Privacy policy

Last updated 1 November 2026

Crystaltide is a free, unofficial companion site for FINAL FANTASY XIV players. This page explains what we store about you, why, who else is involved, and how to get it changed or deleted. We’ve tried to keep it short and plain.

The short version

  • We keep what the site needs to work for you: your sign-in, the characters you add, and the progress and settings you save.
  • No ads, no analytics, no trackers, and we never sell or rent your data.
  • Only cookies the site needs to keep you signed in and secure.
  • You decide who sees your characters, and you can delete your account at any time. It takes effect immediately.

Who we are

Crystaltide (crystaltide.gg) is run by a small team of FFXIV players based in the United States. We decide what’s collected and how it’s used; in GDPR terms, we’re the “controller”.

Questions or requests about your data: write to privacy@crystaltide.gg, or use the Feedback button on any page while signed in.

What we store, and why

Your account

  • Signing in with Discord: your Discord user ID, username, and avatar. We only ask Discord to identify you: no email address, servers, friends, or messages, and we never post anything.
  • Local accounts (set up by an admin for people without Discord): your email address, used only to recognise your account.
  • Passkeys: the public half of each passkey, the name you give it, and when it was last used. The private half never leaves your device. There are no passwords.
  • Invites: the invite code you joined with and who made it; for codes you make, who used them. This is how we grow slowly while sign-up is invite-only.
  • Invite requests: if you ask us for an invite, your email address and anything you add (a Lodestone character link, why you’d like to join). We use it only to send your invite, and email you nothing else. The same goes if a friend gives us your address so we can invite you.
  • When you last visited, to the nearest hour, and how many different days you’ve visited (a number, used in our checks against abuse). It powers “since your last visit” and pauses character updates after 90 days away.

Characters you add

  • To add a character, you put a short code in their Lodestone profile so we know they’re yours. The code stops working after a few hours, and you can remove it from your profile once we’ve checked it.
  • We then read that character’s public Lodestone pages: name, world, portrait, jobs and levels, gear, mounts, minions, achievements, and Free Company. We refresh them regularly while you keep visiting.
  • If you make achievements private on the Lodestone, we keep the ones we already read, marked as old, until you make them public again or press “Remove stored achievements”.
  • We only read characters their players added themselves. We don’t collect other members of your Free Company or anyone else.
  • If you share a character by link or as a public profile, we count how many times others open it, and when it was last opened. We don’t record who opened it.

What you save

Goals, checklists, relic and Trials of the Braves progress, your dashboard layout, look and feel, sharing settings, pinned characters, watched nodes and fish, crafting lists (with the counts you enter), group runs you start or join, your time zone (so “on this day” uses your own date), and which name we show for you. It’s all there so the site remembers your choices. Group runs are deleted once they’re over.

Feedback and suggestions

What you write, the page you sent it from (with any private share link hidden) and your votes. If the suggestions board is on and an admin approves your suggestion, it shows publicly with your display name.

Technical records

  • Sign-in sessions: your IP address and browser type, stored with your session while it’s active, to keep your account secure.
  • Error logs: when something breaks, details of the error, sometimes with your account number, kept for 14 days so we can fix it.
  • Our host’s server logs record each request (IP address, page, browser), as almost every web server does. Our hosting provider keeps them under its own policy.
  • Site health: hourly counts of page loads, background jobs, and errors, with nothing about who made them.

For visitors in the EEA and UK, the legal bases are: providing the service you signed up for (account, characters, saved progress), and our legitimate interest in keeping the site secure and working (sessions, logs, invites) and in reading the public Lodestone pages of characters you ask us to track.

Who can see it

  • You, always.
  • Other players, only what you share. Each character’s Sharing page decides who sees each section: just you, your Free Company on Crystaltide, anyone with your private link, or everyone. “Run it together” only uses what you share with your FC, and your FC sees group runs you start or join.
  • Crystaltide admins, to run the site: account details, characters, invites, and feedback, for support and moderation only.
  • Nobody else. We don’t sell, rent, or trade personal data, and there are no advertisers or analytics companies involved.

Other services involved

  • Our hosting provider runs the servers the site and its database live on, so your data is stored there. It processes it only to provide that hosting.
  • Our email provider sends invites you ask for, so it sees your email address and the invite. A copy of each invite we send stays in our mailbox.
  • Discord, if you sign in with it. Discord’s own privacy policy covers what happens on their side.
  • Square Enix’s Lodestone: our server reads public character pages from it. Your browser also loads character portraits from Square Enix’s image server (img2.finalfantasyxiv.com).
  • XIVAPI: your browser loads game icons from v2.xivapi.com.
  • Discord’s image server (cdn.discordapp.com), for Discord avatars.

When your browser loads an image from another site, that site sees your IP address and browser, as with any web page. None of them get anything from us about who you are. Fonts are served by us, not by a font service. The credits list everything we use.

Crystaltide is run from the United States, and our providers may handle data in other countries too. If you use it from elsewhere, including the EEA or UK, your data is processed outside your country. Where the law requires it, transfers rely on recognised safeguards such as the EU Standard Contractual Clauses.

Cookies

Only the ones the site can’t work without, so there’s no cookie banner:

  • __Host-crystaltide-session: your session; it ends 120 minutes after your last visit.
  • XSRF-TOKEN: protects forms against forgery from other sites.
  • remember_web_…: keeps you signed in on this device until you sign out (at most about 400 days).

No analytics, advertising, or tracking cookies, and no similar storage in your browser.

How long we keep it

  • Your account and what you save: until you delete them.
  • A character: until you remove it from your account (or someone proves it’s theirs and adds it to their account).
  • Sign-in sessions: until they expire. Error logs: 14 days.
  • Invite requests: 30 days after we send your invite or decline, or 90 days if we never get to it. Copies of sent invites in our mailbox are cleared out by hand, every few months.
  • If you don’t visit for 90 days, we stop updating your characters until you’re back. Nothing is deleted.
  • When you delete your account, everything above goes at once, including your characters and progress. Feedback you sent stays without your name, and players you invited keep their accounts but are no longer linked to you.

Your choices and rights

  • See and change most of it yourself: the Account page, each character’s Sharing page, and your dashboard.
  • Delete a character, your stored achievements, or your whole account yourself, at any time.
  • Ask us for a copy of your data, to correct something, or to stop a particular use of it. We’ll answer within 30 days, and it’s free.
  • In the EEA or UK you also have the right to complain to your data protection authority. In California and other US states with privacy laws, you have similar rights to know, correct, and delete; we don’t sell or share personal information for advertising.

Keeping it safe

You sign in with Discord or a passkey, never a password, so there are no passwords of yours for anyone to steal. The site only works over HTTPS. We ask other services for the least we need. Only admins can reach the admin pages, and we review the site’s security before each major step. If something ever goes wrong that affects your data, we’ll tell you.

Children

Crystaltide isn’t meant for children under 13 (or the minimum age for online services where you live, if higher), and Discord and FFXIV have their own age rules. If you think a child has given us personal data, tell us and we’ll delete it.

Changes

If we change what we collect or how we use it, we’ll update this page and the date at the top. If it’s a significant change, we’ll also tell you on the site first.

In beta

    Read more