Privacy Policy

What we collect

• Account data — email, username, country, and the password hash. We never store your password in plain text.
• Competition data — trades, equity, ranking and statistics generated by your participation.
• Payment data — the crypto address a payment came from or is sent to, the transaction hash, the network it travelled on, the amount, and the payment identifier our payment provider gives it. No card details of any kind: this platform has never taken a card.
• Identity documents, when you verify in order to be paid. The section below sets out exactly what that means.
• Security data — two-factor secrets, session and refresh-token records, and login history.
• Technical data — IP address, device and browser, used for security and fraud prevention.

Identity documents

Verification is required before a prize is paid out to you. Nothing else needs it: you can register, compete and pay an entry fee without ever verifying.

What we collect. Your full name, date of birth, country and address; the type of document — passport, national identity card or driving licence — and its number; images of that document, up to four files, and a selfie. JPEG, PNG, WebP or PDF.

Where it is kept. The images go into object storage (Cloudflare R2), never into our database. They are not public, and no lasting link to them exists: an administrator reviewing your submission opens each file through a link that expires within minutes, and every one of those views is recorded against the administrator who made it. The document number is encrypted where it is stored, and we keep a keyed hash of it alongside — that hash is what lets us refuse the same document on a second account. The number is never shown back to you in full. The rest of the platform cannot read any of this: everything outside verification sees only a status — none, pending, verified or rejected.

How long we keep it.

• Files you upload but never submit are deleted automatically, about a day after they were uploaded.
• If we reject your submission, the documents are kept for 90 days from the decision — so that it can be contested and re-examined — and are then deleted automatically.
• If you are verified, or your submission is waiting for review, the documents are kept. There is no automatic deletion for them today. An administrator can clear a verification record, and that deletes the images with it.

How we use it

We use your data to run competitions, publish leaderboards, pay prizes, prevent fraud and comply with legal obligations. We do not sell personal data to third parties.

What is public

Your username, country flag, rank and competition performance are public while a competition is running and afterwards in its results. Everything else is controlled by your privacy settings.

Retention

Account and competition records are kept for as long as your account exists, and nothing deletes them automatically today. Payment records are kept as part of our financial records. Identity documents follow the rules in the section above, which are the ones the platform actually runs.

There is no button that deletes your account. Write to support@wwft.io and a person handles it. Data we are required to keep — for financial record-keeping, for fraud prevention, or because a payment is unresolved — is retained in a restricted form.

Your rights

Depending on your jurisdiction you may have the right to access, correct, export or delete your personal data, and to object to certain processing. Write to support@wwft.io and we will respond within 30 days.

Cookies, and what your browser keeps

• One cookie does the work. When you sign in, our API sets a refresh cookie. It is httpOnly, so no script on the page can read it, and signing out clears it.
• The rest stays on your device. Your access token, your display preferences, your chart workspace and your watchlist are held in your browser's own storage. They are not sent to us as such, and they never leave the device.
• We set no advertising cookies and run no third-party analytics.
• If you sign in with Google you are sent to Google and back. If you sign in with Telegram, the page loads Telegram's own login widget. Those are third parties, and their terms apply to what they do.

Contact

Data protection enquiries: support@wwft.io