Privacy Policy

1. What we collect

• When you sign up: your avatar name, email address and password. We store the password only as a salted hash, never in readable form.
• In your profile (optional): real first and last name, postal address, date of birth, country, display name, and whether you want offline messages sent to your email. We use your date of birth and country to decide which age-rated areas you can enter.
• When you use the grid: your inventory and the content you create, the regions you own or visit, when you log in and out, your last location, and records of grid currency and land transactions. Your viewer software also sends technical details when it connects, such as its name and version.
• When you pay: what you bought, the amount, and the reference Stripe gives us. Stripe handles your card details. We never receive or store them.
• When you contact us: the email address, avatar name and message you send through the contact form or a support ticket.
• When you make a copyright complaint: your name, email, postal address, your complaint and the PDF evidence you attach. We email these to our legal team and do not store the PDF on the website. We may share the complaint with the owner of the content so they can respond.
• When you visit the website: your IP address, browser type and the pages you request, which our servers record in standard logs.

Other residents can see your avatar name, your profile and anything you do in public areas. That is how a shared virtual world works.

2. How we use it

Under UK data protection law, we need a lawful basis for each use:

• To provide the service (contract): to run your account, deliver your land and purchases, reset your password, and forward offline messages if you ask us to.
• To keep the grid safe (legitimate interests and legal obligation): to enforce our Terms of Service, investigate reports, prevent fraud and abuse, and apply age restrictions. This includes the child-avatar rules.
• To improve the website and show adverts (consent): through analytics and advertising cookies, only if you choose “Accept all” in our cookie banner.
• To keep records (legal obligation): payment and accounting records.

We do not sell your personal data. We do not send marketing emails unless you have asked for them.

3. Who we share it with

We share only what each service needs to work:

• Stripe processes card payments for land and Wolf Credits.
• Google provides reCAPTCHA on the signup form (spam protection), Google Analytics (visitor statistics), Google AdSense (advertising), Google Translate (the page translation widget) and Google Fonts.
• Google Gemini answers questions you ask our in-world AI assistant. The text of your question is sent to Google to generate the reply.
• Content delivery networks (Cloudflare cdnjs, jsDelivr, jQuery, Tailwind) serve some of the scripts and styles the website uses. When your browser downloads them, these providers see your IP address.
• Police and authorities, when the law requires it, or when we believe someone, especially a child, is at risk.

Some of these providers are based outside the UK. Where data leaves the UK, it is protected by the safeguards UK law requires, such as adequacy regulations or standard contractual clauses.

4. Cookies

• Session cookie (essential): keeps you logged in to the control panel. It is deleted when you close your browser or log out.
• Google Analytics cookies: count visits and show which pages are used.
• Google AdSense cookies: serve and measure adverts, and may personalise them.
• reCAPTCHA and Google Translate may set their own cookies when you use them.

Google Analytics and AdSense do not load until you choose “Accept all” in our cookie banner. We remember your choice for 180 days in a cookie called wt_consent. You can change it at any time with Cookie settings at the bottom of every page. You can also block or delete cookies in your browser settings. The site works without analytics and advertising cookies, but you need the session cookie to log in. You can also opt out of personalised Google adverts in Google’s ad settings.

5. How long we keep it

• We keep account and profile data while your account exists. When you ask us to close your account, we delete your personal details. We keep only what we need for the records below, or to enforce a ban.
• We keep payment and accounting records for six years, as UK tax law requires.
• We keep server logs only as long as we need them for security and troubleshooting.
• We keep records of serious safety breaches, including breaches of the child-avatar rules, for as long as needed to keep banned users off the grid and to help the authorities.

6. Your rights

Under UK GDPR you have the right to:

• ask for a copy of the personal data we hold about you;
• have inaccurate data corrected (you can update most of it yourself in your profile);
• have your data deleted, subject to the records we must keep;
• object to or restrict how we use it, and withdraw consent at any time;
• receive your data in a portable format.

To use any of these rights, contact us through the contact page. We will reply within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk.

7. Young users

The grid is not for anyone under 14, and we do not knowingly collect data from them. If you believe a child under 14 has an account, tell us and we will remove it. Using a child avatar is a different matter: residents may use child avatars, as set out in our Terms of Service.

8. Changes to this policy

We may update this policy. The effective date at the top of this page shows when it last changed. If we make significant changes, we will tell you on the website.