In this Terms of Service, Privacy Policy and Statutory Disclosures (the “Agreement”): the “Services” are the games, communications, digital tools, APIs, Android client functions and pages offered via wusper.com, game.wusper.com, privacy.wusper.com, pay.wusper.com, other live subdomains, and /tools/* paths. The “Operator” is the individual maintainer who decides why and how personal data are processed: the “data user” under section 2 of the Personal Data (Privacy) Ordinance (Cap. 486) (the “PDPO”); the “controller” under Article 4(7) GDPR where the GDPR applies; and a CCPA “business” only if the statutory thresholds are met. “Personal data” has the Cap. 486 section 2 meaning. GDPR “personal data” and CCPA “personal information” are read under those laws when they apply, and are often wider. “Processing” includes collection, holding, use, disclosure, erasure, transfer and anonymisation. “Virtual items” are in-service markers only. “UGC” is user-submitted text, images, room names, skins, chat or world objects.

This Agreement is between you and the Operator. Access, registration, a click to agree, or other use is acceptance. If you disagree, stop and clear local cookies, localStorage and IndexedDB. A click or continued use is consent recorded electronically. Sections 5, 6 and 17 of the Electronic Transactions Ordinance (Cap. 553) are cited for the concepts of electronic records, electronic signatures and retention. This citation is not an opinion that every click is an electronic signature under section 6.

Non-material clarifications take effect when posted. Material changes to collection, use, retention, cross-border transfer, or dispute resolution take effect only after at least seven days’ notice on this page where practicable, plus a banner and/or email to registered users when we have an address. This edition is published on 2 October 2026 and takes effect on 9 October 2026, so that the seven-day period is observed. Client keys gh_privacy_ok and gh_privacy_version may re-prompt when the document identifier changes. Continued use after the effective date is acceptance. Mandatory protections under Directive 93/13/EEC and the Unconscionable Contracts Ordinance (Cap. 458) are not waived by that fiction.

The Services are for persons with capacity to contract. Under the Age of Majority (Related Provisions) Ordinance (Cap. 410) the age of majority in Hong Kong is 18. You must self-attest majority where you live, or parental or guardian consent after review of this Agreement.

There is no technical age gate on OAuth, email one-time passwords, or guest login. The Services are not directed to children under 13 within 15 U.S.C. §§6501–6506 and 16 C.F.R. Part 312. We do not knowingly collect personal data from children under 13 for the purpose of targeting them. If we gain actual knowledge that we have done so, we will delete it and disable the account. Article 8 GDPR (member-state digital age of consent between 13 and 16) is not the basis on which this project offers the Services to children. A guardian may email us to locate and, once reasonably verified, disable or delete a minor’s account.

You may sign in by OAuth (Google, and Discord or Microsoft if enabled), email one-time passwords, or other methods we offer. OAuth depends on the provider returning email, display name, avatar URL and a provider user identifier. We do not ask the provider for your provider password. Keep credentials and signed-in devices secure. Activity under the account is generally treated as yours. Sharing, transfer, rental or sale of accounts is prohibited. On suspected compromise, disconnect, revoke and notify us.

Guest accounts have a seventy-two-hour time-to-live, after which related data are physically deleted, generally without individual notice, restoration or compensation. The twelve-hour session cookie and the seventy-two-hour guest account are different clocks (Section 31). You agree not to impersonate, not to circumvent controls, to remain responsible for malware, leaked cookies and extensions you authorised, and to comply with computer-misuse, telecom, copyright, harassment and anti-cheat laws, including section 161 of the Crimes Ordinance (Cap. 200) as narrowed by the Court of Final Appeal, and 18 U.S.C. §1030.

Subject to this Agreement we grant a personal, non-transferable, non-exclusive, revocable, limited licence for personal, non-commercial use. No intellectual-property ownership passes. Site appearance, code, copy, audio, art other than your UGC, and this text remain with the Operator or licensors. Works protected by the Copyright Ordinance (Cap. 528) may not be copied or communicated to the public without permission.

You must not reverse engineer except where mandatory law allows; abuse the Services with bots, scrapers or cheats, including memory reading in gomoku or other matches; launch denial-of-service attacks or malware; resell toolkit capacity; circumvent Gauntlet, in-app browser blocks or blocklists; harass, threaten, post hate speech, sexual exploitation, or child sexual exploitation prohibited by the Prevention of Child Pornography Ordinance (Cap. 579); publish another person’s personal data without authority, including an IP visible to you via peer-to-peer, which may also engage section 64 of the PDPO as amended; or use the Services for fraud, money-laundering, unauthorised commercial proxy or VPN operations, or to help others break the law.

Points, coins, pets, skins, ranks, experience and other virtual items are digital markers for feature access. They have no fiat value, are not securities, deposits, stored-value facilities under the Payment Systems and Stored Value Facilities Ordinance (Cap. 584), or e-money. We do not currently sell them for fiat as a primary model. The pay.wusper.com skin is a joke check-in mapped to /api/easter_egg/fake_recharge. Alipay, WeChat and card radios are not wired to an acquirer. Do not type real card numbers or payment passwords there. Virtual items do not acquire cash value merely because a paid feature might appear later.

We may modify, freeze, revoke or reset virtual items for balance, exploits, anti-cheat, system changes or shutdown. Off-platform real-money trading is prohibited. Items vanish on account deletion, guest expiry or project end and are not a debt. This project does not operate a virtual-asset exchange or a Cap. 615 Schedule 3B virtual-asset service. If that characterisation ever changed, the feature would stop until licensing was addressed. This page does not imply a licence.

The PDPO and Schedule 1 Data Protection Principles are the primary frame, because the Operator and the contact point are in Hong Kong. The GDPR or UK GDPR may apply under Article 3(2) if services are offered to data subjects in the EEA or the United Kingdom. A US state law may apply if its business threshold is met. We have not appointed an Article 27 representative, have not filed a formal EU data-protection impact assessment, and do not claim the CCPA business threshold. Section 14 nonetheless grants contractual access, correction, erasure, restriction, portability and objection rights, with a target of forty days aligned to PDPO access practice and one month aligned to Article 12(3) GDPR.

We do not sell personal data to brokers, do not exchange it for money or other valuable consideration, and do not “share” it for cross-context behavioural advertising. That statement addresses the CCPA/CPRA definitions of sale and share, the Nevada NRS 603A opt-out of sale, and PDPO Data Protection Principle 3. Subdomain session sharing exists so the toolbox and the game can see one login. It is not cross-site ad tracking.

Under section 2 of the PDPO the data user is the person who controls the collection, holding, processing or use of personal data. The person who operates the Services and decides purposes and means is that data user. The PDPO has no general registration scheme. This section is not a filing with the Privacy Commissioner.

The table maps Schedule 1. DPP1: collect for a lawful purpose, by lawful and fair means, and not excessively. DPP2: accuracy and retention no longer than necessary. DPP3: no new purpose unless directly related, consented, or exempt. DPP4: practicable security steps. DPP5: openness. DPP6: access and correction, given statutory form by sections 18 and 22. The table is an explanation, not a filing.

Section 18 creates the data-access request. The data user must comply within forty days or explain. Section 22 creates correction. Section 20 lists refusals, including other persons’ data, crime prevention and legal privilege. We do not charge for access. The PDPO has no general erasure right identical to Article 17 GDPR. Account deletion is a contractual right, subject to logs, backup rotation and legal holds. Section 64, as amended in 2021, criminalises certain disclosure of personal data without the data user’s consent. You must not use the Services for doxxing.

Section 33 on cross-border transfer is not fully in force. Section 15 still lists real processors so you are not told that data remain only in a Hong Kong rack.

Part VIA of the PDPO regulates use of personal data in direct marketing and provision of personal data to others for direct marketing. Consent and an opt-out are the statutory model. We do not use personal data collected through the Services for that purpose and do not plan promotional electronic messages. One-time passwords and policy notices are operational.

Article 3(1) GDPR applies to establishment in the Union. This project has none. Article 3(2) applies to offering goods or services to data subjects in the Union, or monitoring their behaviour there. EDPB guidance looks for an intention to offer services in the Union. The Services are in Traditional Chinese and English, resolve globally, and have no EU-specific marketing, euro pricing or Union representative. If a supervisory authority nonetheless treats Article 3(2) as engaged, this Section is the arrangement that answers it. The UK GDPR and Data Protection Act 2018 apply separately. The ICO is the United Kingdom authority. No United Kingdom representative is appointed.

Where the GDPR applies we process under Article 5: lawfulness, fairness, transparency, purpose limitation, minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability. Article 6(1)(b) covers processing necessary for this Agreement (account, match, toolkit). Article 6(1)(f) covers security, abuse defence, debugging and service integrity, balanced against your interests. Location is Article 6(1)(a) consent after the browser prompt. Article 6(1)(c) covers legal obligation. We do not seek Article 9 special-category data. Do not submit health, biometric templates, religion or sex-life data in chat or tools. If you do, we may delete it.

Article 13 requires identity, purposes, bases, recipients, transfers, retention, rights, withdrawal of consent, the right to complain, and whether provision is statutory or contractual. This page is that notice. Article 14 covers data not obtained from the data subject. An IP in a log of your own request remains an Article 13 case.

Where applicable you may use Article 15 access, Article 16 rectification, Article 17 erasure, Article 18 restriction, Article 20 portability where processing is consent- or contract-based and automated, and Article 21 objection to legitimate interests. Article 22 restricts solely automated decisions producing legal or similarly significant effects. Gomoku moves, matchmaking and human verification do not produce credit, employment or legal effects.

Article 12(3) sets one month, extendable by two for complexity. Our target is one month, alongside the forty-day PDPO access target. Unverified requests may be refused so a third party cannot delete your account.

Article 5(3) of Directive 2002/58/EC, as amended by Directive 2009/136/EC, requires consent before storing or accessing information on terminal equipment, unless strictly necessary for transmission or for a service the user explicitly requested. Session cookies and the short human-verification cookie are strictly necessary for the service you requested. Theme, language and privacy-version keys in localStorage serve the interface and consent record you asked for. We do not set cross-site advertising cookies. The UK Privacy and Electronic Communications Regulations 2003 are parallel. We send no direct-marketing email or SMS.

Regulation (EU) 2022/2065 applies to intermediary services offered to recipients in the Union. If the Services are treated as hosting, Article 16 requires a notice mechanism for content the notifier considers illegal, Article 14 requires terms to describe restrictions and moderation, and Article 17 requires a statement of reasons for account restrictions, with exemptions for micro and small enterprises. This project is not a very large online platform and does not accept systemic-risk duties. Illegal-content notices go to the contact email with a URL, reasons and contact details. Handling is best-effort.

The United States has no single comprehensive federal consumer-privacy statute. Section 5 of the Federal Trade Commission Act, 15 U.S.C. §45, prohibits unfair or deceptive acts or practices. Statements on this page about collection, non-sale, non-marketing, the joke top-up, and the absence of a public toolkit index are made so that they are not deceptive under that section. Practice must change only after this page changes.

The CAN-SPAM Act, 15 U.S.C. §§7701–7713, regulates commercial email. One-time passwords, security notices and policy notices are transactional or relationship messages. We do not send commercial promotional email. If we ever did, we would provide a truthful header, identity, postal address and opt-out. The Telephone Consumer Protection Act, 47 U.S.C. §227, is not used for SMS marketing. The Stored Communications Act, 18 U.S.C. §§2701–2712, limits unauthorised access to stored communications. Chat is processed to provide the feature and is not sold.

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, is Cal. Civ. Code §§1798.100–1798.199.100. Its business thresholds (revenue, volume of buying or sharing, or revenue share from sale) are not claimed to be met. We still grant, contractually: the right to know (§§1798.100, 1798.110); deletion (§1798.105), subject to security, debugging and legal retention; correction (§1798.106); opt-out of sale or share (§1798.120), which we do not do; treatment of a Global Privacy Control signal as an opt-out preference; limitation of sensitive personal information (§1798.121), location being used only for the transit feature you requested; and non-discrimination (§1798.125).

The California Online Privacy Protection Act, Cal. Bus. & Prof. Code §§22575–22579, is met by this page. Shine the Light, Cal. Civ. Code §1798.83, is answered by the statement that we do not provide personal data to third parties for their direct marketing. Section 1798.150’s private right of action is limited to certain breaches. This paragraph does not admit a claim.

The Virginia Consumer Data Protection Act (Va. Code Ann. §§59.1-575 and following), Colorado Privacy Act (Colo. Rev. Stat. §§6-1-1301 and following), Connecticut Data Privacy Act, Utah Consumer Privacy Act, Texas Data Privacy and Security Act, Oregon Consumer Privacy Act, and the comprehensive statutes of Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Maryland, Minnesota and other states grant access, correction, deletion, portability and opt-out of targeted advertising or sale where their controller thresholds are met. We do not sell and do not run targeted advertising. Registered users may exercise the same rights contractually under Section 14 whether or not a threshold is met. Nevada NRS 603A is answered by non-sale.

47 U.S.C. §230(c), where it applies, limits treating a provider of an interactive computer service as the publisher of another information content provider. Chat, room names and UGC worlds are provided by users. Section 230 does not displace federal criminal law, intellectual-property claims, or Hong Kong law. We may still remove content and restrict accounts.

Collection depends on features used. The table is the inventory: account and identity; Resend delivery of one-time passwords; technical logs including Cloudflare metadata; realtime game state and chat; session and gauntlet cookies and privacy-version keys; location only after a browser grant; toolkit URLs and files wiped by TTL; CAPTCHA vendor signals; cloud preference and playlist metadata without audio blobs. We do not use personal data for credit, employment, or other automated decisions with legal effects. Point costs in gomoku are game rules, not financial scoring.

session_token is HttpOnly, SameSite=Lax, path=/, Max-Age 43200 seconds, Secure on HTTPS or wusper hosts, and Domain=.wusper.com only on those production hosts. The token is a server-side random value. Logout clears the same cookie. gauntlet_passed lasts about twenty minutes and is server-issued. A client-set cookie is not a pass. localStorage may hold gh_privacy_ok and gh_privacy_version (GH-PRO-LGL-013 for this edition), theme, language, quality and favourites. Do Not Track is not treated as a binding opt-out because it lacks a consistent implementation. Global Privacy Control is handled under Section 10.2.

Registered accounts are kept while active, then primary records are removed or anonymised in about thirty days after a verified deletion request, with residual backups rolling off in about ninety days. Guests are physically deleted after seventy-two hours. Chat and UGC are generally kept thirty to ninety days. Server and edge logs are typically fourteen to thirty days. Toolkit files last minutes to hours. Burn-after-reading QR may be on the order of sixty seconds. WAN file-transfer fallback is about thirty minutes. The Gauntlet cookie is about twenty minutes. Location is used on-device in real time. Lyrics and cutout work directories are deleted at job end. Article 5(1)(e) GDPR and DPP2 are the retention standards. Perpetual backup is not promised.

Email wusui1325@gmail.com with subject “PDPO Data Request”, “GDPR Request”, or “US State Privacy Request”, state the right, and cooperate with reasonable verification. Targets: forty days for PDPO access or correction; one month for Article 12 GDPR; an internal ceiling of forty-five days for California know or delete requests. Portability is a readable text or JSON summary of account fields, not a guaranteed export of matches or worlds. Clearing local consent does not delete a server account.

Complaints: the Hong Kong Privacy Commissioner (sections 37 and following, and section 50 enforcement notices); an EEA supervisory authority of habitual residence, work, or the alleged infringement; the UK ICO; the California Privacy Protection Agency and the California Attorney General; and other state attorneys general where those laws apply. Writing to us first is usually faster. This paragraph does not limit a statutory complaint.

Article 4(8) and Article 28 GDPR describe processors and mandatory contract terms. A hobby-scale operator uses vendor terms, HTTPS and least privilege, and does not claim a complete Standard Contractual Clauses file. The table lists Cloudflare, the VPS origin, Resend, Google, Discord or Microsoft if enabled, a DeepSeek-compatible inference API, and public transit or routing sources. Hong Kong has no EU adequacy decision. Where the GDPR applies and data leave the EEA, Articles 45 to 49 apply. For transfers necessary to perform the service you requested, we disclose reliance on Article 49(1)(b) and (c), plus TLS and access control. That is not a filed transfer impact assessment.

Security is TLS, cookie attributes, hashing, separation, rate limits, human verification and Cloudflare. No service is absolutely secure. If we know of an incident reasonably likely to result in unauthorised access, we will where practicable contain it, reset sessions, and notify affected registered users. The PDPO has no GDPR Article 33 seventy-two-hour clock. Article 33 and Article 34 are stated so the difference is visible. This paragraph is voluntary practice, not an SLA.

The Services are not designed for children. There is no technical age gate. 15 U.S.C. §6502 prohibits an operator of a site directed to children under 13, or with actual knowledge, from collecting personal data without verifiable parental consent. This site is not directed to them. Actual knowledge leads to deletion and disablement. Article 8 GDPR is not the basis of supply.

We do not use personal data for PDPO Part VIA direct marketing, CAN-SPAM commercial email, or PECR unsolicited electronic marketing. One-time passwords and material-policy notices are operational. A change would require consent then required by law and a Section 2 update.

Location for /tools/eta and /tools/nav is used only after an explicit browser grant, which you may revoke. Nearby or onboard features may then fail. Other queries do not need location. Tracks are not kept for advertising. These features are not emergency services or official navigation. Android fine and coarse location permissions are for on-device conditions, not an advertising SDK.

/tools/eta proxies public operator interfaces and is not an official channel. ETAs may be late, missing or stale. We do not invent schedules. Favourites stay in localStorage. The path is often ungated. Metro starts at /api/metro/cities and is unofficial. /tools/nav is OSRM and open-map walking plus heuristic bus planning, not Google Directions, with no traffic-light detection. Risk of missed connections, getting lost, accidents, injury or property damage is yours to the extent the law allows. Section 7 of the Control of Exemption Clauses Ordinance (Cap. 71) prevents excluding liability for death or personal injury resulting from negligence, and overrides contrary words.

Most /tools/* paths may require Gauntlet. /tools/eta is often open. The gate may include a proof-of-work style check, a short WebSocket, Turnstile, reCAPTCHA, a honeypot, dwell time and behaviour summaries. Raw pointer traces are not stored by design. The success cookie is server-issued for about twenty minutes. Some game APIs use a lite check.

Some low-latency modes use WebRTC peer-to-peer or a WebRTC data channel, possibly with STUN, TURN and ICE candidate exchange, rather than server-only relay. Signalling may still exchange session descriptions over the WebSocket. ICE servers include a public STUN server and STUN and TURN on the operator node node.wusper.com, including TCP. The TURN credential is used only to allocate a relay. It is not an account password and is not printed here. This Section does not authorise that node as a public VPN.

When the same account opens another socket or reconnects, the superseded WebSocket is discarded. The RTCPeerConnection is closed only if that close was not a supersede and the user has no remaining live WebSocket. A short drop or a page reconnect should not tear down an established peer. What is discarded is the old signalling socket. The peer is closed when the last live socket is gone.

Your public IP may become visible to other endpoints or to the relay. If you do not accept that, leave and use server relay. You must not log or publish another person’s IP learned this way; that may also engage section 64 of the Personal Data (Privacy) Ordinance (Cap. 486). Browser file transfer can expose a public IP. Optical QR stays on device. Bluetooth and nearby radio frames are not logged as such by the origin.

The toolkit wraps yt-dlp, ffmpeg and related components. The origin does not long-term host protected media or offer a public search index. Operator-held upstream cookies may be presented by yt-dlp. They are not your Wusper password. URLs you submit can appear in temp files and logs. You warrant lawful rights. Restricted acts under sections 22 to 29 of the Copyright Ordinance (Cap. 528) are your responsibility. The Copyright (Amendment) Ordinance 2022 limitation regime for online service providers is the Hong Kong reference for notice and removal. We have not registered a United States Copyright Office designated agent, so 17 U.S.C. §512 safe harbour is not claimed. Notices that contain the §512(c)(3) elements are still processed voluntarily. Lyrics jobs may OCR, run Whisper small on the origin CPU, optionally shape LRC, then delete the work directory. Cutout does not fine-tune a public model. COMG textures under /js/games/comg_assets/ are Poly Haven CC0 or project-drawn CC0. Firearm GLBs are CC-BY 3.0, CC-BY 4.0 or CC0 as listed in ASSETS.md. A client download is for rendering, not a further proprietary licence. Redistribution must keep CC-BY attribution. Creative Commons permission is the rightsholder’s, not ours.

Non-deepseek gomoku difficulties use a compiled engine on the origin. The deepseek difficulty sends board state to a DeepSeek-compatible API without intending to attach login names, IPs or tokens. Point costs are not fiat. Regulation (EU) 2024/1689 does not treat a game opponent or lyric shaper as an Annex III high-risk system. Article 5 prohibited practices are not used. Article 50 transparency is met by labelling the computer opponent as AI. Output may be wrong. It is not professional advice. The United Kingdom has no identical single statute; the same disclosure is given.

UGC submissions, including Color Link strokes, grant a non-exclusive, royalty-free, worldwide licence, sublicensable only for hosting or CDN, to operate, back up, moderate and display the content. Moral rights are not asserted against us for those limited purposes to the extent the law allows. You warrant lawfulness. Color Link (clink) is server-relayed over a WebSocket clink_action, not a WebRTC peer connection, so this mode does not hand your public IP to other browsers in the room. A room code and a /?clink= link let a holder attempt to join; the code is not a cryptographic secret. Caps are about 8000 operations, 8000 points, 80 canvases and 40 groups. A share link invites collaboration. It does not assign copyright or licence publication outside the Services. Other participants keep rights in their own strokes. Joint-authorship rules under the Copyright Ordinance (Cap. 528) may apply; this Section does not apportion them. We may remove content and restrict accounts without promising prior review. DSA Article 16 notices may be emailed. The UK Online Safety Act 2023 illegal-content duties are acknowledged for user-to-user features. This project is not a categorised large service. Notified illegal content, especially child sexual exploitation and doxxing, will be removed where practicable. Section 230 does not displace Hong Kong law.

Section 7(1) of the Control of Exemption Clauses Ordinance (Cap. 71) prevents excluding or restricting liability for death or personal injury resulting from negligence by contract or notice. Section 8 requires the reasonableness test in section 3 and Schedule 2 for other loss. Schedule 2 looks at bargaining position, knowledge of the term, and alternatives. Free hobby status and advance publication are facts we put forward, not a self-declared pass of the test.

Section 5 of the Supply of Services (Implied Terms) Ordinance (Cap. 457) implies reasonable care and skill where services are supplied in the course of a business. Any exclusion must satisfy Cap. 71. The Unconscionable Contracts Ordinance (Cap. 458) lets a court refuse or limit an unconscionable consumer term. Directive 93/13/EEC requires plain language and withholds effect from unfair non-negotiated terms. A Hong Kong choice of law does not strip those mandatory protections. State law in the United States often refuses exclusions for personal injury, fraud and wilful misconduct.

To the maximum extent permitted by law we are not liable for indirect, incidental, special, punitive or consequential damages, including loss of profits, goodwill, data, business interruption, device damage, or damages related to peer-to-peer IP exposure or incorrect transit data, even if advised. Total cumulative liability shall not exceed the fiat amounts you actually paid us in the twelve months before the claim. If you paid nothing, the sole remedy is to stop using the Services and delete the account or local data. Section 25.2 prevails.

You will defend and indemnify us against third-party claims arising from your use, your breach (especially toolkit copyright, automated attacks, harassment, or publishing another person’s IP), your infringement, or your violation of law, including reasonable attorneys’ fees. Clauses that by nature should survive, including virtual items, retention, copyright warranty, the UGC licence, disclaimers, limitation, indemnity, governing law and this Section, survive to the extent the law allows.

Hong Kong substantive law governs, without conflict-of-laws rules and without the CISG. Article 6 of Regulation (EC) No 593/2008 provides that a choice of law in a consumer contract must not deprive the consumer of mandatory protections of the law of habitual residence where the trader pursues or directs activities there. Articles 17 to 19 of Regulation (EU) No 1215/2012 protect the consumer’s home forum. If those instruments apply, exclusive Hong Kong jurisdiction operates only to the extent permitted. The United Kingdom applies retained equivalents. This is a disclosure, not an admission that every user is such a consumer or that activities were directed to that country.

Disputes first go through thirty days of good-faith negotiation by email. The courts of the Hong Kong SAR are the primary forum to the extent permitted. Claims within the Small Claims Tribunal Ordinance (Cap. 338) should use that forum where appropriate. Arbitration is not mandatory for free users. It is available only by post-dispute written agreement, or if the dispute arises from paid features or amounts actually paid. We do not force HKIAC as the sole path for free users. The Arbitration Ordinance (Cap. 609) applies only to a valid arbitration agreement. Individual claims are preferred. This is not a United States class-action waiver. The Limitation Ordinance (Cap. 347) is not altered.

The Services are run by an individual in spare time on a limited budget and may be reduced, made read-only, moved or shut down. Notice will be posted where practicable, without a guaranteed number of days. We may restrict an IP, device or account for security, abuse, legal risk or breach, without a full advance investigation report. On project end we will where practicable stop collecting and delete or anonymise account data we control in line with Section 13. Full export is not guaranteed.

This page aims at semantic headings, contrast and scalable layout. That is not a certification under Title III of the Americans with Disabilities Act, Section 508, or the European Accessibility Act. Game canvases may not be fully operable with assistive technology. Email us for a text copy.

Account data are disclosed when applicable law or valid legal process requires it. Over-broad or apparently unauthorised requests may be questioned. There is no round-the-clock law-enforcement hotline. Use the contact email with authority and legal basis.

Severability, entire agreement (this edition replaces 009 and 008), no waiver, no assignment by you, assignment to a successor maintainer with notice where practicable, and exclusion of third-party enforcement under the Contracts (Rights of Third Parties) Ordinance (Cap. 623) except statutory data-subject rights, are the miscellaneous terms. Force majeure includes natural disaster, war, government action, network failure, upstream API outage, power or cloud incidents. Contact: wusui1325@gmail.com.

Material additions versus 009 are the seven-day effective date, the Hong Kong ordinance map, the GDPR article map, ePrivacy, the DSA, the AI Act, CCPA/CPRA, CAN-SPAM, COPPA, the CFAA, the SCA, section 230, DMCA notice elements without a safe-harbour claim, the state-law list, consumer-forum disclosure, and the express non-exclusion of negligence liability for death or personal injury.

This annex restates privacy-relevant implementation. Figures come from the 009 annex of 19 September 2026, with git main a7ccffb7 of 1 October 2026 noted as the code baseline. Later commits win until this page is revised.

The router branches on hostname among game, portal, privacy, pay, and the legacy name except node.*. session_token is Domain-scoped only on production wusper hosts so toolbox and game share a login. That is session sharing, not ad tracking.

The session cookie is HttpOnly, SameSite=Lax, Max-Age 43200, Secure on HTTPS or wusper hosts, a 16-byte hex token stored server-side with username and expiry. The twelve-hour cookie is not the seventy-two-hour guest TTL.

Guest minting is rate-limited, deletes expired unbound guests, allocates user_###### and a one-time password stored hashed, and sets a three-day expiry. A google_id binding stops the sweeper. There is no expiry email.

Passwords are hashed. Status payloads may include provider ids, email, avatar, friends, chat, inventory, loadout, gacha, pets, points and about fifty history rows. Client secrets are not reproduced.

Cloud prefs store allow-listed keys after stripping secret-looking names and oversized values. Cloud music stores playlist metadata and lyrics text and rejects audio blobs.

pay.wusper.com is a joke top-up skin. real.html states it does not charge. Do not type real card numbers there.

Those mode ids are what the mode registry records. Realtime state is game data, not an advertising profile.

The toolbox page is noindex. Node-config is labelled closed. The music remote is a same-browser BroadcastChannel. The download family is yt-dlp plus ffmpeg. WAN fallback lives thirty minutes, no-store, and can be deleted early.

Permissions exist because triggers and the desk pet need them, not because of an ads SDK. Catalog v9 is labelled local-only, but background video download calls the site toolkit. Node-config is not a public VPN and does not authorise unlawful circumvention.

High-frequency paths may use a WebRTC data channel. Signalling may stay on the WebSocket. A superseded socket is discarded; the peer closes only when the close is not a supersede and no live socket remains. STUN includes stun.l.google.com and stun:node.wusper.com:3478, with TURN on that node. Public IPs may still be visible. The TURN credential is not printed here.

Textures and GLBs are under /js/games/comg_assets/ and can be fetched by URL. Licences are in Section 22.6 and ASSETS.md. Color Link codes copy, the share link is /?clink= plus the code, state is in clink_custom_rooms over clink_action, not peer-to-peer. Caps are about 8000 operations, 8000 points, 80 canvases and 40 groups.

This edition bumps GH_PRIVACY_VERSION in the gate partial and the assembled index to GH-PRO-LGL-013 so existing browsers re-prompt. Shipping the page alone would not.

The schedule states what each cited instrument requires and how this project answers it, or where scale prevents a full statutory programme. It is a map, not a certificate and not a filing.

Each row above is an operational answer, not a certificate. Where establishment, threshold or scale means the statute does not apply, the contractual right is still no less than the core remedy, exercised by the Section 14 email. Mandatory liability, especially Cap. 71 section 7, prevails over any disclaimer.

If body and annex numbers diverge, the statement more protective of the data subject prevails, but live code remains the technical fact. Mandatory law prevails over this Agreement. If the languages diverge, both may be considered; neither overrides the other merely because one party prefers it.

This edition invents no company number, appoints no EU or UK representative, registers no US Copyright Office agent, claims no CCPA threshold, does not say pay.wusper.com charges, does not call the gomoku engine high-risk AI, does not call the project a licensed virtual-asset service, and does not drop the “not lawyer-reviewed” premise.

Rights requests, takedown notices, abuse reports and legal process go to wusui1325@gmail.com. Suggested subjects are “PDPO Data Request”, “GDPR Request”, “US State Privacy Request”, “Copyright Notice” and “Abuse Report”. A missing subject is not a refusal. There is no paid hotline and no twenty-four-hour staffed desk. Immediate danger should go to local emergency services.

To stop a third party deleting or reading an account we may ask the requester to confirm the login email, the OAuth identifier, or control by a one-time password to that account. We do not ask for a national-identity image, a full passport page, or a payment password as routine verification. Excessive collection would itself fail DPP1 and Article 5(1)(c). A guardian request must explain the relationship and locate the account without over-collecting about the child.

Access may be refused for another person’s data, crime prevention, legal privilege, and the other section 20 cases. Erasure may leave security logs, backups not yet rolled off, and data a law requires us to keep. An objection to legitimate interests may be refused if compelling grounds override the data subject’s interests, with reasons. Portability does not extend to other people’s UGC, compiled engine weights, or localStorage we do not hold.

Article 30 requires a record of processing for some controllers, with an exemption for organisations under 250 employees where processing is occasional, low-risk and not special-category. This project has no employee roll. The table is a voluntary record so Section 14 requests can be answered: account, session, guest, match and chat, toolkit, human verification, location, mail, and AI inference, with the bases and retention already stated.

A refusal may be asked to be reviewed within thirty days by email with new facts. Review is by the same maintainer, because there is no independent data-protection officer. It does not replace Article 77 GDPR or a PDPO complaint. A refusal will point to the Commissioner, the ICO, a Union authority, or a state attorney general.

Requests may be in Traditional Chinese or English. Other languages will be read without a translation SLA. Both texts of this Agreement may be considered in a dispute. Neither overrides by preference alone.