Privacy Policy

This policy describes what data LWS Quartermaster collects, how it uses that data, and the controls available to users. The Service is a fan-made tool for analyzing alliance and player data from the mobile game Last War: Survival (developed by First Fun, published by FUNFLY PTE. LTD); the Service is operated independently of both the developer and the publisher.

1. Data we collect

1.1 Account data

Field	Why we have it
Email address	Account identification, password reset
Password (hashed with argon2id)	Authentication. Plaintext is never stored.
Display name	How you appear in the portal UI
Last login timestamp + IP	Audit, security review

1.2 Session data

• access_token cookie — short-lived (4 hours) JWT identifying the signed-in user. Set as secure, httpOnly, samesite=lax.
• refresh_token cookie — 30-day rotating token used to mint new access tokens without re-prompting for password.
• Browser User-Agent string captured at login for the audit log.

1.3 Game data forwarded by the LWS Client

The companion Windows client passively captures specific SmartFoxServer packets from the running game (developed by First Fun, published by FUNFLY PTE. LTD) and forwards them to the portal. Captured packets include:

• Alliance member rosters (names, power, donation counts, VS scores, online/offline status)
• VS event scores and daily breakdowns
• World map tile data (player base coordinates, alliance flags, resource nodes) for areas the user navigates near
• Alliance city ownership (capitol + 84 city slots per server)
• Alliance government roles (R1–R5 transitions)

All of this data is publicly observable in-game by anyone who taps the relevant icons; the LWS Client does not extract anything that is not already exposed to the running game client. The LWS Client does not capture chat messages, mail content, payment information, or your in-game account credentials for First Fun / FUNFLY PTE. LTD's services.

1.4 Cookies

The Service uses only the session cookies described in §1.2. No third-party tracking, analytics, or advertising cookies are set.

2. How we use the data

• To provide the analytics views in the portal (Members, Power, VS, Map, etc.)
• To enforce alliance-level access control (only members + admin see their alliance's roster/power data)
• To compute aggregate platform metrics shown to admins (player counts, server coverage, contribution stats)
• To debug issues raised by users (admin "view as" feature, audit-logged)

3. How we store the data

Data is stored on a single AWS EC2 instance in the eu-west-1 region. The database is a single SQLite file on an encrypted EBS volume. HTTPS (TLS 1.3) is enforced via Caddy with Let's Encrypt certificates. Passwords are hashed with argon2id; plaintext passwords are never persisted anywhere.

4. What we share

We do NOT:

• Sell your data to anyone
• Share your data with advertising networks
• Provide aggregate or per-user data to First Fun, FUNFLY PTE. LTD, their employees, competitors, or other third parties

Within the platform, alliance data is shared among members of that alliance (rosters, power, VS scores) and visible to platform admins. Map tile data on a server is visible to all users with map_track module access on that server.

5. Data retention

Two distinct retention rules apply, depending on whether the data identifies you as the registered account holder or describes in-game state captured by the LWS Client.

5.1 Your personal account data

• Account records (email, password hash, display name): retained until you request deletion at privacy@0x88.sh. Once we verify the request, the account and its directly-identifying records are deleted within 30 days under your GDPR Art. 17 right to erasure.
• Audit logs (login events, admin actions including view-as impersonation): 90 days minimum for security review.

5.2 Captured game data

Data captured by the LWS Client — alliance rosters, world-tile observations, VS-event scores, similar in-game state — is not personally identifying to you as the account holder. It describes other players' in-game characters as the game itself broadcasts that state to anyone playing nearby. We retain captured game data as part of the historical record of your alliance's performance for as long as the Service operates, because that history is the core feature Quartermaster exists to provide.

If you appear in captured rosters via your own linked in-game player and you want those records deleted (for example, after you stop playing the game), email privacy@0x88.sh with the in-game uid(s) you want removed. We will action verified deletion requests within 30 days. Deletion of one player's records does not delete that player's appearance in alliance-wide aggregate metrics where re-identification is no longer possible.

6. Your rights

Subject to applicable law (including the GDPR for users in the EU/EEA and the UK Data Protection Act), you may:

• Request a copy of the personal data we hold about you
• Correct inaccurate data via your profile page
• Request deletion of your account and associated personal records (some captured aggregate game data may persist)
• Withdraw consent for processing by closing your account

To exercise these rights, contact the platform operator at privacy@0x88.sh. We aim to respond within 30 days; identity verification may be required for access or deletion requests covering personal data.

You also have the right to lodge a complaint with the Irish Data Protection Commission (dataprotection.ie) — the lead supervisory authority given the Service's eu-west-1 hosting — or with the supervisory authority in your country of residence, if you believe your data has been processed unlawfully.

7. Children's privacy

The Service is not directed at children under 16, and we do not knowingly collect personal data from anyone under that age. The threshold is set at 16 universally — matching the GDPR Art. 8 digital consent age in the strictest EU/EEA Member States — rather than the 13-year baseline applied in some other jurisdictions, to keep a single defensible age across all users.

The Service does not operate an age-verification mechanism; eligibility relies on the self-declaration made when accepting the Terms of Service at registration. If you become aware that a person under 16 has registered, contact us at privacy@0x88.sh. Once we confirm the report, we will delete the account and any directly-identifying records associated with it within 5 business days.

8. International transfers

Data is processed in eu-west-1 (Ireland). If you access the Service from outside the EU, your data is transferred to the EU for processing.

9. Changes to this policy

Material changes will be surfaced in the portal UI and/or via email to registered users. The "last updated" date at the top of this page reflects the most recent revision.

10. Contact

Privacy questions, data subject requests, and breach reports can be directed to privacy@0x88.sh.