Privacy Policy

1. Who we are

Wuthering Builds ("we", "us") is an independently operated fan website based in New Zealand for the physical Wuthering Waves card game. The Wuthering Builds site operator is responsible for the personal information described here. We are not affiliated with or endorsed by the game publisher.

For privacy questions, access or correction requests, or account deletion, contact the site operator and privacy contact at [email protected]. Our website is https://wutheringbuilds.xyz.

2. Information we collect

From you: your email address, public username, account details, and any support messages you send us. We also store the decks you save, including names, descriptions, card selections, artwork references, tags, visibility settings, and creation or update times. Email-and-password registration uses Supabase authentication; passwords are stored as hashes, not readable passwords.

From a sign-in provider you choose: Google, or Discord or Apple when enabled, may provide an account identifier, email address and verification status, and basic profile information such as a display name or profile image. Supabase processes that information to create or link your account and establish a session. We do not receive your provider password.

When the website is used: our hosting and authentication services may process IP addresses, browser or device information, request times, sign-in events, and security or error logs. Browser storage holds sign-in sessions and preferences, such as administrator player-view mode.

3. Why we use it and your choices

We use this information to sign you in, save and retrieve your decks, show your chosen public content, provide support and account messages, maintain the service, prevent abuse, and meet legal obligations. We do not sell personal information or use account information for targeted advertising.

Registering and providing information are voluntary, not required by a law compelling you to use this site. You can browse public content and use the builder without an account, but saving decks to an account requires account information. Do not include sensitive information or another person's private information in usernames or deck descriptions.

4. Google account information

Google sign-in uses basic identity permissions: openid, email, and profile. We use the resulting information for authentication, account management, support, and security. Wuthering Builds does not request access to your Gmail messages, Google Drive files, contacts, or calendar.

Our use and transfer of information received from Google APIs will follow the Google API Services User Data Policy, including Limited Use requirements where applicable. We do not sell Google user data, use it for advertising, or use it to train general-purpose AI or machine-learning models.

You can remove the connection in your Google Account connections settings. Removing that connection does not itself delete your Wuthering Builds account or previously saved information; contact us to request deletion.

5. Public decks, private decks, and exports

Your username is public, even when your decks are private. Public decks and their author names, descriptions, tags, card lists, and statistics can be viewed, copied, and indexed by others. Your account email and sign-in information are not shown publicly by the site.

Private decks are accessible to their owner and site administrators. Administrators can view, moderate, edit, and delete decks for site administration and support. Private decks are access-controlled; they are not encrypted so as to exclude the operator or the service providers operating our systems.

Changing a deck to private or deleting it does not recall exports, screenshots, cached copies, or copies other people already saved. Downloaded images, text, JSON, and offline deck codes can carry the deck contents regardless of the website's privacy setting. Share exports only when you intend to share that build.

6. Service providers and overseas processing

Cloudflare hosts the website; Supabase provides authentication, the database, and card-image storage; jsDelivr delivers a JavaScript library. Our configured email services handle account and support messages. These services process the information needed for their roles. A sign-in provider also processes your login under its own terms and privacy policy.

These providers and their infrastructure may be outside New Zealand, so information can be stored or processed overseas. We remain responsible for information processed on our behalf and will use safeguards required by applicable law. We may also disclose information where lawfully required or reasonably necessary to investigate abuse or protect users' rights or safety.

The current site does not add advertising or analytics trackers. Essential browser storage supports sign-in and preferences, and hosting, authentication, or security services may use cookies or similar technology. Clearing browser storage can sign you out or remove preferences and unsaved work. Following a Discord, Twitter/X, or other external link takes you to a service with its own privacy practices.

7. Security and retention

We use measures such as HTTPS, authenticated access, and database permissions to help protect information. No online service or backup is completely secure; keep your credentials safe and contact us about suspected unauthorised access.

Account information and saved decks are kept while needed to provide your account or for another lawful purpose. You can delete individual decks through the site or ask us to close your account. Following a verified deletion request, we remove account information and associated decks from active systems unless retention is reasonably necessary for security, a dispute, or a legal obligation. Provider logs and backup copies may remain until their applicable retention periods expire; deletion is not a promise of immediate removal from every backup or third-party copy.

8. Access, correction, deletion, and complaints

Email [email protected] to request access to your personal information, correct it, request deletion, or raise a privacy concern. We may ask for proportionate information to verify that the account or information is yours. Do not send passwords, login tokens, or API secrets.

We respond to access and correction requests as soon as reasonably practicable and within the period required by law, generally 20 working days under New Zealand's Privacy Act 2020 unless a lawful extension applies. If we decline a correction, you can ask for a statement of the requested correction to be attached.

You can raise concerns with the New Zealand Office of the Privacy Commissioner, or an applicable privacy authority where you live. Additional rights under applicable local law are not limited by this policy.

9. Young users and policy updates

Young users should involve a parent or guardian and follow the age rules of their sign-in provider and applicable law. A parent or guardian concerned about information submitted by a child can contact us at [email protected].

We may update this policy when the site or its practices change. We will update the date and provide a prominent notice of material changes before they take effect where practicable or required by law. If a new use requires consent, we will seek it rather than treating this policy as permission for unrelated uses.