Wurder

Privacy Policy

Last updated: 16 July 2026

Wurder is operated by Wurder Ltd. This notice explains how we handle personal information when you use the public website at https://wurder.app, the web game at https://play.wurder.app, the Wurder mobile app, or the organiser enquiry flow.

This is a practical description of the current product and website implementation. It is not formal legal advice and it should not be read as a statement that every future feature will work in exactly the same way.

Quick links

Who Wurder is

Wurder is the live social game and public website operated by Wurder Ltd.

Public contact email: hello@wurder.app

We have not published a registered office or company number on this website. If you need a formal legal contact route, email hello@wurder.app.

Information Wurder collects

Account and profile information

Depending on the route you use into Wurder, we may process:

  • your email address;
  • your first name, last name and display name;
  • your Wurder ID or username;
  • your account user ID and authentication identifiers;
  • the authentication method you use, such as email/password or Google sign-in;
  • your avatar or profile image URL;
  • account timestamps and profile-completion status; and
  • account-related statistics, achievements and settings stored against your profile.

Gameplay information

When you join, host or play a session, Wurder may process:

  • game codes and session identifiers;
  • player identifiers, player names and membership records;
  • host and organiser identifiers;
  • selected mode and setup details;
  • targets, kill words and other contract-related gameplay data;
  • claim, confirmation and dispute records;
  • scores, points, wins, kills, deaths, streaks and similar gameplay statistics;
  • session status, timestamps and event history; and
  • game or dashboard records generated to support session review, exports or organiser tools.

Event-enquiry information

If you submit the organiser playtest form, Wurder processes:

  • name;
  • email address;
  • organisation or group name;
  • event type;
  • approximate attendee count;
  • proposed date;
  • location;
  • event description;
  • website link if provided;
  • additional requirements if provided;
  • anti-spam fields used to reject obvious bot submissions; and
  • delivery or failure information generated when the enquiry is sent through Formspree.

Technical and support information

Wurder and its hosting or infrastructure providers may also process:

  • IP address and request metadata handled by hosting, security and form-delivery providers;
  • browser, device and operating environment details visible in standard request logs;
  • authentication and session-cookie information needed to keep signed-in members logged in;
  • browser storage used for member sign-in persistence, limited cached profile/game state and reliability handoff;
  • support or legal emails you send to us; and
  • operational logs used to investigate failures, abuse, safety issues or organiser support requests.

How information is collected

Wurder collects information when:

  • you create or use an account;
  • you sign in through Firebase Authentication;
  • you complete a profile or update profile fields;
  • you join, host or play a game;
  • a host, organiser or manager uses session tooling;
  • you submit the event-enquiry form;
  • you contact us by email;
  • your browser stores session, sign-in or handoff state needed for the service; and
  • our infrastructure providers process ordinary server, delivery and security logs.

Why Wurder uses the information

We use personal information to:

  • create and maintain accounts;
  • authenticate users and keep member sessions working;
  • run gameplay, including contracts, claims, disputes, host controls and session history;
  • provide member dashboards, statistics and organiser tooling where those features exist;
  • review and respond to event-enquiry submissions;
  • protect the service against abuse, spam, fraud, broken join flows and other misuse;
  • investigate support issues and technical failures;
  • maintain service reliability and security; and
  • meet legal obligations or respond to lawful requests when necessary.

Lawful bases

Wurder relies on the following lawful bases under UK data protection law, depending on the activity:

Contract

We use contract where processing is needed to provide the service you asked us to provide, such as:

  • creating and maintaining an account;
  • signing you in;
  • running gameplay and session state;
  • showing your profile, stats and current sessions; and
  • handling the join, start and handoff routes needed to use Wurder.

Legitimate interests

We use legitimate interests where the processing is reasonably necessary to run, protect or improve Wurder, including:

  • preventing abuse, fraud and spam;
  • investigating disputes, safety issues and support problems;
  • keeping service logs and technical diagnostics;
  • reviewing organiser event enquiries and deciding whether a playtest is suitable; and
  • maintaining session history, exports and operational records for legitimate product and support needs.

Consent

We rely on consent where law requires it for optional tracking or similar technologies. At the date above, the live public site does not have optional Google Analytics or Google Tag Manager enabled in production. If that changes, we expect to update this notice and any consent flow needed for non-essential analytics.

Legal obligation

We may process and retain information where necessary to comply with legal obligations, respond to lawful requests, or handle rights requests and formal complaints.

Gameplay and account data

Wurder is an account-based social game. That means some personal information is bound up with live gameplay itself.

For example:

  • a player cannot receive a target, kill word or session role without a player record;
  • claims and disputes cannot be managed without keeping a record of who made them and when;
  • hosts and organisers cannot manage sessions without role and access information; and
  • members cannot see profile and statistics features without linking those records to an authenticated account.

Wurder therefore keeps direct account/profile data separately from gameplay/session data, but the two can still be connected where that is necessary to operate the service.

Event-enquiry data

The organiser enquiry form is processed through Wurder’s own /api/events/enquiry route and then delivered to Formspree.

The route currently:

  • validates the submitted fields;
  • checks an anti-spam honeypot;
  • checks a form-start timestamp to reject suspiciously fast submissions;
  • applies a best-effort in-memory rate limit by client IP address;
  • sends the validated enquiry to Formspree if server configuration is available; and
  • prepares an honest email fallback if automated delivery is unavailable.

We use this information to review whether an event is suitable for a supported playtest, to reply to the organiser, and to keep a record of the enquiry and any follow-up.

Analytics diagnostics and cookies

Optional website analytics

The codebase contains support for Google Tag Manager and Google Analytics identifiers, but those identifiers are not configured in the current production Vercel environment at the date above. Because of that, the live public website is not currently sending optional website analytics events to Google.

Browser storage and essential state

Wurder does use browser cookies and storage where they are needed for the service, including:

  • an HTTP-only session cookie for authenticated member routes;
  • Firebase Authentication browser persistence;
  • limited local or session storage for member/game cache cleanup and handoff continuity; and
  • limited cached avatar or session identifiers used by the web experience.

These storage items are used for account access, service continuity and reliability rather than advertising.

Diagnostics and operational logging

Wurder and its providers may process technical logs such as request metadata, error information and delivery failures so that we can secure the service and investigate problems.

Service providers and processors

Wurder currently relies on third-party providers including:

  • Vercel for hosting and request handling on the public website;
  • Firebase Authentication for account sign-in;
  • Cloud Firestore for application and gameplay data storage;
  • Firebase Storage where stored asset URLs or related file handling are used;
  • Firebase Admin SDK for server-side access to account and gameplay records; and
  • Formspree for organiser event-enquiry delivery.

We may also link to the Apple App Store and Google Play, but those storefronts apply their own terms and privacy information when you use them.

We do not say that data is “never shared”, because these providers process information on Wurder’s behalf where that is technically necessary to operate the service.

International data transfers

Some of Wurder’s providers operate internationally and may process personal information outside the UK. This repository does not contain a complete public transfer map for every provider environment.

Where information is transferred internationally, Wurder expects those providers to use their standard contractual safeguards and transfer mechanisms. This point should be reviewed again if Wurder publishes a more detailed regional hosting statement.

Retention

Wurder does not currently publish a single fixed retention schedule for every category of data.

Instead, we retain information for as long as it is reasonably needed for the relevant purpose, including:

  • while an account is active;
  • while gameplay history is needed for the service, dispute handling, session history or organiser tooling;
  • while an event enquiry is being reviewed or followed up;
  • while support or safety issues remain unresolved; and
  • for any additional period reasonably required for legal compliance, fraud prevention or technical integrity.

Some information may be deleted, anonymised or detached from a direct account faster than the surrounding operational record. Wurder should publish firmer retention windows later once they have been confirmed operationally and legally.

Security

Wurder uses technical and organisational measures that are intended to keep personal information secure, but no online service can promise absolute security.

Children and age requirements

Wurder is not presented here as a service aimed at young children. However, this repository does not contain a confirmed public minimum-age rule for every route into the product.

If you are a parent, guardian, organiser or teacher and think a child has provided personal information inappropriately, email hello@wurder.app.

Wurder should confirm and publish a consistent age/safeguarding position across the website and store listings.

Account deletion

Information about the current account-deletion route is available at Delete account.

At the date above:

  • account deletion is described as a manual verified request rather than an instant self-service erase button;
  • direct account/profile records can be targeted for deletion or disconnection from the service;
  • some gameplay, safety, dispute, fraud-prevention, support or legal records may still need to be retained; and
  • you can contact hello@wurder.app if you cannot access the account yourself.

Your rights

Depending on the circumstances, you may have rights to:

  • ask for access to your personal information;
  • ask for inaccurate information to be corrected;
  • ask for information to be erased;
  • ask us to restrict processing;
  • object to processing based on legitimate interests;
  • ask for a portable copy of information you provided to us; and
  • withdraw consent where we rely on consent.

These rights are not absolute. For example, Wurder may still need to keep some information for legal, safety, anti-fraud or technical reasons.

To make a request, email hello@wurder.app.

Complaints to the ICO

If you are unhappy with how Wurder handles personal information, you can complain to the UK Information Commissioner’s Office (ICO).

We would still appreciate the chance to hear from you first so we can understand the issue.

Changes to this policy

We may update this notice when Wurder’s features, providers, legal obligations or data practices change. The latest version will remain at Privacy Policy.

Contact details

Privacy Policy | Wurder