Privacy Policy

WaPPo (the “Service”) processes personal information only as needed to provide its services and protects it under applicable law. Privacy inquiries may be sent to the contact below.

• Privacy contact: WaPPo Privacy Inquiries

• Email: contact@wafo.top

1. Purposes and Categories of Personal Information

The Service processes the following information.

1. Discord login: Discord user ID, username, display name, profile image information, and first and latest login times are processed for login, account identification, and authorization. The Discord scope is `identify`; we do not receive your Discord email, password, or date of birth.

2. Characters and raids: Registered character names, classes, roles, factions, realms, selected characters, ownership verification status, team names, schedules, recruitment requirements, application, approval, cancellation, waitlist and participation status, SR items and quantities, and related changes are processed for character management, raid recruitment and participation, reserves, and operational records.

3. Boards: Post and comment content, account identifiers, character names and classes displayed at posting, creation and edit times, upvotes, and view-count information are stored to provide boards, identify authors, check permissions, and manage upvotes and views.

4. Raid messages: Participants’ account identifiers, raid information, counterpart display names, message content, sent times, and read status are processed for communication between the relevant raid leader and applicants or raiders.

5. Notifications: Recipient accounts, notification content and links, and creation and read times are processed. If browser push is chosen, subscription endpoints, keys needed for encryption and delivery, and delivery status are processed to provide application, reserve, schedule, and message notifications.

6. Images and operational records: Uploaded images, file ownership and references, raid import and export materials, and raid operation and audit records are processed to display submitted content, operate raids, respond to errors, and check permissions.

7. Reports and inquiries: Submitted reports and inquiries, signed-in account identifiers where applicable, sanitized page paths, browser type, screen size, occurrence and receipt times, and abuse-prevention hashes are processed. Sender email addresses may also be processed for email inquiries.

8. Login and security: Login session cookies, server-side session hashes, single-use OAuth state values, and anti-forgery values are processed. The Service’s error-report database does not store raw IP addresses; infrastructure providers may process connection information when handling requests and security.

Public posts and raid information may be shown to other users according to their visibility settings. Private messages are provided only to authorized participants.

2. Eligibility and Grounds for Processing

The Service is for people aged 14 or over. Users attest that they meet this age requirement; only the attestation time and applicable notice version are minimally recorded. This is not presented as objectively verified age. Unnecessary dates of birth, identity documents, or resident registration numbers are not requested.

Personal information needed for login and requested services is processed on grounds permitted by applicable law. Optional device push notifications are provided at the user’s choice and can be disabled at any time.

3. Retention Periods

1. Login sessions: Valid for up to 30 days from creation. Signing out ends and deletes that session. Expired sessions are cleaned up periodically.

2. Single-use Discord OAuth state: Valid for 10 minutes and deleted after use or expiry.

3. Raid messages: Retained for 90 days from creation. Expired message content and related notifications are removed, along with residual participant and read-state information for conversations with no messages still needed.

4. General notifications: Deleted after up to 30 days from creation. Message notifications are cleaned up consistently with the existing message retention policy.

5. Device push information: Processed while notifications are enabled. Unsubscribing deletes that subscription. Expired or disabled subscription records are deleted within 30 days after deactivation.

6. Accounts, characters, participation, and reserves: Processed as needed to provide these features while the account is in use. Once a valid deletion request is confirmed, data is deleted or identifiers removed under Section 4.

7. Posts and comments: Processed to provide boards during use. User deletion or account withdrawal destroys content and author identifiers, leaving only an empty deletion marker if needed.

8. Reports and inquiries: Deleted after retention of up to 90 days following closure. If legally required to retain data, the specific items, legal grounds, and periods are managed separately.

9. Uploaded images: Kept while their use or display purpose continues. When deletion or account withdrawal ends that purpose, related users’ materials and rights are checked and unnecessary files and references removed.

10. Operational and audit records: Necessary records are processed for their purposes during account use. After withdrawal, only minimal facts needed for other participants’ raid operations remain, with identifiers removed. Data that can still be reidentified is not claimed to be anonymous.

Other information subject to a confirmed legal retention duty is handled separately within the scope and period required by that law. We do not retain all data long-term solely because a dispute might occur.

4. Access, Correction, Deletion, and Account Withdrawal

Users may request access, correction, deletion, suspension of processing, or account withdrawal at contact@wafo.top. Identity is checked by the minimum necessary means, such as Discord login. Resident registration numbers or ID copies are not routinely required for verification.

Once a valid withdrawal request is confirmed, account and character identifiers and the user’s posts and comments are generally deleted without delay. Raid and reserve history needed by others retains only minimal raid facts; Discord IDs, character names, nicknames, linking keys, and identifiers inside operational records are deleted or processed to make reidentification difficult. Messages or posts written by others and legally retained data may be subject to separate processing limits.

If some information cannot be deleted, we explain the legal basis and limits and process the remaining information according to law. Signing out or deleting one character is not withdrawal of the entire account.

5. Information Visible to Other Users

Depending on raid recruitment and reserve settings, raid titles, schedules, leader and applicant character names, participation status, and some reserve details may be visible to others. Board posts and comments are shown within each board’s visibility scope.

Sharing recruitment information to Discord may show it to users of the relevant channel. Changing visibility or withdrawing from the Service may not automatically remove copies already made by external users.

6. External Services and Overseas Processing

The Service uses Cloudflare Workers, D1, and R2 to process web requests, databases, and images. It also uses Discord login and recruitment sharing, optional browser push notifications, and Gmail for inquiries.

The connected D1 and R2 location information currently shows Asia-Pacific (APAC). This is a region, not a country, and does not establish the actual countries of storage, processing, recovery, or support access.

Legal requirements for overseas transfers require disclosure of the relevant countries, recipients, purposes, categories, timing and methods, retention periods, and users’ rights.

7. Cookies and Security Measures

The `rh_session` cookie maintains login for up to 30 days. The `wappo_board_views` cookie may be used for up to 30 minutes to prevent duplicate post-view counts. Users can delete or restrict cookies in browser settings, which may limit some features.

Technical measures include session hashing, request-forgery protection, authorization checks, and message access controls. We do not guarantee freedom from all privacy incidents or immediate deletion of all external providers’ logs.

8. Changes and Contact

Changes to this policy are notified as required by applicable law. Send privacy inquiries and requests to exercise your rights to contact@wafo.top.

This policy takes effect on the date its finalized wording is first published on the site.

The rh_locale and rh_time_zone cookies remember your language and local time zone for up to one year. You can delete them in your browser settings.

Effective date: 2026-10-11