Who we are
WkBot is made by Wk Co, based in São Paulo, Brazil ("we", "us"). We are responsible for the personal data described here, under Brazil's General Data Protection Law (LGPD). For anything about your data, write to contact@tibiawkbot.com.
The short version
- We collect what it takes to run your account and your license, to take payments and to keep both safe.
- Your game never leaves your computer: we don't receive your screen, your characters or what the program sees.
- Card details go to Stripe, never to us.
- This website uses no cookies, no analytics and no advertising.
- We don't sell your data, and we don't share it except with the few services that help us run WkBot.
- Join the launch list and we email you once, when WkBot opens, then delete your address.
What we collect, and why
- Your account. Your email address, your password (stored only as a salted, one-way hash we can't turn back into the password), whether the email is confirmed, and your sign-in sessions. Why: to create and run your account and let you sign in.
- Your license and purchases. Your plans, the time added and when, and a record of each purchase: the plan, the amount and currency, its status, and Stripe's reference for it. Why: to add the time you paid for, handle refunds and disputes, and keep the records the law asks of us.
- Your computer. The program creates a key of its own on your computer and sends us a code derived from it, together with your computer's name as Windows shows it. Where that key can't be created, the code is derived from your computer's hardware instead, and only the derived code is sent, never the hardware details themselves. Why: to keep your license on one computer at a time, show you which computer holds it, and offer the free trial once per computer.
- Security records. The IP address of each request to our license service, with what it was - a sign-in, a license check, a trial, a failed attempt - and signs that the license or the computer's clock were tampered with. Why: to protect your account and the service from abuse, fraud and cracking.
- Emails. We send confirmation and password-reset codes to your email address. If you write to us, we keep the conversation to answer you. Why: to run your account and give you support.
- The launch list. If you ask on this website to be told when WkBot opens, we keep your email address, when you asked and which wording you agreed to. We send you a confirmation, and one email when WkBot opens. Why: because you asked us to - your consent, which you can withdraw at any time with the link in every email from the list.
The legal bases for this are the performance of our contract with you, our legitimate interest in keeping WkBot secure and free of fraud, the legal obligations we have as a business and, for the launch list, your consent.
What we don't collect
- Your game. WkBot reads your game on your computer and keeps it there. No screen, picture, character, route or profile is sent to us.
- Remote View. Remote View streams from your own computer straight to the screens you open it on. The picture never passes through our servers.
- Telemetry. The program sends no usage statistics, crash reports or logs. Its logs stay on your computer.
- Payment details. Card and wallet details are entered on Stripe's own checkout page and never reach us.
On your computer
The WkBot program keeps these files on your computer, in its own folder and in your Windows profile:
- Your sign-in. If you choose to stay signed in, a sign-in token is saved, sealed by Windows so that only your Windows user can open it, and your email is saved if you ask to be remembered. Your password is never saved. Signing out removes the token.
- Your settings. Profiles, routes, preferences and logs, including the address and key of Remote View and the addresses of the screens that watched it.
- The key that identifies your computer, kept by Windows, in your computer's security chip where there is one. It can't be copied out.
The program talks to our license service and to our update server, which sees the version you run. To show spell pictures it loads them from the game publisher's public website, which, like any website, sees your IP address.
On this website
- No cookies, no analytics, no advertising.
- Your browser keeps a little, for you: the email you last bought with, so the checkout can fill it in, and whether you switched on Arduino mode on the home page. Both stay in your browser and never reach us, and clearing your browser's site data removes them.
- Buying. At checkout we ask for the email of your WkBot account and pass it to Stripe with the plan you chose.
- The launch list. If you join it, the email you type goes to our license service and is kept as described above.
- Fonts are loaded from Google Fonts, which receives your IP address as part of delivering them.
Who helps us
We share data only with the services that help us run WkBot, each for its own part:
- Cloudflare hosts this website, our license service and its database, and our updates. It receives the IP address of every visit and request.
- Stripe processes payments. It receives your account's email, the plan and our reference for your account, plus whatever you enter at checkout, under Stripe's privacy policy.
- Resend delivers our emails. It receives your email address and the message.
- Google Fonts serves this website's fonts.
These services are based or store data outside Brazil, mainly in the United States. We use them under their own data protection terms, with safeguards the LGPD accepts for international transfers. We may also disclose data when the law or a court requires it.
How long we keep it
- Your account and license: while the account exists. When you ask us to delete it, we do so within 30 days.
- Purchase records: for as long as tax and consumer law require us to keep them, even after an account is deleted.
- Security records: up to 12 months.
- Codes we email you: they work once and expire after 10 minutes.
- The launch list: until the launch email is sent - your address is deleted right after - or until you leave the list, whichever comes first.
- Support conversations: while they are useful to help you, and no longer than 2 years.
Your rights
Under the LGPD you can ask us, at any time and free of charge, to:
- confirm whether we hold data about you, and give you a copy of it;
- correct data that is incomplete, wrong or out of date;
- delete your account and the data that depends on it, keeping only what the law makes us keep;
- tell you who we share it with;
- hand it to you, or to another service, in a format you can use;
- review a decision about your account that you believe was wrong.
Write to contact@tibiawkbot.com from the email of your account, so we know the request is yours. If you are not satisfied with our answer, you can also complain to Brazil's data protection authority, the ANPD.
Security
Passwords are stored only as salted hashes, sign-in tokens and codes only as keyed hashes, and every connection to our services is encrypted. Access to the database is limited to the people who run WkBot. No system is perfectly safe, so use a password you don't use anywhere else, and tell us at once if you think your account was accessed by someone else.
Children
WkBot is not meant for children under 13, and we don't knowingly hold data about them. Buying license time requires being of legal age, or the consent of a parent or guardian.
Changes
When what we collect or how we use it changes, this page changes with it, and the date at the top shows the latest version. Important changes are announced on this website or by email.
Contact
Wk Co · São Paulo, Brazil · contact@tibiawkbot.com