Privacy Policy

1. Who we are

Wyld Rivals is operated by Property Investments (UK) Limited (trading as Wyld Rivals), a company registered in England and Wales (Company No. 08852962). Our registered office is Westminster House, 10 Westminster Road, Macclesfield, SK10 1BX.

For any privacy-related enquiry, email [email protected].

This policy explains how we collect, use, and protect personal data in line with UK GDPR, the Data Protection Act 2018, and the Data (Use & Access) Act 2025.

2. What we collect

• Server request logs — IP address, user agent, requested URL, timestamp. Held by our edge platform (Cloudflare) for a rolling 30-day window for abuse prevention and debugging. Never correlated with any identity.
• Voluntary email addresses — if you sign up for battle drop notifications, we store the email address and a subscription-state flag. Nothing else.
• Privacy-first analytics — aggregate page views and simple Wyld Battle progress events via Matomo. Cookie-free. No cross-site tracking. No personal identification.

3. Lawful basis for processing

Under UK GDPR (Article 6) we rely on:

• Legitimate interest — for server request logs and aggregate analytics. Both are essential to running the site, preventing abuse, and improving content. We have balanced this against your rights and freedoms.
• Consent — for the email notification list. You give consent at signup and can withdraw it at any time via the one-click unsubscribe link in every email we send.

4. What we don't collect

• No third-party ad cookies. We don't run display ads.
• No Google Analytics, Meta Pixel, or comparable cross-site tracker.
• No fingerprinting and no behavioural profiling.
• No heatmaps, session recordings, screen replay, or free-text feedback widget.
• No payment data on-site — any future commerce will use a hosted checkout provider, and we never see raw card details.
• No data sold or shared with third parties for marketing.

5. Cookies

Short answer: almost none. We do not use third-party tracking cookies and our analytics is cookie-free.

5.1 Cookies we use

On a typical visit the site sets only strictly necessary cookies, and only where they are needed:

• Bot protection — Cloudflare Turnstile and Cloudflare's bot management may set short-lived first-party cookies (e.g. __cf_bm) to distinguish humans from automated traffic on form pages and the site as a whole. Strictly necessary; not used for tracking or profiling.
• Authentication session — if you sign in to a future account feature, a short-lived session cookie keeps you signed in. First-party. HttpOnly. SameSite=Lax. Expires at the end of your session or after seven days, whichever comes first. (No account features today.)
• Theme preference — if you toggle a future light / dark mode, we store the choice in a first-party cookie so your preference persists across visits. No personal data. (No theme toggle today.)

5.2 Analytics (cookie-free by design)

We use Matomo in cookieless mode. It counts aggregate page views and simple game events so we know which content is useful and how far players get through Wyld Battle. It does not follow you across the web.

Wyld Battle events are limited to labels such as game loaded, champion selected, round milestone reached, journal opened, fact unlocked, and match completed. We do not attach names, email addresses, account IDs, user IDs, or free-text answers to these events.

Under the UK Data (Use & Access) Act 2025, certain low-risk cookies (including basic analytics and functional cookies) no longer require explicit consent. We have chosen to go further and use no analytics cookies at all.

5.3 Third-party embeds

Battle pages may embed a YouTube video. YouTube sets its own cookies when you press "play" (not before). YouTube's privacy-enhanced mode is honoured where we embed.

5.4 Cookies we do not use

• No Google Analytics, Meta Pixel, or comparable cross-site tracker.
• No third-party ad cookies — we do not run display ads.
• No fingerprinting.
• No heatmaps, session recordings, or screen replay.

5.5 Managing cookies

You can block, delete, or review cookies via your browser settings. Since we use almost none, this will have little effect on your experience of Wyld Rivals. If we ever add a category that is not strictly necessary, we will update this page and show a consent banner before setting anything non-essential.

6. Hosting and infrastructure

We use a small set of trusted providers to run the site:

• Cloudflare Pages — static site hosting.
• Cloudflare R2 — image and media storage.
• Matomo — cookie-free aggregate page views and game events.
• Cloudflare Turnstile — privacy-preserving bot protection on forms.

Our Cloudflare account is held with Cloudflare's UK/EU entity (Cloudflare Limited); data is processed across Cloudflare's global edge network. Our Matomo analytics account is hosted by Matomo Cloud. We may add other providers in the future and will update this list accordingly.

7. International data transfers

Our infrastructure providers operate globally. Where personal data is transferred outside the UK/EU, we rely on Standard Contractual Clauses or adequacy decisions recognised by the UK Government, together with the UK International Data Transfer Agreement.

8. Data retention

• Server logs: 30 days.
• Email list entries: until you unsubscribe. Every email we send contains a one-click unsubscribe.
• Analytics aggregates: 6 months.

9. Age restriction

Wyld Rivals is family-friendly. We do not knowingly collect personal data from anyone under 13. If you are under 13, please do not sign up for the email list or send us personal data. If we learn we have collected data from a child under 13, we will delete it.

10. Your rights

Under UK GDPR you have the right to access, correct, export, or erase any personal data we hold about you; to restrict or object to processing; to withdraw consent; and to lodge a complaint with the Information Commissioner's Office.

To exercise any of these rights, email [email protected] and we will respond within 30 days. Under the Data (Use & Access) Act 2025, where we need additional information from you to identify your data or scope your request, the response clock pauses until you reply.

11. Data breaches

If we become aware of a breach that is likely to result in a risk to your rights and freedoms, we will notify affected individuals and the ICO within 72 hours, as required by UK GDPR.

12. Changes

We may update this policy from time to time. Material changes will be flagged with a new "Last updated" date at the top of this page.

13. Contact

For privacy questions, data subject requests, or any other matter relating to this policy, email [email protected] or write to us at:

Property Investments (UK) Limited
Westminster House
10 Westminster Road
Macclesfield
SK10 1BX