Privacy Policy

Overview

WoS Atlas is built to need as little information about you as possible. You can browse without an account. We do not sell your data or build advertising profiles, and the only analytics that sets cookies is optional and stays off until you opt in.

Accounts

An account is optional. You need one for features such as saved favourites, notifications, support tickets, live lookups and purchases.

If you create one, we store:

• Your email address, used to identify the account at sign-in and to send account mail: confirmation links, password-reset links, a notice when your password changes, and replies to your support tickets. We also record whether the address is confirmed and whether mail to it has bounced.
• Your password as a one-way bcrypt hash. We never store, log, or are able to read the password itself.
• The in-game player and alliance IDs you have favourited — public game identifiers, not personal data about you.
• What you do with account features: the live lookups you request and their results, the tracks and shield watches you set up, your notifications, and every change to your balance.
• The language the site and its emails use for you.
• Session records, so a sign-in can be recognised and revoked. Each one stores the IP address and browser user-agent string it was created from, alongside the account it belongs to and when it was issued.
• The IP address and browser user-agent string captured when you created the account. We keep these to investigate abuse — bulk sign-ups, credential stuffing — and to help recover an account.
• If you joined through an invite link: which invite it was, and the IP address and browser user-agent string from when it was attached, so invite rewards cannot be farmed.

Session records expire 30 days after they are issued and are deleted seven days after that. Everything else attached to an account is kept for as long as the account exists. Purchase and payment records may be kept after that where we need them for accounting, tax, fraud prevention or a dispute.

Signing in sets two strictly necessary first-party cookies that carry your session. They are HTTP-only (page scripts cannot read them), they are never used for analytics or cross-site tracking, and they sit outside the analytics consent banner below — without them a signed-in session cannot work at all. Signing out deletes them and revokes the session on the server.

Linked game accounts

If you link a Whiteout Survival account, we store its player ID and Chief ID, its State, its name and its Furnace level at the time of linking, together with the record of the check that proved it is yours. A link lets limits and purchase blocks follow a game account rather than an email address. You can remove the link from your account at any time.

Purchases and payments

For each purchase we keep what was bought, the price and currency, when it was made and completed, the account and linked game account it was for, the payment processor's reference, and whether it was refunded or disputed.

Paid purchases are processed by Paddle, which acts as the merchant of record. To open a checkout we send Paddle your account's internal ID, the item, your language, and the IP address your request came from, which Paddle uses to work out your country and the currency and tax that apply there. You give your payment details to Paddle directly, and Paddle handles them under its own privacy policy.

Paddle tells us when a payment completes, is refunded or is disputed. Those notices can include details you gave at checkout, such as your name, email address and country, and we keep them with the purchase record.

Support tickets and reports

When you open a support ticket we keep its topic, subject, your messages and our replies, the language of the page you wrote from and the language we detect in what you wrote, and a log of what was done on the ticket.

Feedback you leave — a rating, an optional comment, its topic and the page language — is kept with your account.

If you report a record you believe is wrong, we keep the report and the account that sent it. Email you send to our support address is kept in that mailbox.

To answer you, support can see your account's details, linked game account, balance and purchases.

Deleting your account does not delete its support tickets or feedback: open tickets are closed, and their messages are kept in case they are needed to settle a dispute.

Who we share data with

We do not sell personal data. We share it only with the services that run the site, each for its own part of the job:

• Hetzner, which runs the servers our database and API live on.
• Cloudflare, which delivers the website and protects it from abuse. It handles every request, including its IP address and browser user-agent string, and gives us aggregate, cookieless traffic measurements.
• Resend, which sends our email. It receives your email address and the message.
• Paddle, for paid purchases, as described above.
• Google — only if you accept analytics, as described below.

We may also disclose information where the law requires it.

What we do not collect

• No real name, and never your game login or password.
• No card or bank details — you give those to the payment processor, not to us.
• No advertising or ad-network trackers.
• No cookies used to follow you across other sites.

Analytics and cookies

We use Google Analytics (GA4) to understand aggregate usage of the site, such as which pages are visited. Analytics is strictly opt-in: no analytics script loads and no analytics cookies are set until you click Accept on the cookie banner.

If you accept, Google sets a small number of first-party cookies (such as _ga and _gid) that distinguish visitors and sessions. These are used only for aggregate statistics — not to identify you personally or to follow you across other websites. Before you choose, you can click Decline on the cookie banner and no analytics is loaded. If you have already accepted, you can withdraw consent at any time by clearing these cookies (or all site data) through your browser; declining on the banner also clears them and reloads the page. Analytics also never loads for automated or bot traffic, or on non-production preview builds.

Server logs

Like almost every website, the server that delivers the Atlas keeps standard, short-lived access logs — for example the requesting IP address, the page requested, and the browser's user-agent string. These logs exist only to operate and debug the service and to protect it from abuse. They are not used to build profiles or to track individuals, and they are retained only briefly before being discarded.

Data you would want removed

If you browse without an account, we hold no personal data about you at all. The game-map information shown by the Atlas is public in-game data, not personal data we hold about you.

If you have an account, the personal data we hold is what this policy lists as attached to it. You can remove a game-account link yourself from your account.

You can delete your account yourself at any time from your account page. If you cannot sign in, or you want a copy of your data, open a support ticket or write to support@wosatlas.com.

Deleting your account signs it out everywhere and removes or anonymises the personal data attached to it: its email address and password, sessions, language, the IP addresses and browser details captured at sign-up and when an invite was attached, favourites, follows, notifications, game account link and the results of its lookups. Unused lookups and any remaining pass time are forfeited. We keep purchase, payment and dispute records, the history of balance changes and of the lookups it paid for, the invite records rewards are paid from, and a record of which game account was linked and what it earned so rewards cannot be claimed twice, for accounting, tax, fraud prevention or legal reasons. Your email address can still appear inside the records we keep: purchase and payment records, the text of support tickets, and the log of admin role changes.

Your rights

Depending on where you live, you may have the right to access, correct or delete your personal data, to receive a copy of it, and to object to or restrict some processing. Contact us as described above to use any of them.

Where your data is processed

Our servers and the services above may process your information outside the country you live in, under data-protection laws that may differ from yours.

Children

Accounts are for people aged 13 and over. The Atlas is not directed at children under that age, and we do not knowingly collect personal information from them. If you believe a child under that age has created an account or given us personal information, write to support@wosatlas.com (or open a support ticket if you have an account) and we will delete the account and the personal information we hold about that child, except where the law requires us to keep it. Paid purchases need the minimum age set out in the Terms of Service.

Changes

If this policy changes, the "last updated" date above will change with it. Continued use of the site after an update means you accept the revised policy.

Contact

Questions about this policy or a privacy concern: open a support ticket or write to support@wosatlas.com.