miowawa.de is a small hobby website with a word game and chat. We try to collect as little as possible. This page explains in plain language what the site stores, why, and for how long.
You do not need to sign up. When you open the site, a random profile is created automatically. We do not ask for your e-mail address, real name or phone number. The site contains no analytics, no advertising and no third-party trackers, and it does not use cookies.
| Data | Why | How long |
|---|---|---|
| Random profile ID and a secret login token (only a one-way hash of the token is stored on the server) | To recognise your browser the next time you visit. | Until the profile is deleted. |
| Your display name (anything you choose, 3–20 characters; it does not have to be unique) | Shown to other players and in chat. | Until you change or delete it. |
| Your profile picture (max. 10 KB, still image) | Shown to other players. | Until you change or remove it. |
| Linked account (optional; for example Discord, Twitch, Google, GitHub, Microsoft, Bluesky, Mastodon, Last.fm, Vercel, Netlify or another sign-in service listed in the connections panel): account ID, name, avatar and the access tokens issued by the provider | To sign in with that account and show its name/picture. Other people in the same room see the account name next to your name (e.g. “name on Discord”). We only ask for the basic public profile (for Google only your first name and picture), never for messages, servers or e-mail. A linked account is also required to play Categories. Tokens are stored encrypted. | Until you click “Disconnect” or the profile is deleted. |
| Two-step protection (2FA, optional): a secret key for your authenticator app (stored encrypted), the time of the last used code, up to 8 recovery codes (only one-way hashes), an optional recovery e-mail address you add yourself, short-lived 6-digit e-mail codes (only one-way hashes, valid 10 to 15 minutes) and the number of wrong tries | To protect the developer page and your apps. Needed before you can create an app. The 2FA code is only asked for sensitive actions on that page; the site itself still works with your login token. | Until you turn 2FA off or the profile is deleted. |
| List of browsers: a random browser id (only a one-way hash is saved), a short browser name such as “Chrome on Windows”, the first and last time it was used, and, if you choose it, the end of the 30 days “remember this browser” | So you can see where your account is used, sign out other browsers and skip the 2FA code in a browser you trust. | Up to 12 browsers are kept (the oldest drop out). Everything goes when you sign out other browsers or the profile is deleted. |
| Statistics of your developer apps: the number of sign-ins and of new people per day (counts only, no names), kept for 60 days | To show you how much your app is used. | Until the app is deleted. |
| Developer apps (optional, max. 3 per profile): app name, description, website, contact e-mail address, logo (small picture), redirect addresses, app type, a one-way hash of the app secret, the creation time and a status (checked, trusted or blocked by the team) | So other websites can offer “Sign in with miowawa”. App names, logos and websites are shown to people who are asked to allow the app. | Until you delete the app or the profile. |
| App deletion: when you ask to delete an app, we send one e-mail with a confirmation link to the app’s contact address. It contains your IP address, the time and a rough place (city and country). We keep a one-hour, single-use link in memory only. After you confirm, we send a second e-mail. | So an app is only deleted when the owner of that e-mail address confirms, and so you can see where the request came from. | The link expires after 1 hour or when used. The e-mail address is deleted with the app. E-mails stay in your own mailbox. |
| Allowed apps: which app you allowed, which parts of your profile it may see (profile, linked accounts you show) and when. Short-lived codes and access tokens (1 hour, kept in memory only, never written to disk, no refresh tokens) | So you can see and remove access at any time on the developer page. An app that you allowed receives a separate user ID that is different for every app, your display name, your profile picture and your role, and, only if allowed, the accounts you show on your profile. It never sees your messages, friends, e-mail or IP hash. | Until you remove the access or the profile is deleted. Tokens expire after 1 hour. |
| “Join our Discord” (optional): your Discord user ID | Only if you click “Join” and confirm on Discord. Discord then lets our bot add you to our community server (permission “join servers for you”). We do not store your Discord account, name or access token; the ID is used once for that request. | Not stored by us. After joining, Discord's own privacy policy applies to your Discord account. |
| Staff / moderator / game content editor access (only for team members) | To give team members their role. | While the role is active. |
| A keyed hash of your IP address (not the IP address itself) | Abuse prevention: site bans, rate limiting, blocking VPNs/Tor. The original IP address cannot be recovered from the hash. | Until the profile is deleted; bans are kept until lifted. |
| Word suggestions (only if you use the suggestion form): the words, your optional comment, your display name and the time | So the team can review your suggestion. | Until the team has reviewed and deleted it. |
| Game statistics (rounds played, wins, words typed, average reaction time, number of chat messages, favourite dictionary, wins per week), unlocked achievements and the last time you were online | For your profile, the leaderboard and achievements. Other players can see your name, picture, statistics and the achievements you chose to show. Chat messages are only counted, their text is not saved. | Until the profile is deleted. |
| Friends list and friend requests (the profile IDs of the people involved) | So you can find friends, see if they are online and which room they are in, and invite them. Only your friends see where you are playing. | Until you remove the friend or the profile is deleted. |
| Direct messages between friends (the last 100 messages per conversation, stored on both accounts) including small pictures (shrunk to a few dozen KB, the last 20 pictures per conversation are kept) and the number of messages you have not read yet | So friends can write to each other, also when one of them is offline. Only the two people in the conversation can see the messages. | Until you remove the friend or the profile is deleted. |
| Game rooms and chat messages | To play together. The last 50 chat messages of a room are kept in memory. So that a running game survives a server restart, a temporary copy of the open rooms (players, round status, last 50 chat messages) is saved on the server every second. | Deleted automatically when the room is closed (empty rooms disappear after 1 minute). The temporary copy is deleted right after a restart and discarded if it is older than 10 minutes. |
The site stores your secret login token in your browser’s localStorage (key userToken) and, if you use them, your sound on/off setting (sound), your language (lang) and your display settings such as theme, accent colour and volume (settings). This is strictly necessary for the site to work and is not used for tracking. If you clear your browser data, you will get a new random profile.
Like every web server, our web server briefly processes your IP address, the requested page and your browser’s user-agent when you connect. This is needed to deliver the site and to defend against attacks and abuse. Connections are encrypted (HTTPS/WSS). Stored profile data is encrypted at rest.
To block VPN and Tor traffic we compare your IP address against public lists that are downloaded to our server; your IP address is not sent to any third party for this.
ipwho.is (only your IP address is sent). The service is also used for the 6-digit codes of the optional recovery e-mail (the address and the code pass through it). The location lookup only happens when you delete an app.We do not sell your data and do not share it with advertisers.
Names and chat messages are checked automatically for inappropriate words. Team members can search profiles by name, view the data listed above and ban profiles or IP hashes that break the rules.
Bots: automated players (bots) need a bot account that only the team can create. A bot account stores the bot's name, who created it, the creation time and a one-way hash of its secret; it has no profile, friends or messages. To spot bots without an account, the server briefly checks while you play how fast you answer and whether you type before sending a word. Only the last few turns are held in memory and they are not stored or logged. Your browser also checks, only on the game page, whether the word field is used with a real keyboard, whether the browser is remote controlled and whether the game connection was tampered with by a script; it does not read or list your extensions or any other data, and only the result (one of those three reasons) is sent to the server. If a player clearly acts like a bot or a cheat script, the profile is banned automatically. The IP hash is blocked too. If you were banned by mistake, write to the contact address below and a team member will look at it.
The site is not directed at children under 13 (or under 16 where required by local law). If you believe a child has provided personal information, please contact us and we will delete it.
We may update this policy when the site changes. The date at the top shows the latest version.
root · Germany · rootjusii@gmail.com