Legal

Privacy Policy

Effective September 27, 2026

This policy explains what information Open Waves collects when you use the game and websites at openwaves.world and ride.openwaves.world (the "Service"), why, who it is shared with, and the choices you have. Open Waves is an independent project run by an individual developer based in Florida, United States ("we", "us"). The short version: we collect only what is needed to run the game and the beta, we do not sell your information, and we do not use advertising or tracking cookies.

1. Information we collect

When you create an account

• Email address and player name. Used to sign you in, recognise you in lobbies, and contact you about your account.
• Password. Stored only as a salted, one-way scrypt hash. We cannot see your password.
• Invite details. The invite you joined with, and the email address it was issued to.
• Email verification codes. Short-lived codes used to confirm you own your email address.

When you sign in and play

• Sign-in records: time, whether the sign-in succeeded, IP address, browser/device (user agent) and approximate country. Used to protect accounts and spot abuse.
• Session cookie: one essential cookie (fs_session) that keeps you signed in. Only a hash of it is stored on our server. It is not used for advertising or tracking across other sites.
• Usage counts: how many requests your account makes to each part of the game per day (for example, how many 3D scenery sessions you start), so we can manage costs and fair-use limits.
• Gameplay events: sessions, spots and boards used, ride time, waves, falls and similar statistics, used to understand how the game is played and improve it.

In online lobbies

• Positions, movement and chat are relayed live between players in the same lobby so you can ride together. They are not stored after they are delivered.
• Voice chat is optional and connects players directly (peer to peer) where possible, with our server relaying only when needed. Voice is never recorded or stored. To connect directly, your browser contacts public connection services (Cloudflare and Google STUN servers), and other players in the call may be able to see your IP address, as with most voice and video calls.

When you contact us

• The topic, name (optional), email address and message you send through the contact form, the approximate country, and a one-way hash of your IP address used only to limit spam.

When you become a supporter

• Payments are handled by Stripe. We never receive or store your full card number. Stripe shares with us the information needed to record and support your contribution, such as your email address, the amount, and the payment status.

Stored in your own browser

• Game preferences (controls, camera, HUD layout, quality, touch settings, your player name and similar) are saved in your browser's local storage so they persist between visits. They stay on your device.

2. How we use information

• To provide the game, your account, online lobbies and support.
• To keep the Service secure: rate limiting, preventing abuse, and protecting accounts.
• To manage running costs and fair-use limits, such as the daily 3D scenery cap.
• To understand how the game is played and improve it.
• To answer your messages and, where needed, send account emails such as invites and verification codes.
• To comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information, share it for cross-context behavioural advertising, or use it to build advertising profiles.

3. Services we rely on

We share information with service providers only as needed to run the Service:

• Hostinger hosts our server and database.
• Cloudflare provides DNS, security and content delivery for our websites, and processes your IP address and request details to do so.
• Stripe processes supporter payments (Stripe Privacy Policy).
• Resend delivers account emails such as invites and verification codes, when enabled.
• Google Maps Platform provides photorealistic 3D scenery. Scenery requests are made by our server, not your browser, so Google does not receive your IP address from those requests. Use of Google's scenery is subject to the Google Privacy Policy.

Some features are loaded or requested directly by your browser, which means those providers receive your IP address and standard browser information:

• jsDelivr (the 3D graphics library), Open-Meteo (wind, wave and weather forecasts), OpenStreetMap Nominatim (place search, when you use it) and EOX (satellite imagery on the location picker).

We may also disclose information if required by law, to protect the rights, safety or property of players or others, or as part of transferring the Service to a new operator, in which case this policy would continue to apply.

4. How long we keep information

• Account information, gameplay events and usage counts are kept while your account exists.
• Sessions expire after 30 days of inactivity.
• Contact messages are kept as long as needed to resolve them and keep a record of support, and are deleted on request.
• Backups of the database are kept for up to 14 days, after which they are overwritten.

When you delete your account, your account, gameplay events and usage counts are removed immediately, and past sign-in records are anonymised (your email and IP address are removed). Copies may remain in backups until they expire.

5. Your choices and rights

• Download your data: use "Download my data" in the account menu in the game.
• Delete your account: use "Delete my account" in the account menu, or ask through the contact form.
• Correct your information: change your player name in the game settings, or contact us.
• Contact messages: ask us to delete a message you sent.

Depending on where you live (for example in the European Union, the United Kingdom or California), you may have additional rights to access, correct, delete or port your information, to object to or restrict certain processing, and not to be discriminated against for exercising these rights. Where the GDPR applies, we rely on performing our agreement with you (running your account and the game), our legitimate interests (security, fair use and improving the game), and your consent where we ask for it. To exercise any right, send a request through the contact form choosing "My data". We will respond within the time required by law. You also have the right to complain to your local data protection authority.

6. Security

We protect information with HTTPS everywhere, salted password hashing, hashed session tokens, secure HttpOnly cookies, rate limits, a firewalled server whose database is never exposed to the internet, and nightly backups. No system is perfectly secure, but we work to protect your information and will notify affected players of a breach where required by law.

7. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. Players aged 13 to 17 need a parent or guardian's permission. If you believe a child under 13 has created an account, please tell us through the contact form and we will delete it.

8. International players

Open Waves is operated from the United States, and our service providers may process information in the United States and other countries. By using the Service, you understand that your information may be processed outside the country where you live, under the protections described in this policy.

9. Changes to this policy

We may update this policy as the Service changes. If we make material changes, we will update the effective date above and, where reasonable, let you know in the game or by email before they take effect.

10. Contact

Questions or requests about your privacy? Use the contact form and choose "My data".