Legal

Privacy Policy

Effective October 23, 2026

This policy explains what information Open Waves collects when you use the game, websites and standalone software purchase and download service at openwaves.world and ride.openwaves.world (the "Service"), why, who it is shared with, and the choices you have. Open Waves is an independent project run by Gabriel San Roman in Florida, United States ("we", "us"). We use information to provide these services, fulfill software orders and protect accounts. We do not sell your information or use advertising or cross-site tracking cookies.

1. Information we collect

When you create an account

• Email address and player name. Used to sign you in, recognise you in lobbies, and contact you about your account.
• Password. Stored only as a salted, one-way scrypt hash. We cannot see your password.
• Invite details. The invite you joined with, and the email address it was issued to.
• Email verification codes. Short-lived codes used to confirm you own your email address.
• Terms you agreed to. Which version of the Terms of Service you accepted and when, so there is a record of what each of us agreed to.

When you sign in and play

• Sign-in records: time, whether the sign-in succeeded, IP address, browser/device (user agent) and approximate country. Used to protect accounts and spot abuse.
• Session cookie: one essential cookie (fs_session) that keeps you signed in. Only a hash of it is stored on our server. It is not used for advertising or tracking across other sites.
• Usage counts: how many requests your account makes to each part of the game per day (for example, how many 3D scenery sessions you start), so we can manage costs and fair-use limits.
• Gameplay events: sessions, spots and boards used, ride time, waves, falls and similar statistics, used to understand how the game is played and improve it.

In online lobbies

• Positions, movement and chat are relayed live between players in the same lobby so you can ride together. They are not stored after they are delivered.
• Voice chat is optional and connects players directly (peer to peer) where possible, with our server relaying only when needed. Voice is never recorded or stored. To connect directly, your browser contacts public connection services (Cloudflare and Google STUN servers), and other players in the call may be able to see your IP address, as with most voice and video calls.

When you contact us

• The topic, name (optional), email address and message you send through the contact form, the approximate country, and a one-way hash of your IP address used only to limit spam.

When you become a supporter

• Payments are handled by Stripe. We never receive or store your full card number. Stripe shares with us the information needed to record and support your contribution, such as your email address, the amount, and the payment status.

When you buy or download software

• Purchaser and license details: your checkout email, the named individual or legal entity receiving the license, the licensed commercial application where applicable, license tier, billing option and order reference.
• Payment and subscription records: Stripe customer, checkout, payment, invoice and subscription references and status, amounts and currency where supplied, and paid subscription periods. Stripe handles payment information; we do not receive or store your full card number.
• License acceptance and delivery: the terms version you accept, activation and acceptance records, purchased release, download grants and acquired release versions. These records support delivery, updates, license certificates and evidence of your purchased rights.
• Software account access: short-lived email verification codes, sign-in attempts and essential session records. The browser receives a separate HttpOnly session cookie for the software service. This access is separate from your game password, player account and beta invitation.
• Security and service requests: request time, IP or a derived security identifier, and relevant access/error records may be processed to prevent abuse and investigate delivery problems. Purchaser information is not published in the release catalog.

A software purchase or acceptance of license terms is not consent to marketing emails. Sign-in codes, receipts, subscription notices and messages necessary to deliver or support an order are transactional communications. The download portal does not store your sign-in code or license package in browser local storage.

Stored in your own browser

• Game preferences (controls, camera, HUD layout, quality, touch settings, your player name and similar) are saved in your browser's local storage so they persist between visits. They stay on your device.

2. How we use information

• To provide the game, your account, online lobbies and support.
• To process software orders, authenticate purchasers, record accepted license terms, deliver acquired versions and certificates, manage subscription update access, resolve billing issues and meet accounting obligations.
• To keep the Service secure: rate limiting, preventing abuse, and protecting accounts.
• To manage running costs and fair-use limits, such as the daily 3D scenery cap.
• To understand how the game is played and improve it.
• To answer your messages and, where needed, send account emails such as invites and verification codes.
• To comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information, share it for cross-context behavioural advertising, or use it to build advertising profiles.

3. Services we rely on

We share information with service providers only as needed to run the Service:

• Hostinger hosts our server and database.
• Cloudflare provides DNS, security and content delivery for our websites, and processes your IP address and request details to do so.
• Stripe processes supporter and software payments, recurring software subscriptions and billing management (Stripe Privacy Policy).
• Resend delivers software purchaser access codes from [email protected] (Resend Privacy Policy), and may deliver account invitations or verification codes where separately enabled. Google Gmail may instead deliver access codes from [email protected] when configured. In each case the email address and access-code message are processed only to deliver that email.
• Google Maps Platform provides photorealistic 3D scenery. Scenery requests are made by our server, not your browser, so Google does not receive your IP address from those requests. Use of Google's scenery is subject to the Google Privacy Policy.

The standalone SDK is different from the hosted game. If an application uses the optional Google Maps adapter, it makes direct provider requests under that application's Google account. Google then receives the requesting device's IP address and normal request information. The application developer is responsible for its own privacy disclosures and provider configuration. The included SDK example can load Three.js from jsDelivr. Purchasing the SDK does not authorize an application developer to collect data on our behalf.

Some features are loaded or requested directly by your browser, which means those providers receive your IP address and standard browser information:

• jsDelivr (the 3D graphics library), OpenStreetMap Nominatim (place search, when you use it) and EOX (satellite imagery on the location picker).

Wind, wave and weather forecasts are fetched by our server, not your browser, from MET Norway, NOAA and the University of Hawaiʻi's PacIOOS. Only the place's coordinates are sent to them, never your IP address or account.

We may also disclose information if required by law, to protect the rights, safety or property of players or others, or as part of transferring the Service to a new operator, in which case this policy would continue to apply.

4. How long we keep information

• Account information, daily activity summaries and usage counts are kept while your account exists. Individual gameplay events are kept for 30 days and then deleted; after that only daily totals remain (for example how many sessions you rode and for how long on a given day).
• Game sessions expire after 30 days of inactivity. Software sessions and verification codes are separate and expire under the software service's access settings; requesting access again creates a new sign-in flow.
• Software orders, license acceptance and acquired-version records are retained while needed to administer ongoing license rights, provide delivery records and meet accounting, legal or dispute-resolution obligations. A subscription ending does not erase the evidence of a perpetual license. We retain only records needed for those purposes and review requests to remove or minimize other purchaser information.
• Contact messages are kept as long as needed to resolve them and keep a record of support, and are deleted on request.
• Backups of the database are kept for up to 14 days, after which they are overwritten.

When you delete your game account, your game account, gameplay events, activity summaries and usage counts are removed immediately, and past game sign-in records are anonymised (your email and IP address are removed). Copies may remain in backups until they expire. A game-account deletion does not cancel a software subscription, delete the separate purchaser account or erase legally necessary transaction and license records. Contact us for a software privacy request; manage subscription cancellation separately through software billing or our contact form.

5. Your choices and rights

• Download your data: use "Download my data" in the account menu in the game.
• Delete your account: use "Delete my account" in the account menu, or ask through the contact form.
• Correct your information: change your player name in the game settings, or contact us.
• Contact messages: ask us to delete a message you sent.
• Software purchaser records: download your license certificate in My software. To access, correct, export or request deletion of purchaser information, use the contact form and choose "My data". We may verify ownership of the purchaser email before acting. Some transaction and license records must be retained for the purposes above; we will explain any applicable limit.

Depending on where you live (for example in the European Union, the United Kingdom or California), you may have additional rights to access, correct, delete or port your information, to object to or restrict certain processing, and not to be discriminated against for exercising these rights. Where the GDPR applies, we rely on performing our agreement with you (running your account, game and software order), our legitimate interests (security, fair use and improving the Service), legal obligations (such as required financial records), and your consent where we ask for it. To exercise any right, send a request through the contact form choosing "My data". We will respond within the time required by law. You also have the right to complain to your local data protection authority.

6. Security

We protect information with HTTPS everywhere, salted password hashing, hashed session tokens, secure HttpOnly cookies, rate limits, a firewalled server whose database is never exposed to the internet, and nightly backups. No system is perfectly secure, but we work to protect your information and will notify affected players of a breach where required by law.

7. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. Players aged 13 to 17 need a parent or guardian's permission. If you believe a child under 13 has created an account, please tell us through the contact form and we will delete it.

8. International players

Open Waves is operated from the United States, and our service providers may process information in the United States and other countries. By using the Service, you understand that your information may be processed outside the country where you live, under the protections described in this policy.

9. Changes to this policy

We may update this policy as the Service changes. If we make material changes, we will update the effective date above and, where reasonable, let you know in the game or by email before they take effect.

10. Contact

Questions or requests about your privacy? Use the contact form and choose "My data".