Legal — how this demo treats your data
PRIVACY
Short, honest, and written for a demo. No trackers, no ads, no analytics.
Controller
The controller is nwart.app. Mail privacy@nwart.app for every privacy request.
This is a demo game. It names no street address yet, so formal mail goes to the inbox above. The policy grows with the project.
Data we hold
| ITEM | PURPOSE | BASIS |
|---|---|---|
| Wallet address | Account identity and sign-in | Contract, Art 6(1)(b) |
| Handle | Public callsign and ranks | Contract, Art 6(1)(b) |
| Agents, chips, fights | Gameplay, history, standings | Contract, Art 6(1)(b) |
| Session cookie | Login session, 30 days | Contract, Art 6(1)(b) |
| Login challenges | One-time signature check | Contract, Art 6(1)(b) |
| Rate limits, abuse reports | Security and fair play | Legitimate interests, Art 6(1)(f) |
Your wallet address counts as personal data. Nothing is ever written on-chain by this game.
Retention
| ITEM | KEPT FOR |
|---|---|
| Session cookie | 30 days, then it expires |
| Login challenges | 5 minutes, then they expire |
| Account and game rows | Until you delete the account |
| Abuse reports | Until the reported account is deleted |
| Season archives | Aggregate history keyed by retired ids only |
Cookies and storage
| NAME | WHERE | EXPIRY | WHY |
|---|---|---|---|
| aw_session | Cookie, httpOnly, Secure | 30 days | Login session |
| aw_token | localStorage | Until logout or delete | Legacy sign-in for old clients |
| aw_handle | localStorage | Until logout or delete | Shows your name fast |
| aw_tour_seen | localStorage | Until cleared | Remembers the finished tour |
| aw_admin | sessionStorage | Tab close | Organizer key, tab memory only |
Every item is strictly necessary for the login or the game you asked for, so no consent banner appears. If analytics or ads ever ship, a banner ships first.
Sub-processors and transfers
Hosting runs on Cloudflare (Workers plus D1 database) as processor under the Cloudflare customer data agreement with EU standard clauses.
No analytics, ads, fonts, or third-party SDKs load. The API is same-origin.
Your rights
Access and portability: press Download my data in the barracks. One JSON file holds every row.
Rectification: your handle is editable in the game. Other fixes go to privacy@nwart.app.
Erasure: press Delete account in the barracks. It removes the leader, sessions, challenges, agents, chips, fights, tickets, wallet rows, cooldowns, reports, and cup entries, then signs you out.
Restriction and objection: mail privacy@nwart.app. The account is paused by hand.
Requests are answered without undue delay, within one month. Identity is checked with a wallet signature. You can also complain to your data protection authority.