How to read this draft. This is the written data retention policy that the Privacy Policy and the Children's Privacy Notice link to (COPPA's amended rule asks for one: purposes, business need, deletion timeframe). Every row describes the system as built on 2026-10-30 to 2026-11-05 and cites the file it comes from.
[CAPITALISED BLANKS]are periods not yet ruled;[ATTORNEY: ...]notes give our proposal, the alternative and why it matters. Rows marked FIX describe a gap between the code and the policy.
Wampus Data Retention Schedule
Effective [EFFECTIVE DATE] · Owner: Wampus Studios LLC · Reviewed: at least once a year and before any new game or
feature that collects new data
1. Scope
1.1 This schedule covers personal information that Wampus Studios LLC ("Wampus") handles for Chaos Champs, the Wampus ID account shared by Wampus games, the arcade cabinet sign-in, the account page at https://account.wampus.games, and support email at yo@wampus.games. Space Race and later games add rows here before launch.
1.2 Services (each is its own program with its own database): the accounts service (accounts, devices, Wampus ID,
age, names, deletion, cabinet sign-in); stats; purchases; moderation (reports, blocks); settings (remote
game settings); the online game server; the account web page. Today only the online game server is deployed
(Vultr, Dallas, US). The other services are built and tested but not hosted yet; their host is [HOSTING PROVIDER].
1.3 Deletion terms used below. Purge = the accounts service's purge job, which runs every hour and deletes due accounts. Hooks = the messages the accounts service sends to stats, purchases and moderation when an account is deleted; they are written in the same database transaction as the deletion and retried until each service confirms. Unlink = the account ID is removed from a row and the rest of the row is kept.
2. The schedule
| # | Data | Where it is stored | How long | Why | How it is deleted |
|---|---|---|---|---|---|
| 1 | Account record: account ID, player tag, guest / Wampus ID kind, created date, permissions | accounts database | Until the account is deleted: a guest at once; a Wampus ID 30 days after the request (cancellable); a guest that never answered the age question and is unseen for 90 days, automatically | run the account | purge deletes the row |
| 2 | Deletion record ("tombstone"): account ID + deletion date | accounts, stats and moderation databases | [ATTORNEY: proposed indefinitely; alternative 3 years]: contains no name, email or stats |
stop late match results, tokens or reports from re-creating data for a deleted account | not deleted today |
| 3 | Device key: device ID + SHA-256 hash of the 256-bit secret (the secret itself stays on the device) | accounts database | Until the account is deleted or the device is signed out. A Wampus ID's key unused for 180 days is signed out; a guest's never expires | sign the device in | sign-out ends the credential and the purge deletes it with the account [CONFIRM: whether a signed-out device row is deleted or only disabled]; the hourly purge signs out expired keys |
| 4 | Install ID, as a keyed hash (HMAC) on the device row | accounts database | As row 3 | recognise the player's own install for sign-in limits; carry the age lock | with row 3 |
| 5 | Install age record: install ID HMAC + the youngest age group given on that install + the date | accounts database | Outlives guest deletion. [ATTORNEY: proposed [N] years after the last account on the install is deleted; alternative: delete with the account] |
stop a player re-answering the age question by deleting and restarting | not deleted today |
| 6 | Age group (under 13 / 13-15 / 16+ / unknown) + date answered; birth month and year are never stored | accounts database (account row) | Until the account is deleted | apply the Young Player rules | purge |
| 7 | Terms acceptance: newest version accepted + time | accounts database (account row); also on the device (hl.terms.v1) |
Until the account is deleted; the device copy until the app's data is removed | show acceptance; ask again on new versions | purge; the device copy with the app's data |
| 8 | Player name + every past name | accounts database | Until the account is deleted | show names; moderate names | purge |
| 9 | Email address, as HMAC-SHA256 with a secret pepper (the address itself is never stored) | accounts database | Until the account is deleted. Banned accounts: the hash is kept 365 days after the purge | find the Wampus ID at sign-in; stop a banned player making a new ID with the same email | purge; the banned hash after 365 days [CONFIRM: automatic expiry is built] |
| 10 | Sign-in codes (app and account page), hashed | accounts database (web codes in their own table) | 10 minutes, single use, 5 tries | sign-in | expired codes are swept |
| 11 | Wrong-code counter per email per UTC day | accounts database | [CONFIRM: about 1 day] |
stop code guessing | [CONFIRM: swept daily] |
| 12 | Session tokens (15 minutes; signed, not stored by the service); account page tokens (15 minutes, not refreshable) | app memory; the account page's browser sessionStorage |
15 minutes; the page's copy until the browser tab closes | authorise requests | expire; tab close |
| 13 | Deletion messages to other services (account ID + event) | accounts database (outbox) | Until delivered, then 7 days | make sure stats, purchases and moderation delete too | dropped 7 days after delivery |
| 14 | Abuse-limit counters keyed by IP address, email, account, device, venue | memory of each service | Until the service restarts or the window ends; at most 500,000 windows, oldest dropped | rate limits | never written to disk |
| 15 | Cabinet sign-in: QR code (5 minutes, single use); seat token with venue, position and time (15 minutes, refreshed, seat ends 2 hours after the scan) | accounts service and the venue's cabinet system | At most 2 hours; not kept after | run the cabinet seat | expires |
| 16 | Sign-in code email (address + code in the subject) | email delivery provider [EMAIL DELIVERY PROVIDER] |
[PROVIDER'S RETENTION] [ATTORNEY: set a maximum in the provider contract] |
deliver the code | per the provider |
| 17 | Stats per account per game: matches, wins, losses, draws (overall, per mode, per champ), counters, crowns, computer-opponent level + recent form, last 25 results | stats database | Until the account is deleted | show stats; set computer-player difficulty; fairness | deleted hook removes every row |
| 18 | Public profile (name, matches, wins, crowns, most-played champ) | derived from rows 8 and 17 | As row 17; hidden while a deletion is pending | let players see each other's progress | scheduled hook hides it; deleted removes it |
| 19 | Match IDs for duplicate checks | stats database | [CONFIRM: 14 days per app-privacy-answers D7; not found in the stats README] |
stop a result being counted twice | [CONFIRM] |
| 20 | Store purchase rows: item, store, transaction IDs, environment, price (USD + local + currency), times, refunds / revocations | purchases database | While the account exists; after deletion unlinked and kept [N YEARS] [ATTORNEY: tax / refund / chargeback evidence; alternative: delete] |
deliver and restore skins; refunds; business and tax records | deleted hook unlinks; [NOT BUILT: deletion after N years] |
| 21 | Staff-granted skins | purchases database | Until the account is deleted | ownership | deleted by the deleted hook |
| 22 | Ownership audit rows (each change a RevenueCat sync made) | purchases database | As row 20 (unlinked at deletion) | money: trace every ownership change | deleted hook unlinks |
| 23 | RevenueCat customer record (account ID as app user ID, purchase history) | RevenueCat, Inc. | Per RevenueCat; our "delete the RevenueCat customer" switch is built but off | purchase validation, refunds | [ATTORNEY: proposed ON / OFF]; when on, deleted through RevenueCat's API at purge |
| 24 | Store purchase records | Apple, Google | Per Apple's and Google's policies | payments and refunds | not ours to delete |
| 25 | Open reports: reporter, reported tag, name seen, reason, match ID | moderation database | Until closed. If the reporter deletes, the reporter becomes a random deleted: ID; reports against a deleted account stay |
review reports | closing; anonymised by the deleted hook |
| 26 | Closed reports | moderation database | 365 days [ATTORNEY] |
evidence for repeat behaviour and appeals | automatic after 365 days (keepClosedDays) |
| 27 | Staff action log: staff ID, time, action, reports closed, note | moderation database | No limit today [ATTORNEY: proposed 3 years; alternative: as long as the account exists plus N] |
record of moderation decisions | not deleted today |
| 28 | Reports on tags no account has (computer-controlled players, purged accounts) | not stored (one log line without the tag); name-hide counts for such names in a separate table | Counts cleared after 24 hours | keep the report menu identical for bots and people | dropped; table cleared |
| 29 | Hidden names (after 3 reporters in 24 hours) | moderation database | Until staff review | protect players from abusive names | review restores or keeps |
| 30 | Blocks: blocker account, blocked tag, name seen, date | moderation database | Until unblocked or either account is deleted | hide blocked names | unblock; deleted hook |
| 31 | App version sent with a settings request | settings service request only | Not stored per player | serve matching settings | not stored |
| 32 | Live match data: names, champs, skins, inputs | online game server memory | For the match only; results go to row 17 | run the match | discarded when the match ends |
| 33 | FIX: IP addresses in the online game server's log ("room created by", "failed joins") | system journal on the online game server (Vultr) | Until the journal's size cap rotates it (no time limit; [CONFIRM on the box]) |
none intended: the policy says IPs are not logged | proposed: remove the address from these two log lines before launch |
| 34 | Service logs: route, status, time; never emails, codes, tokens, account IDs or addresses | system journal on each host | [JOURNAL RETENTION: proposed 30 days] |
operate and debug the services | journal rotation |
| 35 | Web proxy access logs | none: switched off on purpose for the platform; none configured on the online box | n/a | n/a | n/a |
| 36 | Hosting provider network records | Vultr (online game); [HOSTING PROVIDER] (services); [WEBSITE HOST] (wampus.games) |
[PROVIDER RETENTION] |
the provider's own operations | per provider contract |
| 37 | Backups of every service database (rows 1-30) | on the service machine | Hourly copies, deleted after 7 days (the newest 3 are always kept) | recover from failures | automatic |
| 38 | Off-site backups | [BACKUP STORAGE PROVIDER] |
Every 6 hours, kept 30 days (when switched on) | recover from losing the machine | automatic at the provider |
| 39 | Device secure storage: device key(s), install ID | the player's device (iPhone Keychain, no iCloud sync; Android Keystore, excluded from backups) | On iPhone it survives deleting the app and can move to a new iPhone in an encrypted backup; on Android it goes with the app's data | sign-in without a password; age lock | sign-out / deletion removes the credential; the install ID stays on the device |
| 40 | Device app storage: account copy (hl.acct.v1, moved to secure storage once), owned-skins copy (hl.owned.v1), terms (hl.terms.v1), chosen skins (gr.skins), controller settings (gemrush.sticks.v1) |
the player's device | Until the app's data is removed [CONFIRM: whether account deletion clears hl.owned.v1] |
start fast; work offline | removing the app or its data |
| 41 | Support emails and attachments | Google Workspace mailbox yo@wampus.games | [2 YEARS] proposed |
answer players; record of what we did | [MANUAL deletion by staff] |
| 42 | Privacy and parent requests: who asked, what, when, our answer | [REQUEST LOG LOCATION] |
[24 MONTHS] proposed [ATTORNEY: California's regulations require 24 months of request records for covered businesses] |
show we handled requests | manual |
3. How an account deletion runs (timeline)
| When | Guest account | Wampus ID account |
|---|---|---|
| The player asks (in the game, or on the account page for a Wampus ID) | Deleted at once (rows 1, 3, 4, 6-8 go; hooks fire) | Signed out on every device; public profile hidden (row 18); deletion date shown; can be cancelled |
| Up to 30 days | n/a | Signing in again, "cancel the deletion" on a signed-out device, the account page or staff can cancel |
| Day 30 (next hourly purge) | n/a | Account deleted; hooks fire |
| Hooks (seconds to minutes; retried until confirmed) | stats: every row deleted (row 17); purchases: rows unlinked, grants deleted (rows 20-22); moderation: blocks deleted, reports made anonymised (rows 25, 30) | same |
| Kept after | rows 2, 5 (guest only), 9 (banned only), 20, 22, 23, 24, 25 (reports against), 26, 27 | rows 2, 9 (banned only), 20, 22, 23, 24, 25-27 |
| Backups | gone from on-machine backups within 7 days and from off-site backups within 30 days | same, counted from the purge |
4. Legal holds
If we receive a legal demand, a dispute or a regulator's request, we may keep the specific data it concerns past these
periods until the matter ends. [ATTORNEY: confirm wording and who may order a hold.]
5. Review
Wampus reviews this schedule at least once a year, and before any new game, feature, service provider or data use. Each change is recorded in docs/DECISIONS.md with the date and who approved it.