Privacy policy

Who is responsible

The controller is Wolfram Alexander Freiherr von Funck, known as Wollay, based in Barcelona, Spain. For privacy questions or requests, email hello@wollay.com.

Google sign-in

Signing in with Google is optional. You can also register with an email address and password. If you choose Google sign-in, Google and Firebase Authentication provide an account identifier, your email address and verification status, and basic profile information such as your name and profile picture, where available. Authentication credentials and tokens are processed to sign you in and maintain your session.

We use this information to create or identify your Wollay account, link sign-in methods when you request it, verify your identity, and authorize account features, game access and downloads. Your chosen Wollay username is separate from your Google profile.

We do not request access to your Gmail messages, Google Drive files, contacts, calendar, or other unrelated Google content. Your Google password is handled by Google and is not provided to us. Google sign-in information is not sold or used for advertising or to train general-purpose AI models.

You can review or revoke the connection in your Google Account connections. Revoking access does not by itself delete your Wollay account or previously stored data. Contact us if you want that data deleted.

Other data we process

• Account and access: your account ID, email address, sign-in provider, verification and sign-in records, chosen username, access grants, and account restrictions.
• Game and social features: characters, progress, inventory and customized items, saved positions, Journal discoveries, friends, invitations, online presence, and communications you send through these services. Other players can see information needed for gameplay and social interactions, such as your username, character and online presence.
• Player activity: account-linked play sessions, first observed play, playtime and return visits. Private administration reports use these records to show aggregated activity, concurrent players and retention.
• Feedback and support: messages, bug reports, suggestions, votes, attachments and any diagnostic files you choose to send. Published feedback topics, comments and images can be visible to other users or the public, depending on where they are published. Please avoid including passwords, credentials or other private information in submissions.
• Technical and security information: IP addresses, connection times, requested resources, software or device information, error details, and security or anti-cheat events needed to deliver, troubleshoot and protect the services.

Purposes and legal bases

Where the GDPR applies, we process account, authentication and gameplay data to provide the services you request and perform our agreement with you (Article 6(1)(b)). We process necessary technical records, security events, support and feedback, and player activity statistics for our legitimate interests in operating secure services, preventing abuse, fixing problems and improving the game (Article 6(1)(f)). We may also retain information where required by law (Article 6(1)(c)). Where a separate feature requires consent, we ask for it, and you can withdraw it for future processing (Article 6(1)(a)).

Security checks can automatically reject invalid actions or restrict accounts when suspected cheating or abuse is detected. If you believe a restriction is incorrect, contact us to request a human review. Feedback may be processed with automated or AI-assisted tools to categorize reports, summarize issues and help prepare responses.

You can read public pages without creating an account. Account information is necessary for features that require sign-in, and online gameplay requires the processing of game and connection data.

Sharing and service providers

We use service providers to host the website and game, authenticate users, store data and deliver content. These include Google/Firebase/Google Cloud, Cloudflare and OVHcloud. Feedback and support material may also be processed with tools provided by Google or OpenAI for the purposes described above. Access to non-public data is limited to what is needed for the relevant service, administration or support.

We do not sell personal data. We may disclose information when necessary to comply with legal obligations, respond to lawful requests, or protect users and the services. Public posts and information shared with other players are visible to their respective audiences.

Providers and game servers may process data outside your country, including in the European Economic Area and the United States. Where required, transfers rely on an applicable adequacy decision or contractual safeguards such as the European Commission's Standard Contractual Clauses. You can contact us for information about the safeguards relevant to your data.

Cookies and local storage

Authentication uses browser storage and related technologies to maintain sessions and complete sign-in. The website and launcher also store necessary preferences and account state locally. The launcher keeps sign-in credentials on your device so it can renew your session, and the game stores settings and local saves or logs where applicable.

We do not use Google Analytics or advertising trackers on this website. Our player activity statistics come from online game sessions. You can clear browser storage or sign out to remove local session state; doing so may require you to sign in again. Embedded third-party content, such as videos, can contact its provider when loaded and is subject to that provider's privacy practices.

How long we keep data

Retention depends on the purpose of the data. Account records, access grants and game progress are kept while needed to provide and maintain your account and saved progress. Feedback is kept while useful for support, issue tracking or development. Technical logs and security records are kept as needed to troubleshoot problems, investigate abuse and handle disputes.

Account-linked activity records are retained to measure playtime and long-term return patterns; they are not automatically deleted when a dashboard's displayed date range ends. Backups and records required for legal or security reasons may remain after a deletion request for as long as those purposes require. We assess deletion requests against these purposes and explain any information that must be retained.

Your choices and rights

Where applicable, you can request access to your personal data, correction, deletion, restriction of processing, or a portable copy. You can object to processing based on legitimate interests and withdraw consent where processing relies on consent. These rights may be subject to legal exceptions.

Send requests to hello@wollay.com. We may need to verify account ownership before providing, changing or deleting data. You can also complain to your local data protection authority. In Spain, this is the Agencia Española de Protección de Datos (AEPD).

We update this policy when our practices change. The date above identifies the latest revision; material changes will be communicated where required.