TRANSPARENCY
Privacy
EchoBorn is a Warframe companion app and clan hub run by Safehouse Lab. This page says what we store, why we store it, how long we keep it, and every third party your data actually reaches. It was written by reading the database schema and the code, not from memory.
Last measured against the code:
If you only look around
Every page view records the path, the referrer, and a coarse read of your device from the user-agent string — phone or desktop, browser, operating system. Obvious bots are ignored and nothing is recorded for them.
Your IP address is stored temporarily, for one job: turning it into a country, region and city. Once that lookup succeeds the raw address is overwritten with null in the same write. If the lookup fails, it is deleted anyway.
We also keep a hash of the address — SHA-256 of the address, the date, and a fixed salt. It lets us tell one visitor from two on the same day without keeping the address. ⚠️ We will not call that anonymous: the salt is in our source and there are only four billion IPv4 addresses, so anyone holding both could work backwards. What it genuinely does is change every day, so it cannot follow you from one day to the next.
Cookies
One: the PHP session cookie, which is what keeps you signed in. It is strictly necessary, it is not shared, and it carries no profile.
There are no tracking cookies, no third-party cookies, no advertising pixels and no consent banner — because there is nothing here that would need one. Note the wording: we are not claiming to set none at all. That would be false, and you could disprove it in ten seconds with devtools.
If you sign in with Discord
We receive and store your Discord user id, username, display name and avatar URL. We never see your password, and we do not ask Discord for your email address. Each sign-in is logged with a timestamp so the roster can show who is active.
Anything you then fill in yourself — platform, Mastery Rank, focus school, favourite frame and weapons, clan name, your Twitch/warframe.market/forum handles, your banner and theme — is stored because you typed it into your own profile, and most of it is public on the Network page by design. ⚠️ We store handles, never URLs: every link is built by us.
If you buy the Founder's Pass
Payment is handled entirely by PayPal. Your card never touches our server. We store the PayPal order id, the amount, the currency and the time, which is what lets us prove you paid and stop the same order being claimed twice.
⚠️ PayPal will have an email address for you as part of that transaction even though we never ask for one and do not store one.
If you turn on notifications
Your browser gives us a push endpoint and two keys. That is an address for your browser, not for you, and it is the only thing we store. Revoking notification permission in your browser makes it useless immediately.
If you ask the Relay
Ask the Relay sends your question to xAI (Grok). That is the plainest way to say it and there is no version of this feature where it is not true. We say it here, and on the page itself, because it is the one place your own words leave our server.
What we send is your question plus a block of figures our own engines computed — the world cycles, Baro's manifest history, market prices. What we store is your question, the answer, and which account asked, so your history is there when you come back.
Questions are counted against your account, not your IP address. You can delete any question from your history, and deleting your account deletes all of them. ⛔ If you would rather no third party ever saw a question, the answer is simple: do not use this feature. Everything else on the site works without it.
Who your data actually reaches
| Third party | What reaches them | When |
|---|---|---|
| Discord | the sign-in exchange — and your browser loads member avatars from their CDN, which shows them your IP | sign-in: only if you sign in. Avatars: on any page showing members |
| PayPal | the payment, and an email address they already hold. Their checkout script also loads in your browser | Payment: only if you buy. Script: whenever you open the Founder's Pass page |
| xAI (Grok) | your question, and our computed figures | only if you ask the Relay |
| Steam | if you choose to link a Steam account, our server asks Steam to confirm you own it, and then asks how long you have played Warframe. We store the resulting Steam id and the hours. Steam sees our server, never your browser | only if you link an account — and you can unlink it at any time, which deletes the id we stored |
| Twitch | whether the stream is live is asked by our server. But when it IS live, the player loads in your browser and Twitch sees you directly | only while the stream is live |
| ip-api.com | your IP address, to return a city | every visit
⚠️ over plain HTTP — their free tier offers no TLS. We are replacing this with a local database, the way Mars Deck already does it. |
| Google Fonts | your IP, as with any request for a file | every visit |
| warframe.market, warframestat.us, browse.wf | nothing about you. Our server asks them and caches the answer; your browser never talks to them | — |
How long we keep it
- Raw IP addresses — until the geo lookup runs, then overwritten. A cached copy sits in our lookup table for 30 days so we do not ask ip-api the same question twice.
- Page views — kept as aggregate history, with no address attached.
- "Viewing now" — deleted two minutes after your last heartbeat.
- Your account and anything on it — until you ask us to delete it.
- Orders — kept, because they are the proof your pass is real.
What we do not do
- We do not sell or share anything with advertisers. There are no advertisers.
- We do not run third-party analytics. The analytics are ours and the data stays here.
- We do not email you. We have no mailing list and no email address for you.
- We do not track you across other sites. We could not if we wanted to.
Your rights, and how to use them
You can ask for a copy of everything we hold on you, ask us to correct it, or ask us to delete it. Most of it you can already edit yourself in the Command Hub. For the rest, message Vonfals on our Discord — that is a real person and it is the fastest route.
⚠️ Under UK/EU law our basis for the analytics is legitimate interest (knowing whether the site works), for your account and pass it is performance of a contract, and for order records it is a legal obligation. If you object to the analytics, say so and we will exclude you.
Honest limits
This is a small site run by one person. Your data sits on shared hosting behind HTTPS, and what we can promise is that we collect little, keep it briefly, and tell you the truth about where it goes. ⚠️ We will not claim it is encrypted beyond that, or that a determined attacker with our server could not read it. Anyone claiming otherwise about a site this size is guessing.