Privacy and Cookie Policy

1. Data controller

The controller of personal data is Webrevolution Szymon Kosok, ul. Nowa 21/10, 41-908 Bytom, Poland. Contact for data matters: szymon@mwg.pl.

2. Data we collect

  1. Account data: e-mail address, password (stored only as a secure hash), nickname and the data of characters you create in the game.
  2. Gameplay data: content created in the game (characters, books, songs, posts, comments) and game statistics.
  3. Payment data: order or purchase identifiers, amounts, entitlements and transaction or subscription status. Card and bank details are processed exclusively by payment providers (PayU, Stripe, Apple App Store or Google Play) - we never have access to them. RevenueCat may process the user and purchase identifier and entitlement status. For web orders we store the IP address and browser identifier to prevent abuse.
  4. Technical, notification and security data: server logs, error reports, a browser security identifier, the public mobile-installation identifier, device platform and name, application version, language, time zone, notification preferences, Expo push token, a hash of the device secret, and a hash of the connection network. These data are used to maintain the service, deliver selected notifications, restore an account on its device, limit automated account creation and prevent abuse. During registration, Cloudflare Turnstile receives technical connection data to verify that the request comes from a human.
  5. Analytics data: our first-party product statistics include an ephemeral session identifier, a canonical section/route name, bounded registration-journey events (such as open, attempt, success or failure, without field values or error text), platform and device category, language, the country code supplied by Cloudflare, referring domain, UTM labels, and aggregate mobile-call quality parameters. If you consent to analytics during registration, the UTM source and campaign name linked to the account help us measure acquisition effectiveness. Once signed in, an event may be linked to the account and active character. Analytics does not store an IP address, full user agent, URL parameters or player content. Separately, Google Analytics 4 with IP anonymisation runs only with your consent.
  6. Content passed to AI features: data entered when generating content (e.g. character descriptions, song parameters) is passed to external AI providers to deliver the service.

3. Purposes and legal bases

  1. Account and gameplay - performance of a contract, GDPR art. 6(1)(b).
  2. Payments and complaints - GDPR art. 6(1)(b) and (c).
  3. Security, abuse prevention and diagnostics - legitimate interest, GDPR art. 6(1)(f).
  4. First-party service analytics and improvement - legitimate interest, GDPR art. 6(1)(f); optional Google Analytics 4 - consent, GDPR art. 6(1)(a).
  5. Technical messages such as registration confirmation and password reset - performance of a contract.

4. Data recipients

  • Twilio SendGrid - e-mail delivery (e-mail address).
  • PayU S.A., Stripe, Apple and Google - payment and in-app purchase processing.
  • RevenueCat - synchronisation of purchases, entitlements and subscription status.
  • Expo - delivery of push notifications to devices on which the User enabled them.
  • Google Ireland Ltd. - Google Analytics 4 statistics (with consent).
  • Functional Software, Inc. (Sentry) - application error monitoring.
  • Cloudflare, Inc. - bot protection for registration (Turnstile).
  • OpenAI and ElevenLabs - AI content generation (graphics, texts, audio) based on data entered in the game.
  • The service infrastructure provider.

Some providers may process data outside the EEA under standard contractual clauses or adequacy decisions. Data may be disclosed to authorised authorities on a valid legal basis.

5. Retention

  1. Account data - for as long as you use the service. After a deletion request, access is disabled immediately and deletion or anonymisation normally completes within 24 hours. Accounts inactive for a prolonged period may also be deleted together with related data.
  2. Order data - for the period required by tax and accounting law.
  3. Technical logs and error reports - up to 90 days.
  4. Registration source and campaign - until the account is deleted or earlier removal is requested.
  5. Raw first-party analytics sessions and events - normally up to 400 days; configuration may shorten this period. Account deletion deletes or unlinks the account identifier according to the record relationship.
  6. An unverified provisional account without a durable device link is deactivated after 24 hours if registration is not completed and anonymised after a further 7 days. An account linked to an application installation is retained like an active account until deletion or expiry after prolonged inactivity. Hashed security counters are deleted 7 days after their window closes.

6. Your rights

You have the right to access, rectify, erase and port your data, to restrict processing and to object to first-party analytics based on legitimate interest. You can delete your account in the application or website Settings; public instructions are available at wonderlife.gg/account-deletion. You can withdraw consent to optional Google Analytics at any time in Cookie settings at wonderlife.gg by choosing “Necessary only”. Consent expires automatically after 12 months and we will ask again. You also have the right to lodge a complaint with your supervisory authority (in Poland: the President of the Personal Data Protection Office).

7. Cookies and similar technologies

  1. Necessary (always active): the login session cookie, language selection cookie, registration security identifier (up to 30 days), and the cookie-consent choice. Without them the service cannot work or safely offer registration.
  2. Preferences (always active, stored locally): selected colour theme and time zone - stored in your browser (localStorage), never sent anywhere.
  3. First-party analytics writes no cookie or browser-storage identifier; a random identifier lives only in the open page's memory and is recreated after a full reload.
  4. Analytics (optional, with consent): Google Analytics 4 cookies (_ga and related) used for anonymous visit statistics. Loaded only after you consent in the banner.

You can accept or decline in the cookie banner on your first visit. Your choice is stored in your browser.

Last updated: 2026-08-04

An error has occurred. Reload