Privacy policy

Controller

Data we process

• Account and access: email, Firebase identifier, sign-in methods, language, time zone, Terms acceptance and minimum Discord data when you choose that sign-in method.
• Player and UID: in-game alias, server, alliance, membership, power, scores and the private UID when you verify your profile.
• Roles and requests: managed alliances, evidence supplied, decisions, appeals and request status.
• Captures and extraction: images, file name, date and zone, provider raw response, interpreted figures, corrections and incidents.
• Notifications and activity: preferences, Web Push subscription, deliveries, audited actions, usage limits and technical security data.
• Contact and removal: message, reply email, affected resource, good-faith statement and decision.
• Credits, usage and reports: alliance usage, technical cost, generated reports and, if configured, Discord deliveries.

What each person can see

Without an account, we show anonymous aggregates and, on an individual profile, only alias, server, current alliance, date and latest observed total power. An account unlocks power breakdown, history and progression. Event results require a verified player belonging to an alliance on the same server; managers and operators retain the access needed for their role. UID, account, captures, configuration, requests and audit data are not public.

Individual profiles are excluded from the sitemap and served with noindex. A valid removal hides the profile, removes it from our search and blocks its return. We can ask search engines to remove their copy but cannot promise immediate deletion of third-party caches. Historical aggregates remain only when they no longer identify the person.

Purposes and legal bases

• Contract or steps you request: create and protect the account, link your player, process your uploads, and configure notifications, reports, Discord and other chosen features.
• Legitimate interests: maintain player statistics supplied by managers, historical integrity, security, abuse prevention and proportionate audit, with access limits, removal and objection.
• Legal obligation: handle rights or retain information only where a specific rule requires it; we do not use this as a generic basis.
• We do not sell data, run behavioural advertising or make automated decisions with legal effects.

Sources and how we inform people

Data comes from you, members or managers uploading screens visible in the game, Gift Center when verifying the UID you declare as your own, and Discord when you choose that access. DWS Stats publishes this notice and provides objection and removal mechanisms for affected people.

We normally have no direct contact details for each player. We therefore maintain this stable public notice and shareable wording, and show it when someone claims or verifies a profile. We will reassess this measure if we obtain a direct channel. You can object or request removal through Contact.

Providers and recipients

• Google Cloud, Firebase and paid Gemini: hosting, database, authentication, storage, queues and capture extraction. Gemini receives the image and necessary instructions; Google currently states 55 days for abuse monitoring.
• OpenRouter: it does not receive real captures or personal data in H1. It may only be used in the Lab with datasets marked synthetic or anonymised.
• Resend: sends operational email with the necessary recipient and content; we do not use open or click tracking.
• Discord: voluntary sign-in and delivery to configured webhooks. The receiving server controls its copy and retention.
• Apple, Google or Mozilla Web Push services, depending on the browser: they transport the encrypted notice. Visible wording is generic and contains no name, alliance or score.
• Dark War Gift Center: we disclose to OMNILOJO PTE. LTD., the independent controller of that service, only the UID you declare as your own to verify name, server and level. The lookup is individual, cached for 24 hours and has a capture/manual-review alternative; Wiso has no contracted API or SLA.

International transfers

Core infrastructure is configured in the European Union, but support, security and providers such as Resend, Discord, Web Push, Gemini or OMNILOJO may process data in other countries. We apply the relevant processing addendum, adequacy decision, Data Privacy Framework or standard contractual clauses and review providers and subprocessors. You may request information about current safeguards through Contact.

How long we keep data

• Original capture, raw response, auxiliary output, file name and private batch metadata expire no later than 90 days after upload. An hourly, idempotent job sanitises up to 100 due batches per run; if a batch is still editable, it safely cancels it before purging. Validated history keeps only minimum provenance.
• Gift Center cache: 24 hours. OAuth state and cookies: 60 seconds to 10 minutes. Session: up to 14 days. Imports and diagnostics with a declared TTL: 30 days. Firestore backups: 7 days.
• Account and preferences: while active. Deletion runs a retryable cascade over profile, reminders, Push, claims, notifications and personal references; backups rotate within 7 days. Minimum relationship evidence may be held for up to 5 years for legal defence and is then deleted or irreversibly anonymised unless a claim or specific duty applies.
• Player and alliance history: while the service remains available and a legal basis applies. Removal hides individual data and blocks its return; only irreversibly anonymous aggregates remain. The minimum block remains while the removal is valid.
• Acceptances, authority, role decisions and critical changes: throughout the relationship and 5 years afterwards. Raw manager-request evidence: 90 days after the decision; minimum decision and audit thereafter for up to 5 years.
• Notification and Push preferences: until deleted, the endpoint expires, the provider returns 404/410 or the account is closed. Notifications and delivery history: 90 days unless an incident remains open.
• Contact, rights, removals and incidents: until closure and for the minimum time needed for follow-up, proof of handling or defence of a claim; they are reviewed periodically and then deleted or minimised. Actual Cloud Logging retention is audited separately and we do not claim an unverified period.

Your rights and separate actions

You may request access, correction, erasure, restriction, objection and portability where applicable. We respond within one month, extendable by two more for complexity with notice during the first month, and verify identity proportionately. You may also complain to the Spanish Data Protection Agency.

Deleting an account removes user access and profile; removing a player profile hides it and blocks its return; erasure deletes or anonymises what is no longer needed and explains any current exception. ‘No longer in the alliance’ dates a membership departure and ‘did not participate’ only explains an event: neither is a privacy request.

Request removal, exercise rights or report content · Delete my account

Content notices and appeal

Through Contact you can report unlawful, infringing or incorrect content by identifying the resource, reason, reply email and your good-faith statement. You receive a reference; we review the notice, communicate a reasoned decision and offer an appeal or review route. We may also moderate, remove or suspend content or accounts where proportionate.

Security and changes

We apply role- and resource-based access, encrypted secrets, client-closed Storage, validation, limits, human review and audit. No measure removes every risk. We publish changes here and request fresh Terms acceptance when they are material.