1. Purpose
This Privacy Policy explains how Arab Wuwa handles information when you browse the website, create an account, use public profile/forum/community features, send feedback or direct messages, use owner-approved calculator access, save My Echoes roster data, or subscribe through PayPal.
Arab Wuwa is an unofficial fan site. It is not affiliated with Kuro Game Co., Ltd.
2. Information We Collect
| Category | Examples | Purpose |
|---|---|---|
| Account data | Email address, Firebase UID, sign-in provider, verified-email status, account timestamps | Authentication, account security, account display, and access to signed-in features |
| Profile data | Display name, avatar, profile card, Arab Wuwa ID, BIO, game UIDs, game UID visibility choice | Show your account page, public profile, community rows, and profile customization |
| Community and social data | Following/follower relationships, liked characters, favorite teams, My Roster selections, linked weapons, sequences, refinements | Power public profiles, community owner pages, community counts, and social features |
| Forum content and media | Posts, replies, titles, tags, section IDs, safe formatting, uploaded images converted to WebP, thumbnails, YouTube provider/video IDs, Team DPS IDs, edits, deletes, watches, likes, bookmarks, and search text | Operate forum pages, forum search, post/reply display, safe media serving, notifications, public indexing, and user controls |
| Feedback and direct messages | Feedback titles/descriptions, optional feedback screenshots, owner feedback replies, direct message text, message images converted to WebP, message read state, message preferences, blocks, reports, saved report snapshots, timeouts, ban requests, and abuse-prevention limits | Operate the Feedback page, owner replies, user-to-user messages, message alerts, report review, moderation actions, image serving, and safety controls |
| Roster build and My Echoes data | Character builds, reusable roster echoes, echo stats, sonata sets, proof status, linked character slot, verification state, and usage counts | Show public build pages, let users manage saved echoes, support moderation review, and enforce storage limits |
| Calculator data | Saved rotations, saved calculations, inventory folders, echo data, timing entries, usage counts, calculator state you choose to save | Private calculator access and saving for owner-approved calculator users |
| Subscription data | PayPal subscription ID, plan, status, current paid period, cancellation state, webhook event IDs, plan change state | Manage optional support subscriptions, My Echoes storage limits, cancellation/plan changes, and duplicate webhook processing |
| Technical data | Server logs, IP address or request metadata, browser information, timestamps, error information | Security, abuse prevention, debugging, and website operation |
| Forum moderation and safety data | Reports, report reasons/details, moderation actions, hidden/deleted status, staff notes, section permission grants, rate-limit records, image validation results, and abuse-prevention metadata | Moderation, audit history, safety enforcement, restricted-section access, spam prevention, and security review |
PayPal processes payments. Arab Wuwa does not store your card number, bank details, PayPal password, or full PayPal payment method details.
3. What Other Users May See
Some account data is intentionally public when you use public features. Your public profile may show your display name, avatar, Arab Wuwa ID, BIO, membership styling, social relationship state, liked characters, favorite teams, and roster preview.
Community character and weapon pages may show your display name, avatar, account slot, sequence, refinement, linked weapon, and selected roster data. Game UIDs remain hidden unless you choose to show them to other users.
Published forum pages may show your posts, replies, uploaded/compressed images, selected formatting, YouTube embeds, Team DPS references, tags, rank badge, staff label, Profile Points, display name, avatar, and Arab Wuwa ID. Public forum pages may be indexed by search engines unless a post, section, or moderation rule prevents indexing.
The Leaks section is intended to be publicly readable and may be indexable, but posting and replying there can be limited to users approved by the owner or authorized moderators.
Direct messages are not published on public pages. The message recipient can see the messages and images you send. If a message or conversation is reported, a limited recent snapshot may be reviewed by the owner or website moderators for safety and moderation.
4. Storage, Cookies, and Local Data
- Firebase Authentication handles sign-in, passwords, email verification, Google sign-in, and authentication sessions.
- Hostinger MySQL stores account-linked website data, public profile data, forum data, roster data, My Echoes data, proof review metadata, social data, calculator saves for approved calculator users, and subscription status.
- Private server storage may store forum images after validation and conversion. Forum images are re-encoded as WebP, metadata is stripped by re-encoding, thumbnails are created, and original forum uploads are not kept for display.
- Forum image endpoints serve approved forum images and thumbnails through controlled Arab Wuwa URLs instead of directly exposing private upload folders.
- Message image storage stores direct-message images in private server storage after validation and WebP conversion. Message image URLs use controlled authenticated endpoints instead of exposing the private upload folder.
- Forum video embeds store normalized provider/video IDs for approved providers, starting with YouTube. Arab Wuwa does not store uploaded video files for forum posts.
- PayPal processes subscriptions and sends status updates to Arab Wuwa through API/webhook events.
- Browser storage may keep local calculator work-in-progress for approved calculator users so refreshes do not erase the current calculator setup. Local browser data stays on your device unless you save it through the website.
- Arab Wuwa does not use advertising cookies or sell personal data to advertisers.
5. How We Use Information
- To operate account login, public profiles, forum pages, My Roster, My Echoes, community pages, social features, and owner-approved calculator access.
- To operate forum posting, replies, search, media uploads, image serving, YouTube embeds, Team DPS embeds, reports, moderation, restricted sections, notifications, and public forum indexing.
- To operate feedback submission, owner feedback replies, direct messages, image uploads, message reports, message timeouts, message blocks, and unread alerts.
- To provide My Echoes storage according to subscription tier and calculator saving according to owner-approved calculator access.
- To enforce My Echoes storage limits, calculator access limits, and owner access.
- To support roster proof review and remove proof images after moderation decisions where applicable.
- To process PayPal subscription status, cancellation, renewal, failed renewal, and plan changes.
- To prevent abuse, protect accounts, validate uploads, enforce rate limits, debug errors, and keep the website online.
- To respond to account, payment, subscription, privacy, and legal requests.
7. Data Retention
| Data | Retention |
|---|---|
| Account, profile, social, and public roster data | Kept while your account exists or until you delete/change the relevant data. |
| Published forum posts and replies | May remain readable after account deletion so public threads do not break. Deleted accounts may be anonymized or detached from public identity. |
| Forum images and drafts | Kept while needed for live forum content or drafts. Removed when the related content is deleted, hidden where applicable, or removed during account deletion where practical. |
| Forum reports, moderation logs, restrictions, and rate limits | Kept as needed for abuse prevention, audit history, legal safety, security review, and repeat-violation handling. |
| Direct messages | Each conversation keeps the latest 100 messages. Older messages may be automatically pruned. Account deletion or owner-approved account removal may delete or detach message records where practical, while preserved report snapshots may remain for audit. |
| Message images | Compressed message images expire after 30 days. Expired image files may be deleted from private storage, while limited expired-image metadata may remain so the conversation can show that an image expired. |
| Message reports, snapshots, timeouts, and ban requests | Kept as needed for abuse prevention, moderation review, owner decision history, account-removal audit, legal safety, security review, and repeat-violation handling. |
| Calculator saves and My Echoes data | Kept until you delete them, delete your account, or until we need to remove old/inactive data for storage, abuse, or technical reasons. |
| Proof images | Kept while pending review when needed. Approved or rejected proof images may be deleted after the moderation decision while proof status is retained. |
| Subscription records | Kept as needed for payment status, account access, dispute handling, accounting, and abuse prevention. |
| Browser local storage | Stays on your own device until you clear browser data or use page reset controls. |
| Server logs and technical records | Kept only as long as reasonably needed for security, debugging, and operation. |
If a subscription ends, existing My Echoes data and any existing approved calculator saved data are not automatically deleted just because access ended. The higher My Echoes storage limit may end after the paid period, and calculator access is controlled separately by owner approval.
8. Security
- HTTPS is used across the website.
- Private calculator logic and server configuration are kept behind server-side PHP/API access rather than public browser files where practical.
- Firebase ID tokens are used to protect account APIs.
- Forum uploads are validated server-side, limited by file type/size/dimensions, re-encoded before storage, and served without executable MIME types.
- Forum text is escaped or rendered through strict safe formatting rules instead of accepting raw HTML, scripts, iframes, SVG/XML, PHP tags, unsafe URLs, or arbitrary embed code.
- Forum search, sitemap, image serving, moderation views, and restricted sections are filtered server-side so hidden, deleted, private, or unauthorized content is not intentionally exposed.
- Message text is escaped before display. Message images are validated, converted to WebP, stored outside public web folders, and served only through authenticated controlled endpoints.
- Message reports save limited recent context for review; website moderators cannot use the reports page to freely browse full private conversations.
- PayPal webhook/API data is processed server-side before subscription status is changed.
No internet service is perfectly secure. We cannot guarantee absolute security or permanent availability.
9. Your Choices and Rights
- You can update your display name, avatar, profile card, BIO, game UIDs, and game UID visibility from your account page.
- You can delete or change your saved roster, My Echoes, and calculator content through the relevant tools where available and when you have access.
- You can edit or delete your own forum posts and replies where the forum tools allow it, subject to moderation, abuse-prevention, and audit needs.
- You can block incoming user messages from your profile, block specific conversations where available, and report unsafe message behavior.
- You can cancel subscriptions from the subscription page where available, or from PayPal.
- You can delete your Arab Wuwa account from the account page. Deleting your account removes account-linked website data from Arab Wuwa systems where practical, but public forum threads and preserved moderation records may remain readable or stored with your identity anonymized or detached.
- You can use the Feedback page to request access, correction, export, or deletion where required by applicable law.
10. Children
Arab Wuwa is not directed to children under 13, or the minimum digital-consent age in your country, whichever is higher. If you believe a child has created an account, use the Feedback page so we can review and remove it.
11. Changes
We may update this Privacy Policy as features change. Continued use of the website after an update means you accept the revised policy.
12. Contact
For privacy, account, payment, or legal requests, use the Feedback page.
Last updated: 3 June 2026