Slyraf
Privacy Policy
Last updated: September 5, 2026
1. Controller and scope
Slyraf is the controller for personal data processed through slyraf.com and its tools. You can contact the controller or exercise your rights at contact@slyraf.com.
This policy covers visitors, account holders, Pull Tracker and Echo Analyzer users, PvP participants, tournament entrants and people who contact Slyraf.
2. Processing activities
Only data relevant to the feature you use is processed. Fields required to create an account, synchronise a tracker, join a room or enter a tournament are identified by the interface; without them, the requested feature cannot be provided.
2.1 Site delivery and security
- Data
- IP address, date and time, requested URL, browser/device information, technical and security logs.
- Purpose
- Deliver the Site, prevent abuse, diagnose incidents and maintain availability.
- Legal basis
- Legitimate interests in security and operation of the Site.
- Retention
- For the period strictly necessary for security and troubleshooting, according to the providers’ documented log-retention periods; longer only when an incident or legal obligation requires it.
2.2 Slyraf account and social sign-in
- Data
- Internal user ID; selected provider (Discord, Google or Twitch); provider identifier; email, display name and avatar where supplied by that provider; linked identities; session and sign-in dates.
- Purpose
- Create the account, sign you in, keep your session active and link or unlink sign-in methods.
- Legal basis
- Performance of the service you request. Linking an additional provider is optional.
- Retention
- While the account remains active, then deletion or anonymisation following account deletion, subject to short technical backups and any legal obligation. Inactive accounts may be deleted after 24 months of inactivity and prior notice where practical.
2.3 Wuthering Waves Pull Tracker
- Data
- Imported convene history: banner, item or character, rarity, date/time, resource identifier and pity information.
- Purpose
- Import, synchronise, display and calculate your convene statistics.
- Legal basis
- Performance of the service you request.
- Retention
- Until you delete the history or the associated account. Archived import data used to make an import reliable expires after 72 hours.
2.4 Echo Analyzer
- Data
- Game UID, player name, character/build, weapon and Echo statistics, calculated score, technical visitor identifier, source-image hash and OCR confidence. A proof image may be retained only when a verification is requested or needed to protect ranking integrity.
- Purpose
- Analyse and save builds, prevent duplicates and manipulation, provide sharing and leaderboards, and process verification requests.
- Legal basis
- Performance of the requested service; legitimate interests in fraud prevention and leaderboard integrity; consent for optional public sharing.
- Retention
- Until you delete or detach the history. Verification material is kept only for the review and dispute period, normally no more than 6 months after the request closes, unless a longer period is needed to establish or defend legal claims.
2.5 PvP rooms and tournaments
- Data
- User or guest identifier, display name, character box, room actions and results; for registration, nickname and Discord or Twitch contact.
- Purpose
- Create and operate rooms, organise tournaments, contact selected players and publish results or rankings.
- Legal basis
- Performance of the requested service and steps taken at your request before participation; legitimate interests in running and securing competitions.
- Retention
- Room access expires according to the deadline shown by the feature. Registration and contact details are kept for the tournament and up to 6 months after it ends; public results may remain as an event archive, limited to the nickname and result, unless you object on legitimate grounds.
2.6 Contact and rights requests
- Data
- Email address and any information you choose to include in your message.
- Purpose
- Answer your request and keep evidence of its handling where necessary.
- Legal basis
- Legitimate interests in handling correspondence, steps taken at your request, or compliance with a legal obligation for data-protection requests.
- Retention
- General correspondence: up to 3 years after the last exchange. Rights requests and supporting evidence: for the time needed to handle the request, then up to 5 years where necessary to establish compliance or defend legal claims.
3. Public information
A Pull Tracker history is private by default. By contrast, a user who deliberately publishes or submits a build, leaderboard profile, tournament registration or result should expect the information clearly identified by that feature — such as nickname, game UID, build, rank or result — to become visible to other users. Email addresses, OAuth tokens and tournament contact details are not intended for public display.
Before sharing a screenshot or free-text message, remove information about third parties that is not necessary.
4. Cookies and browser storage
Slyraf uses cookies, localStorage, sessionStorage and IndexedDB only when they are necessary for a feature requested by the user, such as language selection, authentication, local saving or PvP operation. The Site does not use Google Analytics or advertising cookies.
| Storage | Purpose | Duration / control |
|---|
lang_pref | Remember a manual language choice. | 12 months. |
| Account/session storage | Authentication, account linking and security. | Session lifetime or until sign-out/expiry. |
| Feature storage | Locally save tracker, tier-list, PvP and interface state requested by the user. | Until the feature deletes it or you clear site data in the browser. |
Because no advertising or audience-measurement tracker is used, the Site does not display a consent banner. You may clear local Site data at any time through your browser settings; this may sign you out or delete locally saved feature data.
5. Recipients and service providers
Data is accessible only to Slyraf personnel who need it and, within their assigned role, to the following providers:
- Cloudflare, Inc. — hosting, content delivery, security, Workers and D1 database.
- Supabase, Inc. — authentication, PostgreSQL database, storage and server-side functions.
- Google LLC — only when you choose Google OAuth to sign in.
- Discord Inc. / Twitch Interactive, Inc. — only when you choose the relevant OAuth sign-in or open/use their service.
- The email provider used to receive and answer messages sent to contact@slyraf.com.
Some providers and their subprocessors may process data outside the European Economic Area. Depending on the recipient and destination, these transfers are governed by an adequacy decision (including the EU–US Data Privacy Framework where applicable), Standard Contractual Clauses or another safeguard permitted by Chapter V GDPR. Provider documentation is available here:
6. Your rights
Depending on the processing and its legal basis, you may exercise rights of access, rectification, erasure, restriction, objection and data portability. Where processing relies on consent, you may withdraw it at any time without affecting prior processing. You may also give instructions concerning your personal data after death where French law permits.
Send your request from the address linked to your account, where possible, to contact@slyraf.com. Additional proof of identity is requested only where there is reasonable doubt. A response is provided within one month; this may be extended by two months for a complex or numerous request, with notice during the first month.
If you believe your rights have not been respected, you may lodge a complaint with the French Data Protection Authority (CNIL): www.cnil.fr.
Slyraf does not make decisions producing legal or similarly significant effects based solely on automated processing.
7. Security and changes
Slyraf applies proportionate technical and organisational measures, including encrypted transport, access controls, account-scoped database rules and restricted administrative access. No system can guarantee absolute security; report a suspected incident promptly to the contact address above.
This policy may change when the Site or legal requirements change. The date above identifies the current version; a prominent notice will be displayed for a material change.
