Privacy
This page says what data DistillNote handles when you visit it, and why. In short: no ads and no tracking of individuals. Accounts are optional, and the whole site works without one. Cookies are set only when you use the sign-in. Our hosting and our content delivery network see your IP address so the site can reach you, and we count page views without identifying anyone.
Who is responsible
Alexander Wöllner, Baumbachstraße 15, 81245 München, Germany. Email: [email protected]. Full details are in the Impressum.
When you visit the site
To send you a page, our servers and our content delivery network receive what every browser sends with a request: your IP address, the page you asked for, the time, and your browser's user agent. We use this only to deliver the site and keep it secure, for example against attacks. The legal basis is our legitimate interest in a site that works and is safe (Art. 6 (1) (f) GDPR).
We work with two processors, under data processing agreements:
- Hetzner Online GmbH, Germany: hosting, including the database for accounts. Our server is in Falkenstein, Germany.
- Cloudflare, Inc., USA: content delivery network, the secure connection to our server, and storage for our encrypted backups (in the EU). Cloudflare processes your request, including your IP address, and may do so outside the EU. Transfers to the USA rely on the EU-US Data Privacy Framework, under which Cloudflare is certified, and on the EU standard contractual clauses.
No ads, no tracking of individuals
DistillNote uses no advertising tools, and nothing that follows you across visits or other sites. Fonts and icons come from our own server, so your browser doesn't contact Google or any other third party to show them. If you don't use the sign-in, DistillNote sets no cookies.
Accounts
You can sign in with Discord, with Google, or with a link we send to your email address. You don't need an account to use the site.
What we store:
- an account id we create;
- your email address, if you sign in with Google or with an email link (with Discord we receive no email address);
- which ways of signing in you've linked (Discord, Google, email link), with Discord's or Google's id for your account there;
- your sessions: when each one ends;
- for 24 hours, a record of sign-in attempts, so we can limit how often someone tries: a coded form of the email address or IP address, never the address itself.
What we don't store: your name, your picture, a password (there is none), or any access token from Discord or Google. We can't act for you on Discord or Google.
We use your email address only for the sign-in link and to answer you; we send no other mail.
Email addresses and Discord or Google ids are stored encrypted. Session tokens and sign-in links are stored only as a code that can't be turned back into the token.
The legal basis is the contract you enter by creating an account (Art. 6 (1) (b) GDPR). For the record of sign-in attempts, it's our legitimate interest in protecting accounts against abuse (Art. 6 (1) (f) GDPR).
How long we keep it:
- your account data: until you delete the account;
- a session: 30 days after you last used it, or until you sign out;
- a sign-in link: 15 min, and it works only once;
- the record of sign-in attempts: 24 hours;
- our encrypted backups: 30 days. A deleted account disappears from the backups within 30 days.
On your Account page you can download everything we store about you (as a file), remove a way of signing in while another one stays, sign out on every device, and delete your account. Deleting takes effect at once.
Signing in with Discord or Google
When you choose Discord or Google, you sign in on their site, and they tell us that it's you. Discord and Google are responsible for what happens on their side; their privacy policies apply there: Discord, Google.
From Discord we keep only your Discord user id (we ask only for the permission to see who you are). From Google we keep your Google account id and your email address.
Sign-in links by email
If you ask for a sign-in link, we send it through Brevo (Sendinblue SAS, 17 rue Salneuve, 75017 Paris, France), which processes your email address and the message for us as a processor, under its data processing agreement. The mail is plain text, without tracking images.
Cookies
We set cookies only when you sign in or use a sign-in or account form. All of them are strictly needed for the sign-in you asked for (§ 25 (2) no. 2 TDDDG), so we don't ask for consent. None is used for tracking or ads.
| Cookie | What it's for | How long it lasts |
|---|---|---|
__Secure-authjs.session-token | Keeps you signed in. It holds a random token; we store only a code of it | 30 days after you last used the site, or until you sign out |
__Host-authjs.csrf-token | Protects the sign-in and account forms against requests from other sites | Until you close your browser |
__Secure-authjs.callback-url | The page to return to after you sign in | Until you close your browser |
__Secure-authjs.pkce.code_verifier | Secures the hand-over from Discord or Google back to us | 15 min, only while you sign in with Discord or Google |
dn-signed-in | Tells our pages you're signed in, so they ask our server about your account only then. It holds "1", nothing about you | 30 days; removed once our server sees you're signed out |
How we count visits
To see which pages are read and how fast they load, we use Cloudflare Web Analytics. A small script from Cloudflare runs when a page loads and sends Cloudflare the page you're on, the page you came from, your browser, operating system and device type, and how long the page took to load. Cloudflare works out your country from the request. It sets no cookies, stores nothing on your device, and doesn't use your IP address or browser details to recognise you; it counts page views and visits, not people. We see only totals. Cloudflare keeps the full data for 7 days and a reduced sample for up to six months. Cloudflare processes this for us as a processor, under the same terms as above. The legal basis is our legitimate interest in knowing which pages are useful and fast (Art. 6 (1) (f) GDPR).
The sim
The sim runs in your browser. Your export isn't sent to us and isn't stored.
Your faction choice
When you pick Alliance or Horde with the switch at the top, your browser stores that choice on your device (local storage, key "dn-faction"), so the site remembers it on your next visit. It never leaves your device, and we don't receive it. Nothing is stored until you use the switch. You can delete it by clearing your browser's site data for distillnote.com.
When you email us
If you write to [email protected], we use your email address and message only to answer you, and delete them when they're no longer needed for that. Our mailbox is hosted by Microsoft (Microsoft 365), which processes your email for us as a processor. Microsoft may process it outside the EU, including in the USA.
Your rights
You have the right to access the data we hold about you, to have it corrected or deleted, to restrict its processing, to data portability, and to object to processing based on our legitimate interest (Art. 15–21 GDPR). If you have an account, you can download and delete your data yourself on your Account page. Email us to use any of your rights. You can also complain to a data protection authority, for example the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA).
Last updated: 11 Oct 2026.