Privacy Policy

Who we are

POE2 Overlord is a companion web app for Path of Exile 2, operated by POE2 Overlord. We are not affiliated with, endorsed by, or sponsored by Grinding Gear Games. This policy covers the website and the optional helper daemon you can install on your own PC.

Questions about this policy or your data: support@poeoverlord.com.

Account information

Accounts are created with an email address and password, managed by Supabase Auth. There is no social or single sign-on login. We store your email address and use it to sign you in, to send password-reset links, and for occasional service notices. Email confirmation is not currently required to start using an account; if we turn it on, you will need to click a link we send you before your first sign-in. Passwords are handled by Supabase Auth and are never stored by us in readable form.

Your profile can also hold, all optional except the username:

• A username — required, and always publicly visible (see below)
• First and last name
• Your Path of Exile account name
• A timezone and an avatar image

The helper daemon — what it reads from your PC

The helper is optional software you choose to install on your own computer and authorise with an API key. Weonly ever store a SHA-256 hash of that key, never the key itself — but note the raw key is saved in the helper's own configuration file on your PC so it can authenticate, so treat that file as a credential and avoid sharing it. This is the part of the service that touches your machine, so here is exactly what it does:

• It reads the game's Client.txt log file, which Path of Exile 2 writes to your disk as you play.
• It checks your running-process list to detect whether the Path of Exile 2 client is open.
• When you explicitly queue a build for export, it writesa build file into the game's BuildPlanner folder.

It sends us:

• Zone changes — the zone name and its internal area id
• Level-ups — character name, class, and new level
• Deaths — character name
• Game running / stopped— including the game's process name and process id
• A periodic heartbeat that carries no data at all and fires even when the game is closed, so the site can show whether your helper is connected

Timestamps differ by event type: for the gameplay events above (zone changes, level-ups, deaths) the time is read from the log line itself and interpreted in your computer's local time, whereas game running/stopped carries the moment the helper observed the change, and the heartbeat carries no timestamp at all.

One honest disclosure: when the game connects to a realm, the log line contains the game server's IP address and port, and the helper transmits it as part of that event. Our service discards it— it is never written to any table and is not used for anything. It is your game server's address, not yours.

The helper reads nothing else. It does not read your chat, your keystrokes, your screen, your other files, or anything outside the game log and the process list. It does not read or upload build files from your disk — the build export channel only sends data to your machine, never from it. You can uninstall it or revoke its API key at any time from your account page, and the website works without it.

What you create in the app

Characters, levels, zone and playtime statistics, notes, builds, walkthroughs, and crafting recipes are stored against your account. Builds, walkthroughs, and crafting recipes are private by default — they are only shared if you choose to publish them.

What other people can see

Your username and avatar are always public. They appear anywhere your content or activity is shown, and there is no setting to hide them — if you do not want a name visible, choose a username accordingly.

Your Path of Exile account name and character statistics (character count, highest level, active character) can appear on your public profile tooltip. You can switch both off under Account → Profile, using “Hide Path of Exile account name” and “Hide character stats”.

Anything you mark public — a build, walkthrough, or crafting recipe — is readable by anyone, including visitors who are not signed in. Public builds can also be cloned by other users into their own accounts.

Analytics

We use Vercel Web Analytics and Speed Insights, which are cookieless and do not track you across other websites. They give us aggregate page-view and page-performance data.

Google Analytics 4 is integrated but not currently switched on. It can only run on the live production site once a measurement ID is configured — it never runs on preview or development deployments. While it is off, no Google analytics script loads and no analytics cookies are set. We will update this policy and our Cookie Policy before switching it on.

Error monitoring

We use Sentry to receive error reports, performance traces, and server profiles so we can fix crashes. It is configured conservatively:

• Automatic collection of personally identifying request data is switched off.
• You are identified to Sentry by your opaque account id only — never your email address or username.
• There is no session replay. We do not record your screen or your clicks.
• Server error reports deliberately exclude local variable values, because some code paths handle raw API keys.
• Browser error reports are proxied through this site's own domain rather than being sent to Sentry directly.

If you submit the in-app feedback form, the message you write — and any name or email you type into it — is sent to Sentry along with the report.

Advertising

No advertising network is currently loaded on this site and no ad cookies are set. Reserved ad placements exist in the layout but render nothing.

If we enable advertising (Google AdSense, shown only to free-tier accounts), it will set advertising cookies and may personalise the ads you see. Google's own explanation of this is at How Google uses information from sites that use our services. Paid tiers do not see ads.

Other services your browser contacts

Some images are served from third parties: game item icons from Path of Exile's content network, and news thumbnails from external sites. Those hosts see your IP address as part of delivering the image. They do not receive your account details, and we do not embed third-party scripts for this.

Logs and abuse prevention

We read your IP address from the request headers to apply in-memory rate limiting. It is not stored in our database. Our hosting provider keeps its own operational request logs, as any web host does.

Who processes your data

• Supabase — database and authentication
• Vercel — hosting and cookieless analytics
• Sentry — error and performance monitoring

We do not sell your personal data.

Retention and deleting your account

We keep the data in your account for as long as the account exists. While your account is active you can delete it yourself at any time from the danger zone on your Account page — you confirm by typing your own username. This is a hard delete: your authentication record is removed and every row you own cascades with it, including your characters, statistics, notes, builds, walkthroughs, and recipes.

If your account is deactivated or banned, that self-serve control is not available to you — moderated accounts are signed out of the account page and blocked from making changes. Your right to erasure is unaffected: email support@poeoverlord.com from the address on the account and we will delete it for you.

Two caveats worth stating plainly rather than burying:

• If another user cloned a build, walkthrough, or recipe you had published, their copy belongs to their account and remains after you delete yours.
• Deletion covers your account and application data. It does not reach records already held by the processors above — Sentry error reports and any feedback you submitted, and our host's operational request logs — which age out on those providers' own retention schedules, nor routine encrypted backups, which expire on their own cycle. If you need those purged too, email us and we will ask the provider.

Security

Database row-level security enforces the visibility rules described above: your private rows are readable only by you, while the things this policy calls public — your username and avatar, and anything you choose to publish — are readable by others by design, not by accident. Passwords require at least 12 characters with upper-case, lower-case, and numeric characters. Your access token expires after an hour and is renewed with a rotating refresh token — the sign-in itself lasts until you sign out, so you are not logged out hourly. Helper API keys are stored only as SHA-256 hashes and can be revoked by you at any time.

Children

This service is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has created an account, contact us and we will remove it.

Your rights

Depending on where you live, you may have the right to access, correct, export, or erase your personal data, and to object to or restrict certain processing. For an active account the self-serve deletion above covers erasure; if it is unavailable to you — including because your account is deactivated or banned — or for any other request, email support@poeoverlord.com.

Changes to this policy

We will update this page when our practices change and move the “last updated” date above. Material changes — in particular, enabling analytics or advertising cookies — will be reflected here before they take effect. This policy is governed by the laws of the United States.