Privacy Policy
Last updated: 17 October 2026
This policy explains what personal data uuo.app ("we", "us") collects when you use the uuo.app website, the Wasteland Project game, its game servers and the Support shop (together, the "Services"). It also covers how we use that data, who we share it with, how long we keep it and what your rights are. We follow the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where they apply, the EU GDPR and other local privacy laws.
1. Who is responsible for your data
The data controller is uuo.app, the operator of the Wasteland Project. To contact us about privacy, email support@uuo.app with "Privacy" in the subject line.
2. What we collect
| Data | Where it comes from | Why | Legal basis |
|---|---|---|---|
| Account: your SteamID (the permanent identifier of your account), your public Steam display name (used as your callsign and updated when you sign in), account creation date and sign-in times. Accounts made before Steam sign-in may also hold a callsign, email address and password hash (one-way, never readable) until they are linked to Steam | You, when you register | Creating and securing your account, signing you in, confirming your email and recovering your account | Contract |
| Sign-in and security: IP address, login times, failed login attempts, session and login tickets | Automatically, when you sign in or connect | Preventing brute-force attacks, fraud, cheating and abuse; rate limiting; keeping the Services secure | Legitimate interests |
| Game data: characters and appearance, inventory, position, stats, progress, camps, companions, playtime and other in-game state | The game, while you play | Running the game and saving your progress | Contract |
| Gameplay and server logs: join and leave times, in-game actions, errors and crash information, connection data | Our game servers | Running and fixing the game, investigating cheating, exploits and rule-breaking, balancing the game | Legitimate interests |
| Communications: in-game chat, reports, and emails you send us | You | Delivering your messages, moderating to enforce our rules and keep players safe, answering support requests | Contract; legitimate interests |
| Purchases and donations: what you bought or donated, the amount, date, order or transaction ID and payment status | You and our payment providers | Delivering what you paid for, refunds, preventing fraud, keeping tax and accounting records | Contract; legal obligation |
| Steam: sign-in confirmation from Steam (via Steam OpenID; Steam never shares your Steam password with us), authentication tickets and in-game purchase records | Valve / Steam | Signing you in with Steam and processing Steam purchases | Contract |
| Device and game data: game version, operating system, download and update requests | The game and website | Delivering the right updates and investigating technical problems | Legitimate interests |
We never see or store your full card or bank details. PayPal and Steam handle those. We don't sell your personal data, we don't use it for third-party advertising and we don't build advertising profiles.
3. Cookies and local storage
The website uses only strictly necessary storage, such as a sign-in session token kept in your browser so you stay signed in. We use no advertising or cross-site tracking cookies, so we don't ask for cookie consent. If you block this storage, signing in won't work.
4. Who we share data with
We share personal data only as far as each of these needs it:
- Service providers who work for us: hosting and content delivery (including Cloudflare for downloads), our email provider for confirmation and recovery emails, and Valve/Steam and PayPal for payments and sign-in. Each may only use the data to provide its service.
- Other players see what is public by nature of an online game: your callsign, character, in-game actions, and the messages you send in shared chats.
- Authorities or others when the law requires it, or when we need to protect the rights, safety or property of our players, the public or us. This includes investigating fraud, cheating, harassment or threats.
- A successor, if the Services are sold or transferred. That successor stays bound by this policy for data already collected.
5. International transfers
Some providers, such as Cloudflare, PayPal and Valve, may process data outside the UK or EEA. When they do, we rely on adequacy regulations or standard contractual clauses, such as the UK International Data Transfer Addendum, so that your data stays protected.
6. How long we keep data
- Account and game data: while your account exists. When you ask us to delete your account, we delete or anonymise this data within 30 days. Database backups roll over and are cleared within a further 30 days.
- Security and server logs: up to 90 days, or longer when needed for an open investigation into abuse or fraud.
- Purchase records: up to 6 years, because UK tax and accounting law requires it.
- Records of bans for serious rule-breaking: as long as needed to stop banned players from coming back, and only the minimum data needed for that.
7. Security
Passwords are hashed with Argon2id. Login tickets are signed and expire. Databases accept connections only from our own servers, and login attempts are rate-limited. No system is completely secure, though. If a data breach is likely to put you at risk, we will tell you and the Information Commissioner's Office (ICO) as the law requires. Protect your Steam account with Steam Guard.
8. Your rights
Depending on where you live, you can ask us to:
- give you a copy of your personal data (access);
- correct data that is wrong (rectification);
- delete your data (erasure);
- limit how we use your data (restriction);
- send your data to you or to another service in a common format (portability);
- stop processing that relies on legitimate interests (objection).
Email support@uuo.app from the address on your account. We will answer within one month. We may ask you to prove who you are before we act on a request. If you're unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office at ico.org.uk or to your local data protection authority.
9. Children
The Services are not meant for children under 13, and you must be at least 13 to create an account. If you are under the age of digital consent where you live, a parent or guardian must agree first. If we learn that we hold data from a child under 13 without the consent this requires, we will delete it. Parents can contact support@uuo.app.
10. Moderation and anti-cheat
To keep the game fair and safe, we may review chat messages, content that has been reported, gameplay logs and connection data. We may then warn, suspend or ban accounts. People make these decisions. We don't make decisions about you that have legal or similarly significant effects by automated means alone.
11. Changes to this policy
We may update this policy as the Services change. The date at the top shows the latest version. If a change is significant, we will announce it on the website or in the game before it takes effect.
12. Contact
uuo.app · Wasteland Project · support@uuo.app