Privacy

Who is responsible

AionCore is an independent project run by one individual, Guilherme Filvoch, who is responsible for the site and the app. Under the LGPD (Law No. 13,709/2018), he is the controller of the personal data processed by AionCore and also the person who handles requests about it, acting as data protection officer. The channel is the contact email below.

What the site collects

The site is made of ready-made pages. It does not use third-party statistics or advertising tools and does not load scripts, fonts or images from other sites. The pages you read (home, download, accuracy, questions, privacy, terms and contact) do not set cookies and have no forms.

Cloudflare, the company that hosts the site, receives the technical data of each visit, such as the IP address, the browser and the page requested, to deliver the pages and protect the site against attacks. It handles that data under its own privacy policy. The site itself does not keep any of it, and the author does not use that data to identify visitors.

The installer is downloaded from GitHub, where the public AionCore updates channel is. When you click to download, your browser talks directly to GitHub, which receives your IP address and handles that access under its own privacy policy.

Online counter: while a page of the site is open and visible, it tells the AionCore server, every 5 minutes and when it is closed, that someone is there. It sends only a random code that exists just for that open page (it is not stored in the browser, it is not a cookie and it changes with each page) and the word "site". The server keeps only an irreversible summary of that code together with the day, without the code itself, without the IP address and without the page visited, deletes everything within 1 hour and uses it only to show how many people are online. If your browser has the Do Not Track signal turned on, the page sends nothing.

Site language: when you choose a language in the site's language selector, your browser stores only the code of that language (for example, "en") in the browser's local storage, so the site opens in that language next time. This code stays only in your browser: it is not a cookie and it is not sent to the AionCore server. The "System" option of the selector deletes the choice, and so does clearing the site's data in your browser.

What the app does

The app (the HUD, the guide and AionCore Meter) runs on your PC and works without signing in. Linking the meter to a site account is optional; once linked, uploading boss fights starts on and you turn it off whenever you like (see Account and login and Fight upload).

What is stored on your PC

AionCore stores what it produces in files inside its own installation folder (by default, %LOCALAPPDATA%\Programs\AionCore). They include the settings, the fight history, the field boss times, the Odyle energy you note down, the monsters already seen, the activity records (logs), a copy of the skill icons, the window data and the update state.

For each fight, the history stores the name, class, server and numbers of every player who hit the target, including other players. The meter also remembers the name, class and server of your last character in the settings. Since version 1.1.0, the logs mask the character name.

If you turn on Record packets, or mark a moment with Developer mode on (both in Settings › Help and diagnostics), recordings of the game's traffic are also stored in that folder, with the players' names. Moments store the game's full traffic, including chat, shop and the game account; with Developer mode on and the option Save automatically when the meter goes blind checked, the meter saves a moment on its own when it stops reading hits. Record packets records only combat, entities and timers, unless you turn on Record all traffic, which also stores chat, shop and the game account. Record packets, Record all traffic and Developer mode are off by default.

Copy summary puts the text of a fight on the clipboard, with the players' names (shuffled, if Hide names is on), and Export fight, in History, saves the whole fight, with the names, in a .aioncore-luta.json file. Both only act when you click.

Those files stay under your control: in Settings › History › Keep history for you choose how many days fights are kept, and when you uninstall, AionCore asks whether to delete your data too (the default answer is to keep it).

With the site account linked, the meter also stores in its folder the queue of fights waiting to be uploaded, the record of fights already uploaded and the key that links it to your account, protected by Windows. Disconnecting, in Settings › Account and site, deletes the queue, turns off uploading and forgets the key.

What the app reads

The meter uses Npcap to read, on your PC, the network traffic that Aion 2 already receives. It only reads: it does not change game files or memory. Your character's name comes from the game window title.

What talks to the internet

• Skill icons: the meter downloads the images from the game's CDN, from NCSOFT (assets.playnccdn.com), and keeps a copy in its folder. NCSOFT receives your IP address when an icon that is not yet stored is downloaded.
• Updates: the HUD and the meter query the public AionCore updates channel on GitHub, and GitHub receives your IP address with each query. By default, when there is a new version, AionCore downloads and installs it on its own; that automatic installation never happens while Aion 2 is open, and clicking Update now installs it right away, even with the game open. To turn it off, use Settings › About › Update automatically: when it is off, AionCore only checks and updates when you click Check now or Update now.
• YouTube: the HUD's YouTube window only opens when you ask. Inside it, YouTube's own rules apply, with Google's policies; if you sign in there, the login is kept only in that window, on your PC.
• Guide: the guide's video panel shows thumbnails and plays videos through the YouTube player (youtube-nocookie.com), so YouTube and Google receive your IP address. Video search inside the guide only works if you paste a YouTube API key of your own; then the searches go to Google. The key, if you paste it, and the list of videos you watched are kept in the HUD's local storage (the dados-hud folder), on your PC.
• Addresses of other sites, in the guide and in the installer notices, open in your browser, only when you click.
• Third-party components: the meter's windows use WebView2, from Microsoft, which is maintained and updated by Microsoft itself, under its own rules.
• Feedback: if you send a message from the meter, the AionCore server receives the text you write, the title and the rating, if any, the contact you enter (optional) and basic technical data (meter and Windows versions, language, game region and server, chosen visual and whether capture was active). The server forwards this to a private Discord room (a company in the US), where the author reads it; the installation code stays on the server only as an irreversible digest, for 3 days, to limit abuse. It only leaves when you click send. Do not write anything you do not want the author to see; to have a message deleted, ask through the contact.
• Applicant card (supporters only, with an option to turn it off in the meter's Settings): when someone asks to join your party, the meter, linked to your site account, sends the AionCore server that character's name and the game server they are on, only to find the profile that person keeps public on AionCore and show a summary on the card. If the person has no account, has turned the profile off or has hidden their name, nothing shows, and the site does not say which it was. For the person looked up, turning the profile off or hiding the name takes effect within a few minutes: the site always answers with the current state, and the meter of whoever leads the party keeps each answer for up to 10 minutes. The AionCore server does not store the name or the game server it was asked about; it only counts how many lookups your account makes per minute, to limit abuse.

No fight leaves your PC unless you connect the meter to a site account.

The Diagnostic package and Export for analysis, in Settings › Help and diagnostics, only save a .zip file in your PC's Downloads folder. The package replaces the character names the meter knows and checks the result; if a known name is left, the file is not created. The export does the same with the players' names, unless you choose to export without replacing them. Whether to send that file to someone is up to you.

Anonymous technical reports

AionCore Meter sends the AionCore server an anonymous technical report when it opens and then every hour. It carries the meter version, a random installation code (which does not identify you or your PC), the Windows and .NET version, whether the meter is open as administrator and for how long, the capture state (counters such as lost packets and hits read, numbers only), the count of the game packet types the meter saw (numbers only), the type and time of some capture events, such as the meter having stopped reading hits, the type of the program's errors (the technical name of the error and a code for the point in the program where it happened) and, for packet types the meter does not understand yet, statistics made only of numbers: the sizes, how many arrived during a fight, how often they come and whether they tend to come right before or right after packets the meter already knows, such as a hit or a death. While the meter is open, it also sends every 5 minutes a signal with only that random code and the word "app", to count how many people use AionCore at the same time, and it tells the server when it is closed. The server keeps only an irreversible summary of that code together with the day, without the code itself, and deletes everything within 1 hour.

The reports do not include character names, chat messages, your fights, file names or the text of error messages; from the contents of packets, only the optional samples described further below are sent. The server sees the connection's IP address only to limit abuse and does not store it in the database.

They are used to find out what changed after a game update and to fix the meter. When a new packet type appears, or the meter stops reading hits, the server may notify the author in a private Discord room, with a summary line and no personal data; once a day it posts there a summary with totals only, such as how many installations sent a report and which versions.

The reports and the per-packet-type statistics of each installation are kept for 30 days and then deleted automatically; only a summary per packet type, without the installation code, is kept with no time limit. To delete your installation's reports sooner, send through the contact the code that is in the site-telemetry.json file, in the meter's folder; deleting that file makes the meter create a new code. They come turned on by default: the meter lists this on first launch; the full text is in Settings › Privacy, next to the switch. To turn them off, open the meter's Settings and turn off the Anonymous technical reports switch; when off, the meter makes no request to the server because of these reports or of the signal that it is open.

Samples (optional, off by default): only if you turn on the Unknown packet samples option in the meter's Settings, and only when the server asks, the meter keeps up to 3 samples of each packet type it does not understand yet, with up to 96 bytes each, plus the type and size of the 3 neighboring packets; never from packets it already reads or from the nickname, party and legion packet types we know. Before a sample leaves the computer, every stretch that could be text is erased and the meter checks that no character name it knows was left, yours and the ones it has seen; if it cannot be proven that the sample is clean, it is discarded. What remains are numbers and game codes, such as the identifier of a monster or a character in that match, which is what makes it possible to understand the packet. Samples are kept for up to 90 days, and their link to the installation code disappears after 30 days. To delete them sooner, the same removal request from the previous paragraph applies.

Account and login

Login is optional and is used to link AionCore Meter to the site and upload fights. It is done through Discord, and AionCore asks Discord only for the identify permission.

From your Discord account, AionCore stores the identifier (a number), the public name and the avatar code, plus the date the site account was created and the date of last use. The site does not load the avatar image. From Discord, AionCore does not receive your email, your password, your server list, your friends or your messages.

Browser sessions and meter keys are stored in the database only as a hash, a summary that does not allow the original value to be rebuilt. When you authorize a meter, the server stores the country and the internet provider (its number, the ASN) the request came from, to show them in My account and to warn you when the request comes from another network. The IP address is not stored: only a keyed summary of the network range, deleted together with the pairing code.

Discord receives your login, under its own rules and privacy policy. AionCore sends no fight data to Discord.

Two pages have a field to type in: the meter code, in Authorize AionCore Meter, and the confirmation phrase, in My account, to delete the account. The server checks the code, which never appears in the page address. The phrase only confirms the delete request and is not stored.

Cookies

The site uses one session cookie, needed to keep you signed in, called __Host-aic_sid. It is only created after login. The page's scripts cannot read this cookie (HttpOnly), it only travels over HTTPS (Secure) and the browser does not send it in requests made from other sites, except when you click a link (SameSite=Lax).

It expires in up to 30 days, is renewed while you use the site and never goes beyond 90 days from login. Signing out deletes the cookie right away.

During login there is also a support cookie, __Host-aic_oauth, which lasts 10 minutes and is deleted when login ends.

There are no tracking, statistics or advertising cookies.

Fight upload

Uploading boss fights starts on: as soon as you connect the meter to a site account, it uploads the fields listed below at the end of each boss fight, and it shows a notice the first time. This feeds your ranking, your profile and each fight’s link; who sees what is under “Who sees your fights”, further down. You turn uploading off whenever you like in the meter’s Settings, you can keep each fight Private or delete it, and if the list of fields changes, the meter asks again.

With uploading on, the meter sends the fight when it ends (by default only boss fights; in the settings you can include training dummies or all fights), and there is also the upload of a single fight, on request, in the Fight summary. If the internet fails, the fight waits in a queue on your PC for up to 14 days.

Each uploaded fight may carry these 69 fields (the 7 from the skill and buff timeline and the last 12, on aggro, guard bar breaks and deaths, are sent starting with the meter version that sends them):

• Upload format version
• AionCore Meter version
• Server region (kr, tw or global; unknown when not confirmed)
• Your character's server number
• Fight type (boss, regular monster or training dummy)
• Fight result (killed, ended, reset)
• Target monster code
• Target monster name
• Target's maximum HP
• Target's HP at the end of the fight (%)
• Fight start time
• Fight duration
• Which row in the list is you (without a name)
• Each player's class
• Each player's role (tank, DPS or healer)
• Each player's combat power
• Each player's total damage
• Each player's DPS
• Each player's number of hits
• Each player's direct hits (without damage over time)
• Each player's critical hits
• Each player's critical rate
• Each player's multi-hit rate
• Each player's back attacks
• Healing done by each player
• Shields given by each player
• Damage taken by each player
• Each player's deaths
• Each skill's code
• Each skill's name
• Each skill's hits
• Each skill's damage
• Each skill's critical hits
• Each skill's biggest hit
• Active specializations of each skill
• Code of each part of the skill combined with the summon
• Name of each part of the skill combined with the summon
• Hits of each part of the skill combined with the summon
• Damage of each part of the skill combined with the summon
• Critical hits of each part of the skill combined with the summon
• Biggest hit of each part of the skill combined with the summon
• Who can open the fight (only you, or anyone with the link)
• YOUR character's name (only yours)
• Your character's class
• Your character's server
• Length of each segment of the damage curve (seconds)
• Each player's damage in each segment of the fight (the DPS curve, without names)
• Each teammate's slot in the fight (their position in the list of players)
• Name of each teammate the meter read
• Each teammate's server
• Timeline format version
• Timeline time unit (in milliseconds)
• Code and name of each skill, buff and debuff in the timeline
• Moment of each skill use by each player (without names)
• Start and end of each buff and debuff on each player, with the slot of who cast it (without names)
• Start and end of each debuff on the boss, with the slot of who cast it
• Notice that the timeline was cut for going over the maximum size
• Format version of the aggro, breaks and deaths block
• Time the boss had each player as its target (aggro), in milliseconds (without names)
• Part of that time in which the boss's target was the player's summon
• How many times the boss turned to each player
• Damage each player dealt to the boss while the guard bar was broken
• Time each player spent dead in the fight, in milliseconds
• Code of the monster that killed each player (never the killer's name)
• Code of the skill that killed each player
• Stretch of the fight in which the aggro was measured, in milliseconds
• How many times the boss's aggro changed from one player to another
• Moment each break of the boss's guard bar started, in milliseconds since the start of the fight
• Duration of each break of the boss's guard bar, in milliseconds

What is never sent:

• Chat messages
• Your computer's name. The upload does not carry your IP in its content; the server sees the connection's IP, like any site, only to limit abuse, and does not store it with your fights
• Folder and file paths on your computer
• Your game account data (login, password, account ID)
• Packet recordings and the full history of your fights (the upload carries only the summary above)

The server checks that the fight's numbers are consistent with each other and stores the summary (target, result, duration and each player's numbers) in the database and the skill details and the damage curve in a JSON file, without any player name. Each player's combat power stays only in the database and shows, as the exact number, to anyone who can see the fight. From your character, the account stores the name, the server and the class, to link your fights to you. The skill and buff timeline, when it goes along, is kept in a second JSON file, also without names, with the boss health over the fight, which the server calculates from the damage curve. It is deleted together with the fight.

To prevent abuse, each account stores up to 500 fights and accepts up to 100 uploads every 24 hours, and the server refuses fights whose numbers are not consistent with each other. The numbers come from the uploader's meter: the site cannot compare them with the game, which is why the fight report shows the Self-reported, not verified badge.

When you use login or upload, the AionCore server, which runs on Cloudflare, sees the connection's IP address, like any site. It uses the IP only to limit abuse (Cloudflare counts the requests from each IP), and AionCore does not store the IP in the database, neither with your account nor with your fights.

Who sees your fights

Each uploaded fight is Private (only you see it) or With link (anyone with the link sees the fight, with each player by class and exact combat power, and with the name only of those who show their name on the ranking, you included; the server never shows).

By default, it comes With link (a meter that already had a saved choice keeps it, and whoever never changed it stays Private). You can change it whenever you want, on the site and in the meter, and going back to Private makes the link stop opening at once. Anyone who already opened a fight With link may have kept a copy or the address, and AionCore cannot erase that.

Party and Public do not exist yet.

The account and fight pages ask search engines not to index them, and the browser does not send their address to other sites.

Who else receives data

• Discord: receives your login, as described in Account and login, and handles that access under its own privacy policy.
• Cloudflare: hosts the site, the AionCore server and the storage of the account, the fights and the praise ranking; it receives the IP address and the technical data of each visit and handles all of it under its own policy.
• GitHub: where the installer and the updates come from; it receives the IP address of whoever downloads or queries.
• Ko-fi, PayPal, Stripe and Resend: only for those who support, as described in Support.

No fight data goes to Discord, to GitHub or to any other third-party service: fights stay only on AionCore's hosting, at Cloudflare.

Ranking

The ranking shows the whole group. When someone with an account uploads a fight, their meter also sends the name and server of the teammates in that fight, and each person in the group becomes a row on the board. This also applies to people who do not use AionCore. Anyone who does not turn off Send inspections to the site, which comes on in the meter, also sends the game data of the characters they inspect (see Game data on the profile).

The class, the combat power (the exact number), the DPS, the fight duration (to the second), the party size, the day and the verification badge show on the DPS board and in Fastest kill. The combat power also shows for anyone who hides their name or leaves the ranking and, together with the class and the fight, may be enough for people who play with them to know who they are. In a fight's details, each teammate's DPS and skills only open if they have an account and keep Show my fight details on, which starts on and is turned off in My account. Anyone who removed their character from the ranking shows, in fights others uploaded, only as a teammate, by class, with no numbers. The server never shows. Anyone who shows with their character name and has a supporter code linked to the account also gets the supporter badge (see Support).

Who sees the name. Account holders show with their character name for everyone, with the declared label, because that starts on; they can turn it off. A teammate without an account shows with no public name, for everyone: a name only shows when the person has an account and chose to appear. Someone who never used AionCore does not get a public page with the name just because an account inspected their character: the reading is kept but not shown, and the name only appears if the person creates an account and shows the name. Anyone who hides their name, with or without an account, has no name for everyone, supporters included. The same rules apply to the name on the page of a fight with a link. The author sees everything to moderate the ranking and handle requests. Board pages do not show in search engines.

How the site stores a person. Each character becomes a key computed from the region, the server and the name, with a secret only AionCore has. The site also stores the name seen, the date of the last fight it appeared in and, if there is one, the request to hide the name. The Discord name, the e-mail and the server never show on the ranking.

What you control, with an account: in the meter, you turn off uploads; in My account and in the meter, you hide your name or leave the ranking (the class, the combat power and the DPS stay, with no name); in My account, you remove your character from the ranking for good. All of it is free and applies at once; the public board may take up to 10 minutes to update, because of the cache. In My account, you also turn off your fight details (highest-damage skills, DPS curve, crit and healing per second), which start on; hiding your name does not turn them off. Turning off the details also removes the skill and buff timeline.

Without an account: on /ranking, the form Hide or remove a character from the ranking asks for the region, server and name, with no account and no proof. Both requests remove the name at once, for everyone, and no new upload stores it again. Remove from the ranking also sends the author the request to delete the rows, which the author checks and applies. To remember the request, the site keeps only the character key, the region, the server, the request type and the date. To limit abuse, the site counts the requests from each internet address per day, with a key that does not keep the address and is deleted the next day. Undoing a request is done through the contact page.

For how long. The stored name is deleted 180 days after the last fight it appeared in; the row stays, with no name, while the fight exists. Deleting a fight deletes its rows. An account unused for 180 days is deleted with everything.

Your rights. With or without an account, you can ask for confirmation that there is data about you, access, correction, a copy, deletion, information on who it is shared with, and object to its use, through the contact page. For access or a copy without an account, the author may ask for a simple in-game screenshot that shows the character is yours; to hide or remove from the ranking, no proof is asked. The request is free, and the full answer comes within 15 days.

Anyone signed in can report a row. The review is manual, and AionCore may remove the fight or take the person off the ranking. The data is kept on Cloudflare servers, which may be outside Brazil.

Public profile. Anyone with an account who shows their character name has one public page per character, at an address with the region and the name, and shows up in the player search of the ranking. This starts on. The page shows the name, the class, since when the person has been on AionCore (month and year), how many bosses and fights they have on the ranking, the highest DPS and the position on each boss, with the exact combat power when available, the party size, the day and the verification badge, and the recent fights. If an account that uses AionCore sent an inspection of the character, the page also shows the game data and, if the person turns it on, the build (see Game data on the profile). For people who support AionCore and keep the badge on, it also shows the supporter badge, with the month and year the person started supporting. It brings together in one place what already shows on the boards, and that makes it easier for people who play with the person to recognize them. The server, the Discord name and the e-mail never show, and the profile pages ask search engines not to index them.

People who chose No public name, left the ranking, turned off the profile, asked to hide the name or remove the character, or deleted the account have no profile and do not show up in the search. In those cases the address shows the same profile-not-found page, without saying whether the person exists. Someone without an AionCore account has no profile and does not show up in the search, even if an account that uses AionCore inspected the character (see Game data on the profile). You turn off the profile in My account, for free, for everyone, supporters included, and you stay on the ranking. The site stores only that choice in your account.

Skill and buff timeline. An uploaded fight may also carry the timeline of each player in the group: the moment of each skill use and the start and end of each buff and debuff, on the player and on the boss, with the slot of who cast it. It is used to show, in the fight details, each person's rotation and how long the buffs stayed active. A person's timeline is part of their details: it shows only for people who have an account and keep Show my fight details on, and anyone who opens the details of that fight on the ranking sees it. It shows without names: whoever cast a buff or debuff shows by class, without the name, and the slot stays stored only on the server. If the class is the only one in the group, people who were in the fight may know who it is. The buffs you cast on a teammate and your debuffs on the boss show, by class, in the timeline of a teammate who keeps their details on. The timeline comes from the meter of the person who uploaded and may miss some of the teammates' buffs. It is kept in a separate file, next to the fight, and is deleted together with it: when the fight is deleted, when the account is deleted or after 180 days without using the account. Turning off the details removes the timeline from the page at once (the public board may take up to 10 minutes to update, because of the cache); it stays stored with the fight until the fight is deleted.

Game data on the profile. In the game, any player can inspect any character. When someone who uses AionCore Meter and did not turn off Send inspections to the site, which is on by default, inspects a character, their meter sends the site what the inspect window shows: the name, the class, the level, the item level, the combat power, the title, the equipped titles, the legion (the name as text, as the game shows it in the inspection), the equipment (each piece with the enhancement, the stones, the extra stats, the effects and the chosen appearance), the Arcana, the Daevanion and the count of each type of praise. The site shows this on the character's public page, to anyone, with the day of the reading, including the count of each type of praise and the total, which come from the game's inspect window and not from AionCore's praise ranking. Anyone who compares the class and total on the profile with the praise ranking board can conclude it is the same character. Someone who never used AionCore does not get a page or show up in the search because of an inspection: the reading is kept but not shown, and the name only appears if the person creates an account and shows the name. Each new reading replaces the previous one, with no history.

Never shown: the server, the Discord name, the legion member list, the character's face and body, the time of the reading and who inspected. With the name, the class and the combat power, people who play with the person may recognize them, even in a No public name row of the ranking. The data is read by another player's meter, and AionCore does not check it against the game.

How the site stores it. To know it is the same character after a name change, the site stores a key computed from the character's identifier in the game, with a secret that only AionCore has, plus the region and the server, which never show. It also stores which account sent the last reading and which one sent a different reading not yet confirmed, only to check reports of false data: this never shows and changes with the next readings. The game data of people without an account is deleted 180 days after the last reading. In Download my data, the account sees how many readings it sent that day, not which ones were kept.

How to remove it. Without an account and without proof, in the form Hide or remove a character from the ranking, on /ranking: the request deletes the readings with that name and takes the page offline, and no new reading with that name is stored. If the character changes name in the game, you need to ask again for the new name. With an account, turning off Show the game data on my profile, in My account, closes that block on your profile for everyone, supporters included; the readings are deleted, and the next ones discarded, for the characters the site confirmed as yours. You can also ask through the contact page.

Build. The build (the skills with their level, the chosen specialization, the equipped skills and the stigma) only shows if the character's owner publishes it: on a new account, the Publish my build option comes checked in the first-run notice and turns on when the person presses Connect; on an account that already existed, it starts off. It comes only from the character's own meter, never from an inspection. Turning it off in the meter or in My account erases the build from the site right away; the page may take up to 10 minutes to update. Hiding the name, turning off the profile or leaving the ranking take the build offline together with the profile, without erasing it; deleting the account erases the build. The site stores the choice, the version of the accepted text and the date.

Deleting the account and the game data. When you delete the account, the readings of the characters the site confirmed as yours are removed and do not come back unless you ask through the contact page; a character the account only declared is then treated like that of someone who never used AionCore. The readings in which your account was the last to send are removed too.

Applicant card. A supporter of AionCore who leads a party sees a summary of your public profile (the class, since when you have been on AionCore, the totals, the best positions, the recent fights and the supporter badge) when you ask to join their party in the game. This only applies if you have an account and show your name with the profile on: with no account, with the profile off or with the name hidden, nothing shows, and the site does not say which it was. To end it, turn the profile off or hide your name in My account, or use the form Hide or remove a character from the ranking, on /ranking: it takes effect within a few minutes and it is free. The site does not store who looked you up or the name that was looked up.

Praise ranking

The praise ranking is optional and separate from fight upload and from the DPS ranking. On an account created through the first-run notice, it comes checked in that notice, before the Connect button, and only turns on when you press the button with the option checked. On an account that already existed, it starts off and only turns on if you accept the text in Settings › Account and upload. Only for people aged 18 or over. The acceptance is recorded on the site, with the version of the text and the date.

With participation on, the meter reads, on your PC, only your own character's praise and sends the site: the character's name, the server, the region, the class, the count of each of the five praise types, the time the game reported it and the meter version. The site calculates the total, keeps each character's current status and one record per day, and links everything to your account.

Purpose: to build and show the praise ranking and give the badge to those in the top 20. Legal basis: your consent (LGPD, art. 7, I). You can withdraw it whenever you want, free of charge, and the rest of AionCore keeps working the same.

Who sees it: on the public board, which opens without logging in, the first letter of the name with an asterisk, the class, the total and the position appear, split only by region; the server does not appear. Anonymity is not assured: people who play with you may recognize you. Those who pay to support AionCore see the full name of the confirmed characters in the ranking. You see everything you sent. The author sees the data to moderate the ranking and handle requests.

A supporter can write down or screenshot the name they saw. The Support Terms forbid copying, publishing or passing on the names and limit the queries, but AionCore can't delete a copy made by someone else.

Never shown in the praise ranking: the Discord name and identifier, the time of the reading, combat power and your fights. The meter does not send other players' names or praise. The praise ranking does not use your DPS ranking profile, but the character's public profile shows the count of each type of praise read from the game's inspection (see Game data on the profile): anyone who compares the class and total on the profile with the praise board can conclude it is the same character.

The numbers are declared by the meter of whoever sends them, and the site can't check them against the game. To prevent fraud, automatic rules put numbers that look unusual under review, off the board; the top 20 go through a manual review; and the same name sent by two accounts stays hidden for everyone until the doubt is resolved. If one of your uploads is put under review by an automatic rule, you can ask for a person to review the decision, through the contact page.

Who else receives it: supporters, as described above, and Cloudflare, which hosts the site and the AionCore database. AionCore does not sell or pass this data on to anyone else.

Data outside Brazil: Cloudflare's servers may be in other countries. You are told this in the participation text, and the transfer happens with your consent (LGPD, art. 33, VIII).

For how long: each character's current status stays while you take part. The daily record is kept for at most 180 days. A character with no new reading for 60 days leaves the board and, after 180 days, is deleted. Leaving deletes your praise on the site right away, and the public board stops showing it within 1 hour. The hosting backups disappear within 30 days. Only the version and the date of the last acceptance stay, as proof of consent, while the account exists. An account unused for 180 days is deleted with everything.

Your rights: you leave the ranking in the meter itself; you download everything you sent in My account › Download my data; and you delete the whole account in My account. For correction, review of an automated decision or any other request, use the contact page. The request is free of charge.

If your character's name shows in the ranking and you did not sign up, or you don't use AionCore, ask for it to be removed through the contact page, as explained on the Contact page. The name leaves the board within 24 hours after the request, even before the review.

Cookies: the public board sets no cookie. To see the full names, the supporter uses the same session cookie described in Cookies, with no new cookie.

First run: what comes checked on a new account

If you create a new account now, these two options come checked: taking part in the praise ranking and publishing your build. Nothing is turned on before you press the button. Uncheck one or both here, with one click, and connect all the same. When you press the button, whatever is checked applies.

Praise ranking: the character's name, the server, the region, the class and the count of each praise type are sent. On the public board, which opens without logging in, the first letter of the name with an asterisk, the class, the total and the position in the region appear; the server does not appear. AionCore supporters see the full name. People who play with you may recognize the character.

Publish my build: from the character that is in the game, the active and passive skills with their level, the chosen specialization, the equipped skills and the stigma start to appear on the character's public profile, for anyone, without logging in. It is only the current build, with no history. Other players' builds are never sent.

The account and the praise ranking are only for people aged 18 or over. By pressing the button you declare that you are 18 or over. If you are under 18, do not connect.

Purpose: for the praise ranking, to build and show the ranking and give the badge to the top 20; for the build, to show your build on your public profile. Legal basis for each option: your consent (LGPD, art. 7, I), which you give by leaving the option checked and pressing the button, and can withdraw whenever you want, for free. Controller: Guilherme Filvoch, author of AionCore, an individual. The data is kept on Cloudflare's servers, which may be outside Brazil, and you also consent to that.

You can turn them off whenever you want, for free: in AionCore Meter, in Settings › Account and upload, or on the site, in My account. Turning off the build erases it from the site right away; leaving the praise ranking erases your praise right away. The public page may take from 10 minutes to 1 hour to change. The acceptance is recorded with the notice version and the date.

Accounts that already existed do not change: nothing is turned on in them. If you already have an account and connect again, what is checked here turns nothing on. To turn on one of the options, accept its text in Settings › Account and upload.

For each option that is checked when you press the button, the site records the version of this notice and the date, as proof of your acceptance, for as long as the account exists. An unchecked option stays off, with no record of acceptance.

Support

Supporting is optional. If you support, the payment happens on Ko-fi. The AionCore site receives your email only to send the supporter code and add renewals, and deletes the email 90 days after the code expires. Your name, your message and the amount are not kept in the support record.

Also read the Support terms

On Ko-fi

Payment is made on Ko-fi. Ko-fi receives and handles the payment data (such as name, email, card or PayPal), under its own rules and privacy policy. Ko-fi uses PayPal and Stripe to process payments, and they also receive the payment data, under their own policies.

The author does not receive or store your card or PayPal details. As with any sale, Ko-fi and PayPal or Stripe show the author, in each one's seller area, the record of the purchase, with details such as your name and email. The author only looks at that record to handle requests, refunds and disputes.

What the AionCore site receives and keeps

From Ko-fi, the site receives your email, the amount, the currency, the quantity, the date and the order and transaction identifiers. Ko-fi also sends the name, the message and whether the support is public: the site discards those three without storing them.

The site uses this data only to send your code, add a renewal to the term, avoid two codes for the same purchase, handle your requests (lost code, withdrawal, refund) and answer a payment dispute. Your email is not used for advertising or mailing lists, and your data is not sold or passed to anyone other than the services named in this section.

Your email is kept in the site's database, at Cloudflare, and is deleted 90 days after your code expires (or 90 days after the order, if no code was sent). The support record keeps the code identifier, the dates, the count of supporter years, whether you are a founder, the delivery status and the Ko-fi order and transaction identifiers, and stays for about 5 years after the order, without the email once it is deleted. After the code is sent, its text is not kept in that record, only the identifier.

The email with the code goes out through Resend, an email service, which receives your address and the message with the code. With each sale and each delivery problem, the author gets a notice in his private Discord channel with the code identifier, part of the order and transaction identifiers, the amount and the dates, without your email, your name or the code.

When the code is sent by hand, the author notes the identifier and the dates in a file on his PC, without name and without email, and adds your email to the site's database, with the same deletion period. The messages you write to the author stay in his mailbox.

If you use access to the names in the praise ranking, the site keeps how many names your account looked up in the last 24 hours, without keeping which ones, to apply the daily limit and prevent bulk copying. This count is replaced every new 24-hour period.

On your PC

The code has an identifier, the dates, the count of supporter years and, if it applies, the founder mark. It does not have your name or your email. The meter checks the code on your PC, without internet, and stores it in a file encrypted by Windows, which only your Windows user, on that PC, can open. Along with it, the meter stores the latest time it has seen on the PC's clock, only so that turning the clock back does not extend the term.

Activity records (logs) never contain the code, at most the beginning of the identifier. Settings › Support › Remove code deletes the code and the time stored on the PC. When you uninstall, AionCore asks whether to delete your data too.

Once a day, every AionCore Meter, with or without support, downloads from the site the public file aioncore.app/recursos.json, with the dates when early-access features open to everyone and the identifiers of cancelled codes. That request does not carry your code or any identifier of yours or of the installation. Cloudflare sees the request's IP address, as with any visit.

Support and the site account

With AionCore Meter linked to a site account, the meter automatically sends the site the text of your supporter code a few seconds after opening, when you sign in to the account and when the support changes. The site checks the signature and stores in your account the code, the identifier, the end date, the count of supporter years, whether you are a founder and when it was linked. The identifier is the same as in the support record, which keeps your email until the deletion period. To stop, use Settings › Support › Unlink from site account.

To stop a code from being passed on, the site keeps, for an indefinite period, the link between the code's identifier and the internal identifier of the account where it was first linked. This link does not have your name, your email or the code text and is not deleted when you unlink the code, renew the support or delete the account: that is why the same code does not link to another account. If you deleted the account and want to use the code on a new account, ask the author.

When you delete the account, the site deletes the code and the support data stored in it, along with the rest of the account. Only the link described above and the support record (with the email until the deletion period) remain. The code on your PC stays valid until its date.

If your code is linked to your site account and the support is active, the supporter badge shows to anyone next to your character's name: on the DPS board, in Fastest kill and on your public profile. It shows the years of support, the founder mark, if any, and, on the profile, the month and year you started supporting, for example "Supporter since October 2026". The amount paid, the payment dates and your email stay out of the badge. This starts on. To hide it, turn off Show my supporter badge in My account: it is free, applies to everyone, other supporters included, and your support keeps working. The change shows within 10 minutes. A row with No public name has no badge. If you marked the support as private on Ko-fi, the badge starts hidden.

Why the author may show the badge: it is one of the items of the support (Support terms, section 4.10), and showing it promotes support for AionCore. Legal basis: performance of the contract (art. 7, V) and the author's legitimate interest in promoting the support (art. 7, IX, and art. 10, I). You can object for free by hiding the badge.

For the badge, the site stores in your account only your choice to show or hide it and the day you first linked a code to this account, which gives the month and year of the badge on the profile. Both go along in Download my data and are deleted with the account.

Why the author may process this data

To send the code, add renewals and keep what the Support terms promise: performance of a contract (LGPD, Art. 7, V). To keep what the law requires to be kept: compliance with a legal obligation (Art. 7, II). To defend himself in a payment dispute or a lawsuit: regular exercise of rights (Art. 7, VI). To prevent fraud, delivery errors and code sharing (notices to the author, daily order limit, one code per purchase): legitimate interest (Art. 7, IX). Without the email, the author cannot send the code.

To apply the query limit on the names in the praise ranking and protect the people in it: legitimate interest (Art. 7, IX).

Who else receives support data

Ko-fi, PayPal and Stripe receive the payment data, each under its own policy. Cloudflare hosts the site and the database where your email and the support record are kept, and keeps copies of the database for up to 30 days for recovery: deleted data only disappears from those copies after that period. Resend receives the email with the code. Discord receives the private notices to the author, without your email, your name or the code. The provider of the author's mailbox stores the messages you write to him.

These services process data outside Brazil, because that is necessary for the payment and for delivering the code you bought (LGPD, Art. 33, IX).

The rights in the Your rights section also apply to support data. To make a request, write to the author from the email used for the payment (you can reply to the code email), so he can find your support. The payment data is with Ko-fi, PayPal and Stripe: for that data, make the request to those companies too. You can ask for your email to be deleted before the deadline; without it, the author cannot resend the code or add a renewal to your current term.

AionCore and support are only for people 18 or older: people state this when they sign in. Ko-fi and PayPal may have their own age rules. If a minor supported, the parent or guardian asks for a refund through the contact page.

Supporter wall

The wall, on the Support page, is optional and starts off for everyone. Only people who have the supporter code linked to their site account, turn it on in My account and accept the wall text, which is versioned, appear on it.

Shown publicly, to anyone: the nickname you wrote and the range of your years of support (1 year, 2 years, 3 years or more, or founder). The order follows years of support and, among equals, who started first. The amount, payment dates, email, Discord name and character are never public.

The site stores in your account the nickname, when you turned it on, the version and date of the accepted text and, if applicable, that moderation hid the nickname.

Why the author can do this: your consent (LGPD, Art. 7, I). You can withdraw it whenever you want in My account, with Leave the wall: the nickname is deleted right away and disappears from the page within 5 minutes. Only the version and date of the last acceptance remain, as a record that you consented, until the account is deleted.

If your support expires or the code is unlinked from the account, you leave the wall automatically; when you unlink the code, the nickname is also deleted. When you delete the account, everything is deleted. Cloudflare keeps database copies for up to 30 days and the wall page stays cached for up to 5 minutes.

Why AionCore may process this data

The LGPD requires a legal basis for each use of personal data. These are AionCore's:

• What the app stores on your PC stays under your control: the author does not receive or open those files, unless you send them to him yourself, for example in a diagnostic package.
• Delivering the site, protecting the server against attacks and limiting abuse by IP address, without storing it: legitimate interest (Art. 7, IX).
• Anonymous technical reports and counter of who is online: the author's legitimate interest in fixing the meter after a game update and in knowing how many people use AionCore, with the minimum of data, without a name and with the way to turn it off described above (Art. 7, IX, and Art. 10). Packet samples only leave if you turn the option on.
• Site account, login through Discord and fight upload: performing the service you asked for when you signed in and connected the meter, which turns on boss-fight uploading (Art. 7, V). The meter screen that shows the list of what goes along exists so you know exactly what leaves your PC; turning off uploading or signing out in the meter ends this use.
• Ranking, uploads and the name of account holders: the AionCore terms of use, which you accept when you create the account (Art. 7, V). You turn off each part whenever you want. Storage on Cloudflare servers, outside Brazil, is needed for that contract (Art. 33, IX). Fight details of account holders, which start on, follow the same basis, and you turn them off in My account.
• Teammates without an account (presence with no public name, with the class and the combat power, stored name): AionCore's legitimate interest in building a complete and reliable ranking of each fight (Art. 7, IX, and Art. 10). This also applies to the class of a teammate without an account who shows as the caster of a buff or debuff in another player's timeline. Anyone can object for free, by hiding the name or removing the character from the ranking. The assessment of that legitimate interest can be requested through the contact page.
• Public profile and player search, for people with an account who show their name: the AionCore terms of use (Art. 7, V), like the rest of the ranking, and AionCore's legitimate interest in showing in one place the performance of people who play (Art. 7, IX). You object for free, by turning off the profile or hiding the name.
• Game data on the profile of account holders, and keeping, but not showing, the reading of people who do not use AionCore: AionCore's legitimate interest in showing the character as the game itself shows it to any player (art. 7, IX, and art. 10), taking into account that this data is already open in the game (art. 7, § 3). Anyone can object for free by hiding the name or removing the character from the ranking. For account holders, the terms of use also apply (art. 7, V). For those who send inspections, the terms of use and the notice the person saw in the meter, with the feature on by default and free to turn off. The assessment of this legitimate interest can be requested through the contact page.
• Build on the profile: your consent (art. 7, I), separate from fight upload and from the profile. You withdraw it in the meter or in My account, for free.
• Party applicant card: AionCore's legitimate interest in helping whoever leads a party decide with more information (Art. 7, IX, and Art. 10), using only what the person keeps public on AionCore, found from the name and server that the game itself shows the leader in the join request; minimal data, one person per lookup, and the lookup is not stored. You object for free, by turning off the profile, hiding the name or removing the character from the ranking, or through the contact page.
• Checking that fights make sense, applying the limits, reviewing reports and preventing fraud: legitimate interest (Art. 7, IX) and defense in case of a dispute (regular exercise of rights, Art. 7, VI).
• Support: the legal bases are in the Support section.
• Supporter wall: your consent (Art. 7, I), which you withdraw in My account with Leave the wall.
• Replying to the messages and requests you send to the contact: handling your request (Art. 7, V) and, for requests about your data, meeting the duties set by the LGPD itself (Art. 7, II).

When the basis is consent, you can withdraw it whenever you want, at no cost. What was done before remains valid, and the rest of AionCore works the same.

Data outside Brazil

The companies AionCore uses are outside Brazil and may process data in other countries, mainly in the United States: Cloudflare (hosting of the site and the server), GitHub (download and updates) and, for those who use each feature, YouTube, from Google (guide videos), NCSOFT (skill icons), Discord (login), Resend, Ko-fi, PayPal and Stripe (support) and Gmail, from Google (the author's mailbox, which receives the contact messages).

This transfer happens because it is necessary to deliver what you ask for, such as opening the site, downloading and updating the app, receiving the supporter code or getting your message answered (LGPD, Art. 33, IX). For the technical reports and the online counter, it relies on the data protection terms Cloudflare offers its customers (Art. 33, II). Each company handles the data under its own privacy policy.

Security

The site and the server only accept encrypted connections (HTTPS), and the IP address is not stored in the database. Browser sessions and meter keys are kept in the database only as a hash. On your PC, the key that links the meter to the account and the supporter code are protected by Windows.

No system is completely secure. If a security incident happens that may pose a relevant risk or harm to you, the author notifies the affected people and the Brazilian Data Protection Authority (ANPD), as the LGPD requires (Art. 48).

Your rights

Under the Brazilian General Data Protection Law (Law No. 13,709/2018), you can request the following about your personal data:

• Confirmation that they are processed
• Access to them
• Correction of incomplete, wrong or outdated data
• Anonymization, blocking or deletion of unnecessary data or data processed in violation of the law
• Portability to another service
• Deletion of data processed with your consent
• Information about who your data was shared with
• Information about the possibility of not giving consent and what happens if you do not
• Withdrawal of consent
• Review of decisions made solely by automated means that affect your interests
• Objection to processing carried out without your consent, when it violates the law

The app's data stays on your PC, under your control: to see, correct or delete that data, use the app's options or delete the files in its folder. You can download and delete your site account data in My account, the only place where the account is deleted. For whatever cannot be done there, ask the author through the contact below. Requests are free of charge.

The author confirms receipt of the request and replies within 15 days. To protect your data, he may ask for confirmation that the data is yours before handing over or deleting anything. If you think your request was not met, you can complain to the Brazilian Data Protection Authority (ANPD).

For the praise ranking, see also the Praise ranking section.

How to exercise each right on the site

• Access and portability: in My account, Download my data creates a JSON file with your account, your characters, your fights and your meters.
• Correction: the name and avatar come from Discord. If a fight has incorrect data, delete it and upload it again, or ask for the correction through the contact.
• Deletion: in My account you delete a fight or the whole account, with the fights, characters and linked meters. The meter only deletes the fights it uploaded itself. What is on your PC is not deleted.
• Withdrawal: to unlink a meter, use Disconnect in Settings › Account and site, in the meter itself, or Revoke in My account.

Children and teenagers

AionCore is only for people 18 or older, like Aion 2, and does not knowingly collect data from children or teenagers. Nobody gives a date of birth: people state they are 18 or older when they sign in, and the praise ranking asks for that statement again. Because the ranking shows the whole group, a minor's character may show on it, brought by someone else. A parent or guardian can hide that character's name and ask for it to be removed from the ranking on /ranking, with no proof, or ask through the contact page for any data to be deleted; the author deletes it.

How long data is kept

Site: the technical access data stays with Cloudflare, and the download data with GitHub, for as long as each one's policy sets. The online counter signal (site and meter) stays on the AionCore server for 1 hour at most.

App: the files stay on your PC, and you can delete them whenever you want. The history follows the period set in Settings › History › Keep history for and the Fight limit on the same screen. Recordings and logs are cleaned up automatically: recordings are removed after 14 days or when the folder goes over 1 GB (the ones you pin stay), Developer mode moments stay in their own folder, with at most 30 files (the oldest go first), and logs keep only the latest files.

Site account and uploaded fights: they stay while you use the site or the meter. If 180 days pass with no use at all, the account is deleted with everything in it, and you are warned 30 days before, only inside the site and the meter (the site account does not ask for your email, so there is no email notice). Browser sessions expire in up to 30 days of use, never after 90 days from login, and a meter's key expires in 180 days and renews when it is used, up to 1 year at most after it was linked; then you just link the meter again.

Messages to the contact: they stay in the author's email inbox and are deleted up to 12 months after the matter is closed, so he can follow up on a request or show that he handled it.

Supporter wall: the nickname stays until you leave the wall, unlink the code from your site account or delete the account; the version and date of the accepted text stay until the account is deleted.

Changes to this policy

When this policy changes, the date at the top of the page changes with it. A change that handles data in a new way will be published here before it takes effect and, when the basis is consent, AionCore asks for your acceptance again.

This policy exists in Portuguese, English, Spanish, German, Russian and French. If the versions differ, the Portuguese version prevails.