Privacy Policy

Last updated 7 October 2026

What WikiDerby stores, where it lives, and how to get rid of it.

Stored in your browser

Your cosmetics, W-Bucks balance, trophies, settings and guest profile live in your browser's localStorage. Clearing site data erases them. We never see this unless it is also on the server for one of the reasons below.

Stored on our server

• Gameplay records tied to your player name: multiplayer ratings, match results and winner replays.
• Country: the two-letter country your connection comes from, such as “GB” or “ES”, as reported to us by our network provider, so we can see where players are. We are told the country and nothing else; your IP address is not part of it and is never stored. It is replaced, not accumulated: we keep the most recent one, not a history of where you have been.
• Account details, if you register: your email and username, held with our database provider (Supabase) so you can log in.
• Purchase records, if you buy W-Bucks: the order reference, which pack, and which account it credited. We keep these permanently, because they are the receipt trail behind a support or refund question, and tax rules require the seller to retain them.
• Anonymous usage counts: a random ID your browser generates for itself, plus events like “a race started”. No IP addresses, no user agents, no names. The first time you open the game it asks whether this is OK, and turning it off stops the ID being sent from then on — the same choice is repeated below for anyone who wants to change it later.
• Multiplayer chat: chat goes to everyone in the room as you send it, so it was never a private channel, and WikiDerby has no direct messages. We keep a copy for 30 days and then delete it automatically: the message, the name and player ID it came from, which room or race it was in, and when. It is kept so we can look into it when someone reports a problem, and we can read it.
• Reported chat: if a player reports someone, the messages around the report are copied into a separate record with both player names, so a human can act on it. Those are kept for 90 days, which is longer than ordinary chat above.
• Sanctions: if you are muted, restricted or banned, we keep what it was for, how long, and when, so a second offence can cost more than a first. Each one is deleted a year after it was given.

Children

WikiDerby is not directed at children under 13, and accounts have a minimum age. See the terms. We do not knowingly collect anything from a child below that age.

There are no ads, no third-party trackers, no profiling and no advertising identifiers in WikiDerby itself, for anyone of any age. The account data we hold is an email, a username and gameplay records.

The one thing that can bring a third party in is a room playlist, and it cannot happen by accident. In a private room the host can set a YouTube or SoundCloud link, and each player is asked before anything loads. Press play and that company's player runs in the page under their rules, including their ads and their cookies; decline and nothing of theirs is ever fetched. It is off in public rooms entirely, so a stranger cannot start it for you. If you are setting up the game for a child, declining once is remembered on that browser.

Parents and guardians: email support@xofanic.com and we will delete the account and everything attached to it. You do not need to prove anything to us first. We would rather delete an account on request than hold data for a child.

Payments

We never see or store your card. Checkout is run by Link (Stripe), which is the seller of record: your card details, billing address and email go to them, not to us, and are handled under Link's privacy policy and Stripe's. What comes back to us is the order reference and which pack to credit.

Companies that handle it for us

WikiDerby is a small game and does not own any servers. These are every outside company that touches your data, and the only thing each one is there to do:

• Render runs the game server. Everything you send the game passes through them, because they are the machine it runs on.
• Cloudflare sits in front of that server and carries every request to it, so they see your IP address and your browser's user agent. They are also who tells us your two-letter country, which is the only part of it we keep.
• Supabase is the database: accounts, gameplay records and everything else listed above is stored with them.
• Sentry receives a report when the server hits a bug — the error, and what the game was doing at the time. Crash reports are not something we compose by hand, so we cannot promise none of them will ever contain something about you. That is why they are listed here rather than left out as technical.
• Link (Stripe) takes the payment, as described above.
• YouTube and SoundCloud are different from every other company on this list, and are here for one feature only: a room playlist. If you press play on one, their player loads in the page and they see you directly — your IP address, and what you listened to — as their own customer rather than through us. They are the only names here that advertise. Nothing reaches them unless you press play, and we are not told what you chose either way. One thing does go to YouTube without a player pressing anything: if the host types words instead of pasting a link, our server asks YouTube's search API which tracks match. That request comes from us, not from anyone's browser, so it carries the words and no player's IP address or account. YouTube is loaded from its no-cookie host, which delays their cookies until playback starts; it is not the same as none.

None of them are advertisers and none of them are sent your data so they can do something of their own with it, with the single exception of the two music companies above — which is the whole reason that feature asks first.

What we don't do

We don't sell your data. The game contains no ads and no third-party trackers of our choosing: the companies above are the plumbing that makes the game run, not anyone watching you across the internet. The exception is a room playlist you press play on, which is a tracker and an ad break you chose — that is why you are asked first, why it is private rooms only, and why saying no is remembered. If anything else ever changes, this page and a consent prompt will be updated first.

There is no AI in WikiDerby. Nothing you type is sent to a chatbot or a language model, and nothing you do is used to train one. The bots you race against are ordinary code following the same rules you do.

Deleting your data

Email support@xofanic.com and we will delete your account and gameplay records. Purchase records are the exception, and are kept as required for tax and accounting, with the account link removed where possible.

Chat can be deleted the same way, and you do not need an account to ask — chat is stored against the player ID your browser generated, so tell us the name you were playing under and roughly when. If you do nothing it deletes itself after 30 days anyway.