1. Scope and controller
This notice covers the information website at wisplegends.com and the browser game at play.wisplegends.com. The controller is the individual operator identified in the legal notice, where the name, service address and privacy contact are provided.
Controller: Cengiz Cinar
Address for service: Oslebshauser Heerstr. 178, 28239 Bremen, Deutschland
Privacy contact: info@wisplegends.com
Acknowledging this notice is not consent to advertising or tracking. Accepting the terms does not replace any separately required data-protection consent.
2. Visiting the information website
Cloudflare delivers the website, images and fonts and protects the connection. Necessary connection data include IP address, requested URL, time, browser information and errors. They support delivery, troubleshooting and protection against misuse.
This information website serves fonts and images from its own origin. It has no embedded video, advertising network, analytics script, contact form or sign-in. Language links do not store a language identifier on your device. Selecting Play opens the separate game service.
3. Game accounts, guests and progress
A server-supported game creates a technical account ID for guests too. Supabase provides authentication and the account database. Registration additionally uses your email address and authentication credentials. Passwords are not displayed publicly or shared with other players.
Account data include display name, platform cohort, saved progress, runs, rank, rank points, currencies, upgrades, collected content, cosmetic ownership and equipped hero appearances, rewards and inbox messages. The server checks elapsed time and results, assigns claims to the correct account and prevents duplicate rewards. Leaderboards publicly show display name, score and the hero appearance associated with the record.
Session and run identifiers, heartbeat times and game version secure access and recovery. Switching accounts or signing in on another device may end an older session.
When you acknowledge the legal notice, the device stores its version and your local acknowledgement time. The first account loaded after that is linked to this acknowledgement: the device also stores that account's identifier, and the game submits the version for this account with an expected-owner check. Another account signed in later on the same device is not recorded on the basis of this acknowledgement. The server records the account, document version, draft or approved status and the first server receipt time. This does not create an account on its own and is not consent to analytics or advertising.
4. Storage on your device
The game uses Local Storage, Session Storage, IndexedDB and a service worker for session credentials, language, audio and controls, local progress copies, run recovery, pending reward submissions, party connections and acknowledgement of legal documents. Your browser may also cache game files. These functions support the service you request. Where German device-access rules apply, strictly necessary access is assessed under section 25(2) TDDDG.
Depending on the function, entries remain until replaced, signed out, expired or cleared. Browser controls let you remove website data. This can remove settings, unsynchronised results and access to an unsecured guest account. Clearing browser data does not delete an existing server account.
5. Town, friends, parties and co-op
Online features process account and public contact identifiers, display name, hero and skin, room and party membership, presence, movement and game state. Players in your room see your character and public details. Accepted friends can see your online status; party members receive information needed for the shared run. Blocking and muting restrict contacts and messages within the supported features.
Co-op uses WebSockets and may establish direct WebRTC data connections between players. Network addresses can be disclosed to the connection partner and STUN/TURN services during connection setup and transmission. Cloudflare TURN or the game server may relay data when a direct connection fails. The game does not request microphone or camera access; these connections carry game state, not voice or video chat.
6. Messages and reports
Town messages are visible to eligible recipients in the room; party messages reach that party. Private messages are processed between the participants, and a new contact may require acceptance. Text, participant identifiers, room and sending/acceptance times support delivery and history. Do not post confidential information about yourself or others.
Automated text and rate checks protect against misuse. Reporting a message stores its original text, public participant identifiers, time, report reason and attribution to the reporting account as protected evidence. Authorised operators may review this evidence. Messages are not end-to-end encrypted.
7. Diagnostics and abuse prevention
The game reports technical startup failures and security events. The deployed game uses Sentry for technical error and diagnostic reports. After acknowledgement of the legal notice, Sentry may load on the first error or diagnostic report to be submitted. Reports include error messages and program location, game version, device/browser characteristics, viewport, scene and input type, selected gameplay events, run identifier and run seed. Technical connection and delivery measurements may include sign-in status, timing and error counters, limited inbox item identifiers and read/claim counts; message contents are not deliberately collected for these reports.
Automatic collection of user information, cookies and HTTP bodies is disabled in the Sentry configuration. Headers are limited to User-Agent and URL parameters to seed. Error messages and stack traces are transmitted for troubleshooting; performance tracing and session recording are not enabled. The transport provider processes connection data needed to receive reports. Cloudflare Web Analytics is disabled for the website and game.
8. Purposes and legal grounds
Processing necessary to provide the game you request, manage your account, deliver messages and handle service enquiries relies on Article 6(1)(b) GDPR. Secure delivery, fraud prevention, fair-play enforcement and proportionate technical diagnostics serve legitimate interests under Article 6(1)(f). Legal obligations rely on Article 6(1)(c).
Optional processing that requires consent relies on Article 6(1)(a). That choice must be separate and voluntary, and consent can be withdrawn for the future. Playing the game, acknowledging this notice or pressing a general acceptance button does not grant blanket tracking consent.
9. Retention
Persistent account values and relationships remain for the account and requested features until valid deletion or an applicable cleanup rule. Inactive guest accounts may be cleaned up, with active relationships and retained conversations considered. Legal duties or the necessary defence of specific legal claims can justify limited further retention.
Regular maintenance generally removes finished or aborted run history and attestations after 14 days; active runs are exempt. Progression ledger entries generally expire after 30 days, while the latest wallet entry per account remains. Security events remain for 90 or 365 days according to severity; startup-error records for 30 days and inbox messages for 14 days. Weekly scores cover the current and three preceding weeks.
Town and party messages remain for three days. Private history is limited to 30 days, 500 messages per conversation and 2,000 across a participant’s conversations; the caps can remove messages sooner. Report evidence remains independently for 180 days. Empty, unaccepted conversations may be removed after seven days. Scheduled cleanup may defer rows involved in a live write until the next sweep.
Successful cosmetic commands retain at most 512 replay receipts per account; receipts older than one day are pruned on the next command. Technical provider logs support delivery, security monitoring and troubleshooting. Retention depends on the time needed for those purposes and the service's technical deletion cycles. Backup and recovery copies may still contain previously deleted data until their overwrite cycle ends. The linked provider information explains this processing. Security and report evidence may remain within the periods above after account deletion where needed to prevent misuse or handle specific claims.
Account notice receipts remain per published or draft document version until the account is deleted. Only server-catalogued versions can create a receipt; retrying the same version does not create another record.
10. Recipients and international processing
Cloudflare, Inc. (USA) processes delivery, protection and online connection data. Supabase Pte. Ltd. (Singapore) provides authentication and the account database. Functional Software, Inc. (USA, Sentry) receives the diagnostic data described above. Email enquiries are delivered using Cloudflare Email Routing and mail infrastructure from Hetzner Online GmbH (Germany). Providers use further suppliers for their services; their published information and data-processing agreements describe their roles and safeguards. Other players receive the public information and messages described above. Competent authorities may receive information where legally required.
The Supabase account database is configured in Frankfurt am Main (eu-central-1). Sentry's selected data storage region is the European Union (EU). Cloudflare operates a global network; location preferences for online rooms do not guarantee EU-only processing. Provider support, operational data and subprocessors may also involve processing outside the European Economic Area. Depending on the provider agreement, transfer safeguards include applicable adequacy decisions, relevant participation in the EU-US Data Privacy Framework or EU standard contractual clauses. The information below explains the respective conditions and subprocessors.
11. External game platforms
When you play through CrazyGames, its SDK may additionally process platform storage, sign-in status, language, loading/gameplay status and completion progress for that platform. Wisp Legends accounts and storage are separated by platform. CrazyGames is responsible for its own platform processing. Its SDK does not load on this information website. Other linked websites receive data when you follow their links and have their own notices.
12. Your rights and contact
Subject to legal conditions, you can request access, rectification, erasure, restriction and data portability. You may object to legitimate-interest processing for reasons relating to your particular situation, and withdraw consent for future processing. You may complain to a competent data-protection authority, including where you live, work or believe an infringement occurred.
Send privacy and account-deletion requests to the privacy contact in the legal notice. We may request information necessary to identify the account securely, without requesting unnecessary additional data. Requests are handled within statutory time limits. Clearing browser data alone is not an account-deletion request. You do not need to publish your email address in game chat to request access.
For email enquiries, we process your sender address, message and any attachments you provide to handle and answer the request. Correspondence remains for as long as the enquiry and any necessary supporting evidence are being handled; statutory retention duties and specific legal claims may require longer retention.
13. Minors and changes
Minors should use the service with any guardian permissions required where they live. Their particular protection needs are considered when handling requests and reports. The game does not perform technical age verification.
Material changes to processing or providers require an updated notice. Its version identifies the document shown. Updating a notice does not retroactively authorise a new purpose requiring consent.