Privacy Policy

Account types

The site recognises two kinds of users:

• Guest sessions — when you first visit, we automatically create an anonymous Supabase session so you can use the site without signing up. This session is identified by a cookie and a stored anonymous user row.
• Signed-in accounts — when you sign up with an email, your existing guest data is promoted to that account. The email is stored by Supabase Auth, never sold, never used for marketing.

What we store

Everything the site shows you — and nothing that you don't put in yourself — lives in a Supabase Postgres database. That includes:

• Your auth record (anonymous flag or email, created-at timestamp, unique id)
• Your profile (username, avatar character, public/private flag)
• Your characters (level, sequences, skill levels, stat weights)
• Your builds (name, description, weapon and echo references, ordering)
• Your weapons and echoes (game id, level, rank, scanned stats)
• Your showcase entries (which slot points to which build)

We do not store screenshots, real names, IP addresses, payment information, or any field that you didn't explicitly type or upload.

Screenshots and the OCR scanner

When you use the importer to scan a Wuthering Waves screenshot, the image is processed entirely in your browser by Tesseract.js. It is never uploaded to our servers. Only the extracted structured data (the echo, weapon and stat fields) is sent to Supabase to create the matching records.

Analytics

We use Google Analytics (GA4) to measure aggregate traffic — which pages get visited, how many guests vs signed-in users, broad geographic regions. Ad personalization and ad storage are disabled by default; only analytics storage is granted. You can block Google Analytics with any standard tracking-protection extension or browser setting and the site will keep working.

Cookies and local storage

• Supabase auth cookie — keeps your session alive between visits.
• Locale cookie (wuwa-optimizer-locale) — remembers your language choice.
• Google Analytics cookies — anonymous traffic measurement only.
• Local storage — small UI preferences (e.g. dismissing the guest banner).

Third parties

We use the following processors, each with their own privacy policy:

• Supabase — auth and database hosting
• Cloudflare / NuxtHub — edge hosting and CDN
• Google Analytics — aggregate traffic measurement
• Userjoin — public feedback and feature-request board (only data you explicitly post there)
• Google Fonts — fonts served at build time, no runtime tracking

Data retention

• Signed-in accounts — kept until you delete your account from the settings page.
• Guest sessions — kept as long as the anonymous user record exists. We periodically prune anonymous records that have been inactive for an extended period to limit unused data.

Your rights

You have the right to access, export and delete the data we hold about you. Signed-in users can delete everything from Settings → Delete account ; the operation cascades through every table and is irreversible. Guests can sign up to claim their data, or simply clear their browser cookies to abandon the session (the record is then cleaned up on the schedule above).

International transfers

Supabase, Cloudflare and Google operate globally; your data may be processed in regions outside your country of residence. We rely on these providers' own safeguards (standard contractual clauses where applicable) for cross-border transfers.

Children

The site is not directed at children under 13. If you are under that age, please do not create an account or upload screenshots.

Changes

We may update this policy as the site evolves. The "Last updated" date above will change whenever we do. Material changes will be flagged in a footer notice for at least two weeks.

Contact

General questions about your data go on the feedback board . For privacy-sensitive requests (data access, erasure, complaints), email contact@wuwa-optimizer.com .