Legal
Privacy Policy
How we collect, use and protect your information.
This Privacy Policy explains how Weapons of War 2 ("we", "us") collects, uses, shares and protects your personal information when you use this website and play the game. We follow the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and the rules of the National Privacy Commission (NPC).
1. Who we are
The personal information controller is [to be completed: operator_name], [to be completed: address]. Registration: [to be completed: registration].
Data Protection Officer: [to be completed: dpo_name], [to be completed: dpo_email].
This policy covers the website and the game client and servers, because they share the same account.
2. What we collect and why
| Information | Why we use it | Legal basis |
|---|---|---|
| Username and password (the password is stored in the format the game server requires) | To create your account and let you sign in to the website and the game | Contract |
| Game data: characters, class, level, experience, guild, items, in-game mail, trades and game logs | To run the game, show rankings, and prevent cheating | Contract; legitimate interest |
| Login records from the game and website: IP address, device identifier (such as a network MAC address), login and logout times | Account security (including staff review of password changes made on the website), preventing cheating and abuse, enforcing bans | Legitimate interest |
| Optional profile: email address, Discord username, short bio, main class, avatar image | To personalise your account page and to contact you about your account. We only use your email for account and support messages. | Consent (you can remove these at any time) |
| Top up records: invoice number, package, amount paid, eCoin received, bonuses, payment method (GCash), the GCash reference number and receipt screenshot you upload (which may show your GCash name and number), date, and your IP address at purchase | To process payments, deliver eCoin, prevent fraud, handle disputes, and keep the financial records the law requires | Contract; legal obligation |
| Referral program: your referral code, who invited whom, IP addresses at sign up and login, rewards earned | To run the referral program and detect self-referrals | Contract; legitimate interest |
| Support tickets: messages, category, linked invoice, screenshots you attach | To answer your concern and moderate the community | Contract; legitimate interest |
| Guild logos uploaded by guild leaders | To show your guild's logo in the rankings after staff review | Consent |
| Security data: a scrambled (hashed) form of your IP address with the time of failed sign-ins and new sign-ups | To block password guessing and spam accounts | Legitimate interest |
| Server logs: IP address, browser type, pages requested, errors | Security and troubleshooting | Legitimate interest |
What we do not collect: we never ask for or receive your GCash PIN, one-time codes, card number or bank login. Only administrators can see receipt screenshots. We do not use analytics, advertising or tracking tools.
3. What other people can see
The public Rankings page shows character names, class, level, god level, guild name, the guild leader's character name, and approved guild logos. Your email address, Discord username, bio, purchases and tickets are never shown to other players.
4. Who can access your information
- Administrators can access account, purchase, referral, ticket and log records to run the service.
- Game Masters can access support tickets and their attachments only.
- Staff will never ask for your password.
5. Who we share it with
- GCash processes the money you send under its own privacy policy. When you send a payment, GCash shows us the sender's name, number and reference number, as with any GCash transfer.
- Cloudflare Turnstile (security check): on the Sign Up page, and on Sign In after failed attempts, a Cloudflare check runs to block bots. Cloudflare receives your IP address and basic browser information for this check only. See Cloudflare's privacy policy.
- Resend (email delivery): when you submit a top up, our staff receive an email with your username, the amount, the reference number and your receipt screenshot so they can approve it.
- Our hosting provider: [to be completed: hosting], which stores the website and game data for us.
- Government authorities, when the law requires it.
We do not sell your personal information.
6. How long we keep it
- Account and game data: while your account is active. After you ask us to delete your account, we delete or anonymise it within 60 days, except records we must keep by law.
- Purchase records: as long as tax and accounting laws require (currently up to 10 years). IP addresses in these records are removed after 12 months.
- Support tickets and screenshots: 2 years after the ticket is closed.
- Security data (failed sign-ins, sign-up limits): deleted automatically after 1 day.
- Server and staff activity logs: up to 1 year.
7. How we protect it
We use measures such as encrypted connections (HTTPS), parameterised database queries, protection against forged form submissions, sign-in limits, automatic sign-out after inactivity, re-processing of uploaded images, and access controls for staff. No system is perfectly secure. If a breach affects your personal information, we will notify you and the National Privacy Commission when the law requires it, within 72 hours of discovering it.
8. Your rights
Under the Data Privacy Act you have the right to be informed, to access your data, to object, to correct it, to have it erased or blocked, to data portability, and to claim damages. To use these rights, email our Data Protection Officer at [to be completed: dpo_email] or open a Support Ticket in My Account. We will reply within 15 days. We may ask you to prove that the account is yours. You can also file a complaint with the National Privacy Commission at privacy.gov.ph.
9. Children
You must be at least 13 years old to create an account. If you are under 18, you need permission from a parent or guardian, especially before buying eCoin. A parent or guardian can ask us to review or delete their child's account by contacting us.
10. Cookies
This website only uses what it needs to work. We do not use analytics, advertising or third-party tracking cookies. The only outside script is Cloudflare Turnstile, which loads on the Sign Up page (and on Sign In after failed attempts) to block bots; it does not track you across websites.
| Name | Type | Purpose | How long |
|---|---|---|---|
WOW2SESS | Strictly necessary | Keeps you signed in, protects forms against forgery, and shows one-time messages | Until you close your browser. You are signed out after 30 minutes of inactivity or 8 hours at most. |
wow2-admin-groups (browser storage) | Functional, staff only | Remembers which Admin panel menu groups are open | Until you clear it in your browser |
Because these are strictly necessary, they don't need your consent. If you block them, you can still browse the site but you can't sign in.
11. Other websites
Links to Discord, Facebook, YouTube, Twitch and GCash are governed by those services' own privacy policies.
12. Changes to this policy
We may update this policy. We will change the effective date above and, for important changes, show a notice on the website.
13. Contact
Data Protection Officer: [to be completed: dpo_name], [to be completed: dpo_email]. General support: [to be completed: contact_email].