and necessity of a retained record determine that assessment, rather than a promise to keep every record indefinitely.
Support and appeal records, security logs, delivery records, expired tokens and completed jobs are reviewed for removal when they no longer serve troubleshooting, abuse prevention or an outstanding issue. Backups are handled separately from the active account database and may retain historical records until replaced or removed. We do not represent token expiry as an automated deletion schedule. Contact us for an account-specific retention or erasure request.
Your rights and choices
Depending on the circumstances and applicable law, you may ask for access, correction, erasure, restriction or a portable copy of your information. We may need proportionate evidence that you control the account before acting; never send us your game or email password as that evidence.
You can object to processing based on legitimate interests.
Contact the controller privately using the privacy contact route above and explain which use concerns you. We will consider your request and explain any reason we need to continue a particular use.
You may also ask for a human review of an access restriction through the DevD2 Discord. Privacy requests are separate from moderation appeals; a game or community restriction does not remove your data-protection rights. Automated checks can refuse registration, verification or launch because a challenge fails, a link expires, an account is restricted or a release does not match. These are service-access checks, not an assertion that you cheated; contact us when a result appears wrong.
You have the right to complain to the UK Information Commissioner’s Office at
, or to your local supervisory authority where applicable. Contacting DevD2 first may help resolve a problem but is not a condition of making a complaint.
Cookies and local storage
The account website uses an essential
devd2_session
cookie to maintain sign-in. Turnstile and Cloudflare may use technical storage needed for protection. The guide’s filters use page memory and URL query parameters. The launcher keeps local installation and preference settings on your computer.
This release does not add advertising or optional analytics trackers. Essential authentication and security processing is explained here rather than hidden behind a marketing-consent checkbox. See the cookies and local storage notice for details.
Young users and changes
DevD2 is not designed or promoted as a service for children. Observe the original games’ age restrictions and contact us before registering on behalf of a child. We do not ask for a date of birth on the current form. A parent or guardian with a concern about a child’s information can use the privacy contact.
We update this notice when the service or its handling of information changes. The date and version identify the text shown to new applicants. Acknowledging that you have read it does not waive your rights or authorise unrelated marketing.