In this Terms of Service, Privacy Policy and Statutory Disclosures (the “Agreement”): the “Services” are the games, communications, digital tools, APIs, Android client functions and pages offered via the current primary hostnames — portal/tools wusper.com (including www.wusper.com), app g.wusper.com, privacy privacy.wusper.com, joke top-up pay.wusper.com — other live subdomains (including WebRTC node node.wusper.com; deploy console coolify.wusper.com for operations only), and /tools/* paths. Legacy aliases (e.g. former app host game.wusper.com), if still resolving or redirecting, are historical aliases/redirects; the hostname you actually reach controls, and such aliases are not the current primary app host. The “Operator” is the individual maintainer who decides why and how personal data are processed: the “data user” under section 2 of the Personal Data (Privacy) Ordinance (Cap. 486) (the “PDPO”); the “controller” under Article 4(7) GDPR where the GDPR applies; and a CCPA “business” only if the statutory thresholds are met. “Personal data” has the Cap. 486 section 2 meaning. GDPR “personal data” and CCPA “personal information” are read under those laws when they apply, and are often wider. “Processing” includes collection, holding, use, disclosure, erasure, transfer and anonymisation. “Virtual items” are in-service markers only. “UGC” is user-submitted text, images, room names, skins, chat or world objects.

This Agreement is between you and the Operator. Access, registration, a click to agree, or other use is acceptance. If you disagree, stop and clear local cookies, localStorage and IndexedDB. A click or continued use is consent recorded electronically. Sections 5, 6 and 17 of the Electronic Transactions Ordinance (Cap. 553) are cited for the concepts of electronic records, electronic signatures and retention. This citation is not an opinion that every click is an electronic signature under section 6.

Non-material clarifications take effect when posted. Material changes to collection, use, retention, cross-border transfer, or dispute resolution take effect only after at least seven days’ notice on this page where practicable, plus a banner and/or email to registered users when we have an address. This 018 edition is published 19 October 2026 and effective 26 October 2026; publication starts an at-least-seven-day notice period ending on the effective date 26 October 2026. Client keys gh_privacy_ok and gh_privacy_version may re-prompt when the document identifier changes. Continued use after the eventual effective date is acceptance. Mandatory protections under Directive 93/13/EEC and the Unconscionable Contracts Ordinance (Cap. 458) are not waived by that fiction.

The Services are for persons with capacity to contract. Under the Age of Majority (Related Provisions) Ordinance (Cap. 410) the age of majority in Hong Kong is 18. You must self-attest majority where you live, or parental or guardian consent after review of this Agreement.

There is no technical age gate on OAuth, email one-time passwords, or guest login. The Services are not directed to children under 13 within 15 U.S.C. §§6501–6506 and 16 C.F.R. Part 312. We do not knowingly collect personal data from children under 13 for the purpose of targeting them. If we gain actual knowledge that we have done so, we will delete it and disable the account. Article 8 GDPR (member-state digital age of consent between 13 and 16) is not the basis on which this project offers the Services to children. A guardian may email us to locate and, once reasonably verified, disable or delete a minor’s account.

You may sign in by OAuth (Google, and Discord or Microsoft if enabled), email one-time passwords, or other methods we offer. OAuth depends on the provider returning email, display name, avatar URL and a provider user identifier. We do not ask the provider for your provider password. Keep credentials and signed-in devices secure. Activity under the account is generally treated as yours. Sharing, transfer, rental or sale of accounts is prohibited. On suspected compromise, disconnect, revoke and notify us.

Guest accounts have a seventy-two-hour time-to-live, after which related data are physically deleted, generally without individual notice, restoration or compensation. The twelve-hour session cookie and the seventy-two-hour guest account are different clocks (Section 31). You agree not to impersonate, not to circumvent controls, to remain responsible for malware, leaked cookies and extensions you authorised, and to comply with computer-misuse, telecom, copyright, harassment and anti-cheat laws, including section 161 of the Crimes Ordinance (Cap. 200) as narrowed by the Court of Final Appeal, and 18 U.S.C. §1030.

Subject to this Agreement we grant a personal, non-transferable, non-exclusive, revocable, limited licence for personal, non-commercial use. No intellectual-property ownership passes. Site appearance, code, copy, audio, art other than your UGC, and this text remain with the Operator or licensors. Works protected by the Copyright Ordinance (Cap. 528) may not be copied or communicated to the public without permission.

You must not reverse engineer except where mandatory law allows; abuse the Services with bots, scrapers or cheats, including memory reading in gomoku or other matches; launch denial-of-service attacks or malware; resell toolkit capacity; circumvent Gauntlet, in-app browser blocks or blocklists; harass, threaten, post hate speech, sexual exploitation, or child sexual exploitation prohibited by the Prevention of Child Pornography Ordinance (Cap. 579); publish another person’s personal data without authority, including an IP visible to you via peer-to-peer, which may also engage section 64 of the PDPO as amended; or use the Services for fraud, money-laundering, unauthorised commercial proxy or VPN operations, or to help others break the law.

Points, coins, pets, skins, ranks, experience and other virtual items are digital markers for feature access. They have no fiat value, are not securities, deposits, stored-value facilities under the Payment Systems and Stored Value Facilities Ordinance (Cap. 584), or e-money. We do not currently sell them for fiat as a primary model. The pay.wusper.com skin is a joke check-in mapped to /api/easter_egg/fake_recharge. Alipay, WeChat and card radios are not wired to an acquirer. Do not type real card numbers or payment passwords there. Virtual items do not acquire cash value merely because a paid feature might appear later.

We may modify, freeze, revoke or reset virtual items for balance, exploits, anti-cheat, system changes or shutdown. Off-platform real-money trading is prohibited. Items vanish on account deletion, guest expiry or project end and are not a debt. This project does not operate a virtual-asset exchange or a Cap. 615 Schedule 3B virtual-asset service. If that characterisation ever changed, the feature would stop until licensing was addressed. This page does not imply a licence.

The PDPO and Schedule 1 Data Protection Principles are the primary frame, because the Operator and the contact point are in Hong Kong. The GDPR or UK GDPR may apply under Article 3(2) if services are offered to data subjects in the EEA or the United Kingdom. A US state law may apply if its business threshold is met. We have not appointed an Article 27 representative, have not filed a formal EU data-protection impact assessment, and do not claim the CCPA business threshold. Section 14 nonetheless grants contractual access, correction, erasure, restriction, portability and objection rights, with a target of forty days aligned to PDPO access practice and one month aligned to Article 12(3) GDPR.

We do not sell personal data to brokers, do not exchange it for money or other valuable consideration, and do not “share” it for cross-context behavioural advertising. That statement addresses the CCPA/CPRA definitions of sale and share, the Nevada NRS 603A opt-out of sale, and PDPO Data Protection Principle 3. Subdomain session sharing exists so the toolbox and the game can see one login. It is not cross-site ad tracking.

Under section 2 of the PDPO the data user is the person who controls the collection, holding, processing or use of personal data. The person who operates the Services and decides purposes and means is that data user. The PDPO has no general registration scheme. This section is not a filing with the Privacy Commissioner.

The table maps Schedule 1. DPP1: collect for a lawful purpose, by lawful and fair means, and not excessively. DPP2: accuracy and retention no longer than necessary. DPP3: no new purpose unless directly related, consented, or exempt. DPP4: practicable security steps. DPP5: openness. DPP6: access and correction, given statutory form by sections 18 and 22. The table is an explanation, not a filing.

Section 18 creates the data-access request. The data user must comply within forty days or explain. Section 22 creates correction. Section 20 lists refusals, including other persons’ data, crime prevention and legal privilege. We do not charge for access. The PDPO has no general erasure right identical to Article 17 GDPR. Account deletion is a contractual right, subject to logs, backup rotation and legal holds. Section 64, as amended in 2021, criminalises certain disclosure of personal data without the data user’s consent. You must not use the Services for doxxing.

Section 33 on cross-border transfer is not fully in force. Section 15 still lists real processors so you are not told that data remain only in a Hong Kong rack.

Part VIA of the PDPO regulates use of personal data in direct marketing and provision of personal data to others for direct marketing. Consent and an opt-out are the statutory model. We do not use personal data collected through the Services for that purpose and do not plan promotional electronic messages. One-time passwords and policy notices are operational.

Article 3(1) GDPR applies to establishment in the Union. This project has none. Article 3(2) applies to offering goods or services to data subjects in the Union, or monitoring their behaviour there. EDPB guidance looks for an intention to offer services in the Union. The Services are in Traditional Chinese and English, resolve globally, and have no EU-specific marketing, euro pricing or Union representative. If a supervisory authority nonetheless treats Article 3(2) as engaged, this Section is the arrangement that answers it. The UK GDPR and Data Protection Act 2018 apply separately. The ICO is the United Kingdom authority. No United Kingdom representative is appointed.

Where the GDPR applies we process under Article 5: lawfulness, fairness, transparency, purpose limitation, minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability. Article 6(1)(b) covers processing necessary for this Agreement (account, match, toolkit). Article 6(1)(f) covers security, abuse defence, debugging and service integrity, balanced against your interests. Location is Article 6(1)(a) consent after the browser prompt. Article 6(1)(c) covers legal obligation. We do not seek Article 9 special-category data. Do not submit health, biometric templates, religion or sex-life data in chat or tools. If you do, we may delete it.

Article 13 requires identity, purposes, bases, recipients, transfers, retention, rights, withdrawal of consent, the right to complain, and whether provision is statutory or contractual. This page is that notice. Article 14 covers data not obtained from the data subject. An IP in a log of your own request remains an Article 13 case.

Where applicable you may use Article 15 access, Article 16 rectification, Article 17 erasure, Article 18 restriction, Article 20 portability where processing is consent- or contract-based and automated, and Article 21 objection to legitimate interests. Article 22 restricts solely automated decisions producing legal or similarly significant effects. Gomoku moves, matchmaking and human verification do not produce credit, employment or legal effects.

Article 12(3) sets one month, extendable by two for complexity. Our target is one month, alongside the forty-day PDPO access target. Unverified requests may be refused so a third party cannot delete your account.

Article 5(3) of Directive 2002/58/EC, as amended by Directive 2009/136/EC, requires consent before storing or accessing information on terminal equipment, unless strictly necessary for transmission or for a service the user explicitly requested. Session cookies and the short human-verification cookie are strictly necessary for the service you requested. Theme, language and privacy-version keys in localStorage serve the interface and consent record you asked for. We do not set cross-site advertising cookies. The UK Privacy and Electronic Communications Regulations 2003 are parallel. We send no direct-marketing email or SMS.

Regulation (EU) 2022/2065 applies to intermediary services offered to recipients in the Union. If the Services are treated as hosting, Article 16 requires a notice mechanism for content the notifier considers illegal, Article 14 requires terms to describe restrictions and moderation, and Article 17 requires a statement of reasons for account restrictions, with exemptions for micro and small enterprises. This project is not a very large online platform and does not accept systemic-risk duties. Illegal-content notices go to the contact email with a URL, reasons and contact details. Handling is best-effort.

The United States has no single comprehensive federal consumer-privacy statute. Section 5 of the Federal Trade Commission Act, 15 U.S.C. §45, prohibits unfair or deceptive acts or practices. Statements on this page about collection, non-sale, non-marketing, the joke top-up, and the absence of a public toolkit index are made so that they are not deceptive under that section. Practice must change only after this page changes.

The CAN-SPAM Act, 15 U.S.C. §§7701–7713, regulates commercial email. One-time passwords, security notices and policy notices are transactional or relationship messages. We do not send commercial promotional email. If we ever did, we would provide a truthful header, identity, postal address and opt-out. The Telephone Consumer Protection Act, 47 U.S.C. §227, is not used for SMS marketing. The Stored Communications Act, 18 U.S.C. §§2701–2712, limits unauthorised access to stored communications. Chat is processed to provide the feature and is not sold.

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, is Cal. Civ. Code §§1798.100–1798.199.100. Its business thresholds (revenue, volume of buying or sharing, or revenue share from sale) are not claimed to be met. We still grant, contractually: the right to know (§§1798.100, 1798.110); deletion (§1798.105), subject to security, debugging and legal retention; correction (§1798.106); opt-out of sale or share (§1798.120), which we do not do; treatment of a Global Privacy Control signal as an opt-out preference; limitation of sensitive personal information (§1798.121), location being used only for the transit feature you requested; and non-discrimination (§1798.125).

The California Online Privacy Protection Act, Cal. Bus. & Prof. Code §§22575–22579, is met by this page. Shine the Light, Cal. Civ. Code §1798.83, is answered by the statement that we do not provide personal data to third parties for their direct marketing. Section 1798.150’s private right of action is limited to certain breaches. This paragraph does not admit a claim.

The Virginia Consumer Data Protection Act (Va. Code Ann. §§59.1-575 and following), Colorado Privacy Act (Colo. Rev. Stat. §§6-1-1301 and following), Connecticut Data Privacy Act, Utah Consumer Privacy Act, Texas Data Privacy and Security Act, Oregon Consumer Privacy Act, and the comprehensive statutes of Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Maryland, Minnesota and other states grant access, correction, deletion, portability and opt-out of targeted advertising or sale where their controller thresholds are met. We do not sell and do not run targeted advertising. Registered users may exercise the same rights contractually under Section 14 whether or not a threshold is met. Nevada NRS 603A is answered by non-sale.

47 U.S.C. §230(c), where it applies, limits treating a provider of an interactive computer service as the publisher of another information content provider. Chat, room names and UGC worlds are provided by users. Section 230 does not displace federal criminal law, intellectual-property claims, or Hong Kong law. We may still remove content and restrict accounts.

Collection depends on features used. The table is the inventory: account and identity; Resend delivery of one-time passwords; technical logs including Cloudflare metadata; realtime game state and chat; session and gauntlet cookies and privacy-version keys; location only after a browser grant; toolkit URLs and files wiped by TTL; CAPTCHA vendor signals; cloud preference and playlist metadata without audio blobs. We do not use personal data for credit, employment, or other automated decisions with legal effects. Point costs in gomoku are game rules, not financial scoring.

This section lists cookies and local storage Wusper actually uses. We do not set cross-site advertising cookies and do not track you for marketing profiles. Items below are necessary or directly related to login, human verification, interface preferences or consent records. The bottom banner records that you have been informed of these necessary items.

session_token is HttpOnly, SameSite=Lax, path=/, Max-Age 43200 seconds, Secure on HTTPS or wusper hosts, and Domain=.wusper.com only on those production hosts. gauntlet_passed lasts about twenty minutes and is server-issued. wusper_ls syncs a small preference payload across wusper subdomains; it is not an advertising tracker. localStorage may hold gh_privacy_ok, gh_privacy_version (GH-PRO-LGL-018), wusper_cookie_ok, theme, language, surface and quality keys. The bottom banner records notice of necessary items and sets wusper_cookie_ok=1. We do not set cross-site advertising cookies. Do Not Track is not treated as a binding opt-out. Global Privacy Control is handled under Section 10.2.

Registered accounts are kept while active, then primary records are removed or anonymised in about thirty days after a verified deletion request, with residual backups rolling off in about ninety days. Guests are physically deleted after seventy-two hours. Chat and UGC are generally kept thirty to ninety days. Server and edge logs are typically fourteen to thirty days. Toolkit files last minutes to hours. Burn-after-reading QR may be on the order of sixty seconds. WAN file-transfer fallback is about thirty minutes. The Gauntlet cookie is about twenty minutes. Location is used on-device in real time. Lyrics and cutout work directories are deleted at job end. Article 5(1)(e) GDPR and DPP2 are the retention standards. Perpetual backup is not promised.

Account deletion path: After sign-in, use the account UI (calls /api/user/delete with verification such as password), or email us under §14. Withdrawing privacy consent clears local consent records and re-shows the notice; it does not delete the account. Cascade: §41.4.

Email [email protected] with subject “PDPO Data Request”, “GDPR Request”, or “US State Privacy Request”, state the right, and cooperate with reasonable verification. Targets: forty days for PDPO access or correction; one month for Article 12 GDPR; an internal ceiling of forty-five days for California know or delete requests. Portability is a readable text or JSON summary of account fields, not a guaranteed export of matches or worlds. Clearing local consent does not delete a server account.

Complaints: the Hong Kong Privacy Commissioner (sections 37 and following, and section 50 enforcement notices); an EEA supervisory authority of habitual residence, work, or the alleged infringement; the UK ICO; the California Privacy Protection Agency and the California Attorney General; and other state attorneys general where those laws apply. Writing to us first is usually faster. This paragraph does not limit a statutory complaint.

Article 4(8) and Article 28 GDPR describe processors and mandatory contract terms. A hobby-scale operator uses vendor terms, HTTPS and least privilege, and does not claim a complete Standard Contractual Clauses file. The table lists Cloudflare, the VPS origin, Resend, Google, Discord or Microsoft if enabled, a DeepSeek-compatible inference API, and public transit or routing sources. Hong Kong has no EU adequacy decision. Where the GDPR applies and data leave the EEA, Articles 45 to 49 apply. For transfers necessary to perform the service you requested, we disclose reliance on Article 49(1)(b) and (c), plus TLS and access control. That is not a filed transfer impact assessment.

Security is TLS, cookie attributes, hashing, separation, rate limits, human verification and Cloudflare. No service is absolutely secure. If we know of an incident reasonably likely to result in unauthorised access, we will where practicable contain it, reset sessions, and notify affected registered users. The PDPO has no GDPR Article 33 seventy-two-hour clock. Article 33 and Article 34 are stated so the difference is visible. This paragraph is voluntary practice, not an SLA.

018 multi-regime children note: Not directed to children under 13 (COPPA); Art. 8 GDPR is not the basis of supply; PIPL minor rules prevail where mandatorily applicable—no claim of a technical guardian-consent gate; PDPA and others are contractual-floor only. Honest disclosure: still no technical age gate on login.

The Services are not designed for children. There is no technical age gate. 15 U.S.C. §6502 prohibits an operator of a site directed to children under 13, or with actual knowledge, from collecting personal data without verifiable parental consent. This site is not directed to them. Operational rule: on actual knowledge of an improper minor registration, or a reasonably verified guardian request to locate an account, we will disable/delete that account. Article 8 GDPR is not the basis of supply.

We do not use personal data for PDPO Part VIA direct marketing, CAN-SPAM commercial email, or PECR unsolicited electronic marketing. One-time passwords and material-policy notices are operational. A change would require consent then required by law and a Section 2 update.

Location for /tools/eta and /tools/nav is used only after an explicit browser grant, which you may revoke. Nearby or onboard features may then fail. Other queries do not need location. Tracks are not kept for advertising. These features are not emergency services or official navigation. Android fine and coarse location permissions are for on-device conditions, not an advertising SDK.

/tools/eta proxies public operator interfaces and is not an official channel. ETAs may be late, missing or stale. We do not invent schedules. Favourites stay in localStorage. The path is often ungated. Metro starts at /api/metro/cities and is unofficial. /tools/nav is OSRM and open-map walking plus heuristic bus planning, not Google Directions, with no traffic-light detection. Risk of missed connections, getting lost, accidents, injury or property damage is yours to the extent the law allows. Section 7 of the Control of Exemption Clauses Ordinance (Cap. 71) prevents excluding liability for death or personal injury resulting from negligence, and overrides contrary words.

Most /tools/* paths may require Gauntlet. Paths disclosed as open (for example /tools/eta) are exceptions. The gate may combine a short-lived server-issued pass with one or more third-party human-verification services (for example Cloudflare Turnstile or Google reCAPTCHA). Challenge types and thresholds are operational security measures; this document does not publish bypassable implementation detail. Raw pointer traces are not retained by design. A client-set flag is not a pass. Turnstile and reCAPTCHA process device signals and IP under their own policies. Some game APIs use a lite check.

The primary realtime path is WebSocket (server relay) with backpressure/priority (Part 40). Some low-latency modes may additionally use WebRTC peer-to-peer or a WebRTC data channel (optional/legacy), possibly with STUN, TURN and ICE candidate exchange. Signalling may still exchange session descriptions over the WebSocket. ICE servers include a public STUN server and STUN and TURN on the operator node node.wusper.com, including TCP. The TURN credential is used only to allocate a relay. It is not an account password and is not printed here. This Section does not authorise that node as a public VPN.

When the same account opens another socket or reconnects, the superseded WebSocket is discarded. The RTCPeerConnection is closed only if that close was not a supersede and the user has no remaining live WebSocket. A short drop or a page reconnect should not tear down an established peer. What is discarded is the old signalling socket. The peer is closed when the last live socket is gone.

Your public IP may become visible to other endpoints or to the relay. If you do not accept that, leave and use server relay. You must not log or publish another person’s IP learned this way; that may also engage section 64 of the Personal Data (Privacy) Ordinance (Cap. 486). Browser file transfer can expose a public IP. Optical QR stays on device. Bluetooth and nearby radio frames are not logged as such by the origin.

Principle: The toolkit wraps yt-dlp, ffmpeg and related components for URLs or files you submit (including /tools/video_download). The origin does not long-term host protected media or offer a public search index. To complete a fetch you requested, the operator may maintain operator-owned upstream sessions (cookies / short-lived fields / publicly documented anti-bot helpers). That maintenance is not your Wusper password or OAuth token and does not sign you into the upstream as you. Sessions for different sources (for example Bilibili vs YouTube) are separate and may fail independently. Concrete paths and secrets are omitted. See any toolbox operational note for non-secret detail. Concrete fetch strategies may change and failures may degrade; experimental upstream-session renewal (if enabled) does not guarantee bypass of bot-checks, rate limits or geo blocks (e.g. fall back to another component or abort the job); this clause does not lock an implementation path and does not turn occasional failure into an SLA. Submitted URLs and job metadata may appear briefly in temp storage and logs.

22.1A Discord music/bot disclaimer: Any operator-run Discord bot or music feature (a) is a separate service from the Wusper front door and is not an SLA for it; (b) if it shares the same search/download stack as the toolkit, upstream cookies, failure rates and source-site policies (including YouTube “confirm you’re not a bot” blocks) follow Section 22.1; (c) temporary audio/transcode files created for a job are deleted after the job under the same class of TTL as the toolkit; (d) a Discord user identity is not automatically linked to a Wusper account (unless you separately sign in to Wusper with Discord OAuth—see Parts 4 and 42; those uses differ); (e) voice playback, queues and request availability are not an SLA—rate limits, geo-blocks, cookie expiry or platform ToS changes may fail the feature; (f) Discord messages, voice and server content remain subject to Discord’s Terms and Community Guidelines. This paragraph does not expand the bot into a paid service under this Agreement and discloses no deploy paths, tokens or admin endpoints.

Non-deepseek gomoku difficulties use a compiled engine on the origin. The deepseek difficulty sends board state to a DeepSeek-compatible API without intending to attach login names, IPs or tokens. Point costs are not fiat. Regulation (EU) 2024/1689 does not treat a game opponent or lyric shaper as an Annex III high-risk system. Article 5 prohibited practices are not used. Article 50 transparency is met by labelling the computer opponent as AI. Output may be wrong. It is not professional advice. The United Kingdom has no identical single statute; the same disclosure is given.

UGC submissions, including Color Link strokes, grant a non-exclusive, royalty-free, worldwide licence, sublicensable only for hosting or CDN, to operate, back up, moderate and display the content. Moral rights are not asserted against us for those limited purposes to the extent the law allows. You warrant lawfulness. Color Link (clink) is server-relayed over a WebSocket clink_action, not a WebRTC peer connection, so this mode does not hand your public IP to other browsers in the room. A room code and a /?clink= link let a holder attempt to join; the code is not a cryptographic secret. Caps are about 8000 operations, 8000 points, 80 canvases and 40 groups. A share link invites collaboration. It does not assign copyright or licence publication outside the Services. Other participants keep rights in their own strokes. Joint-authorship rules under the Copyright Ordinance (Cap. 528) may apply; this Section does not apportion them. We may remove content and restrict accounts without promising prior review. DSA Article 16 notices may be emailed. The UK Online Safety Act 2023 illegal-content duties are acknowledged for user-to-user features. This project is not a categorised large service. Notified illegal content, especially child sexual exploitation and doxxing, will be removed where practicable. Section 230 does not displace Hong Kong law.

Section 7(1) of the Control of Exemption Clauses Ordinance (Cap. 71) prevents excluding or restricting liability for death or personal injury resulting from negligence by contract or notice. Section 8 requires the reasonableness test in section 3 and Schedule 2 for other loss. Schedule 2 looks at bargaining position, knowledge of the term, and alternatives. Free hobby status and advance publication are facts we put forward, not a self-declared pass of the test.

Section 5 of the Supply of Services (Implied Terms) Ordinance (Cap. 457) implies reasonable care and skill where services are supplied in the course of a business. Any exclusion must satisfy Cap. 71. The Unconscionable Contracts Ordinance (Cap. 458) lets a court refuse or limit an unconscionable consumer term. Directive 93/13/EEC requires plain language and withholds effect from unfair non-negotiated terms. A Hong Kong choice of law does not strip those mandatory protections. State law in the United States often refuses exclusions for personal injury, fraud and wilful misconduct.

To the maximum extent permitted by law we are not liable for indirect, incidental, special, punitive or consequential damages, including loss of profits, goodwill, data, business interruption, device damage, or damages related to peer-to-peer IP exposure or incorrect transit data, even if advised. Total cumulative liability shall not exceed the fiat amounts you actually paid us in the twelve months before the claim. If you paid nothing, the sole remedy is to stop using the Services and delete the account or local data. Section 25.2 prevails.

You will defend and indemnify us against third-party claims arising from your use, your breach (especially toolkit copyright, automated attacks, harassment, or publishing another person’s IP), your infringement, or your violation of law, including reasonable attorneys’ fees. Clauses that by nature should survive, including virtual items, retention, copyright warranty, the UGC licence, disclaimers, limitation, indemnity, governing law and this Section, survive to the extent the law allows.

018: Indemnity does not exclude liability that Cap. 71 s.7 (death/personal injury from negligence) or other mandatory law forbids excluding. See §§25.2 and 44.

Hong Kong substantive law governs, without conflict-of-laws rules and without the CISG. Mandatory-law carve-out: where the mandatory consumer-protection, privacy or product-liability rules of your habitual residence (including non-derogable EU/UK consumer rules, non-waivable US state rights, and non-derogable rules in Mainland China, Singapore, Australia and similar) require otherwise, those rules prevail to that extent. The Hong Kong choice is not a waiver of those protections. See Parts 34, 44 and 48.

Hong Kong substantive law governs, without conflict-of-laws rules and without the CISG. Article 6 of Regulation (EC) No 593/2008 provides that a choice of law in a consumer contract must not deprive the consumer of mandatory protections of the law of habitual residence where the trader pursues or directs activities there. Articles 17 to 19 of Regulation (EU) No 1215/2012 protect the consumer’s home forum. If those instruments apply, exclusive Hong Kong jurisdiction operates only to the extent permitted. The United Kingdom applies retained equivalents. This is a disclosure, not an admission that every user is such a consumer or that activities were directed to that country.

Disputes first go through thirty days of good-faith negotiation by email. The courts of the Hong Kong SAR are the primary forum to the extent permitted. Claims within the Small Claims Tribunal Ordinance (Cap. 338) should use that forum where appropriate. Arbitration is not mandatory for free users. It is available only by post-dispute written agreement, or if the dispute arises from paid features or amounts actually paid. We do not force HKIAC as the sole path for free users. The Arbitration Ordinance (Cap. 609) applies only to a valid arbitration agreement. Individual claims are preferred. This is not a United States class-action waiver. The Limitation Ordinance (Cap. 347) is not altered.

The Services are run by an individual in spare time on a limited budget and may be reduced, made read-only, moved or shut down. Notice will be posted where practicable, without a guaranteed number of days. We may restrict an IP, device or account for security, abuse, legal risk or breach, without a full advance investigation report. On project end we will where practicable stop collecting and delete or anonymise account data we control in line with Section 13. Full export is not guaranteed.

This page aims at semantic headings, contrast and scalable layout. That is not a certification under Title III of the Americans with Disabilities Act, Section 508, or the European Accessibility Act. Game canvases may not be fully operable with assistive technology. Email us for a text copy.

Account data are disclosed when applicable law or valid legal process requires it. Over-broad or apparently unauthorised requests may be questioned. There is no round-the-clock law-enforcement hotline. Use the contact email with authority and legal basis.

Severability, entire agreement (this edition replaces 009 and 008), no waiver, no assignment by you, assignment to a successor maintainer with notice where practicable, and exclusion of third-party enforcement under the Contracts (Rights of Third Parties) Ordinance (Cap. 623) except statutory data-subject rights, are the miscellaneous terms. Force majeure includes natural disaster, war, government action, network failure, upstream API outage, power or cloud incidents. Contact: [email protected].

Material additions versus 009 are the seven-day effective date, the Hong Kong ordinance map, the GDPR article map, ePrivacy, the DSA, the AI Act, CCPA/CPRA, CAN-SPAM, COPPA, the CFAA, the SCA, section 230, DMCA notice elements without a safe-harbour claim, the state-law list, consumer-forum disclosure, and the express non-exclusion of negligence liability for death or personal injury.

This annex restates privacy-relevant implementation. Figures inherit the 013 operational annex, updated for the realtime stack after #74’s pure-WS priority/backpressure work. Any historical tip SHA printed in older annexes is a past snapshot only; then-current deploys / tip win until this page is revised.

The router branches on current primary hostnames: app g.wusper.com; portal/tools wusper.com (and www.wusper.com); privacy privacy.wusper.com; joke top-up pay.wusper.com (and any pay.*). Auxiliaries: WebRTC node node.wusper.com; deploy console may be coolify.wusper.com (operations only, not a general end-user surface). Legacy app aliases (e.g. game.wusper.com), if still in DNS, bookmarks or redirect chains, are historical aliases/redirects; the hostname you actually reach controls—they are not the current primary app host. session_token is Domain-scoped only on production wusper hosts so toolbox and app share a login. That is session sharing, not ad tracking.

The session cookie is HttpOnly, SameSite=Lax, Max-Age 43200, Secure on HTTPS or wusper hosts, a 16-byte hex token stored server-side with username and expiry. The twelve-hour cookie is not the seventy-two-hour guest TTL.

Guest minting is rate-limited, deletes expired unbound guests, allocates user_###### and a one-time password stored hashed, and sets a three-day expiry. A google_id binding stops the sweeper. There is no expiry email.

Passwords are hashed. Status payloads may include provider ids, email, avatar, friends, chat, inventory, loadout, gacha, pets, points and about fifty history rows. Client secrets are not reproduced.

Cloud prefs store allow-listed keys after stripping secret-looking names and oversized values. Cloud music stores playlist metadata and lyrics text and rejects audio blobs.

pay.wusper.com is a joke top-up skin. real.html states it does not charge. Do not type real card numbers there.

Identifiers follow the code registry (js/modes.js / core/modes.py; use check_modes.py) and may drift briefly between client and server—the live menu/room maps control, not this summary. Same purposes cover solo and multiplayer modes. Identifiable leaderboard names require §31.7A’s hard condition. Realtime state is application data, not an advertising profile.

Some modes may publish scores, times, clear-state and display names. That is application data for the comparison feature you asked for, not an advertising profile, and has no fiat value. Cheating (memory edits, packet tampering, bots, unfair automation) is forbidden. We may restrict accounts, void scores or refuse listing without publishing detection details that would enable bypass.

Opt-out / hide display name (hard condition): A mode may upload/publish an identifiable leaderboard row (display name or linkable user label) only if a product control already exists (account or mode settings) to turn off “join leaderboards” or choose “hide display name”. If a mode has no such control yet, it must not publish an identifiable public board — no listing, or anonymous non-linkable labels only. The control and this clause must be available the same day; soft “should be able to” language is not treated as delivery. After opt-out, existing rows may drop or anonymise after cache/TTL — not guaranteed instant worldwide removal. Leaderboard results are not cash and are not property claims.

The toolbox page is noindex. Node-config is labelled closed. The music remote is a same-browser BroadcastChannel. The download family is yt-dlp plus ffmpeg. WAN fallback lives thirty minutes, no-store, and can be deleted early.

Permissions exist because triggers and the desk pet need them, not because of an ads SDK. Catalog v9 is labelled local-only, but background video download calls the site toolkit. Node-config is not a public VPN and does not authorise unlawful circumvention.

High-frequency paths may use a WebRTC data channel. Signalling may stay on the WebSocket. A superseded socket is discarded; the peer closes only when the close is not a supersede and no live socket remains. STUN includes stun.l.google.com and stun:node.wusper.com:3478, with TURN on that node. Public IPs may still be visible. The TURN credential is not printed here.

Textures and GLBs are under /js/games/comg_assets/ and can be fetched by URL. Licences are in Section 22.6 and ASSETS.md. Color Link codes copy, the share link is /?clink= plus the code, state is in clink_custom_rooms over clink_action, not peer-to-peer. Caps are about 8000 operations, 8000 points, 80 canvases and 40 groups.

On this 018 publication the gate constant becomes GH-PRO-LGL-018 (replacing GH-PRO-LGL-015). Browsers that consented to an older edition are re-prompted. Any “gh_privacy_version=GH-PRO-LGL-018” in this draft is the go-live / post-adoption value, not a live bump. The Cookie banner uses a separate wusper_cookie_ok key. On go-live, bump gate, shell_boot.js and assembled pages to GH-PRO-LGL-018 with at least seven days’ notice.

The schedule states what each cited instrument requires and how this project answers it, or where scale prevents a full statutory programme. It is a map, not a certificate and not a filing.

Each row above is an operational answer, not a certificate. Where establishment, threshold or scale means the statute does not apply, the contractual right is still no less than the core remedy, exercised by the Section 14 email. Mandatory liability, especially Cap. 71 section 7, prevails over any disclaimer.

If body and annex numbers diverge, the statement more protective of the data subject prevails, but live code remains the technical fact. Mandatory law prevails over this Agreement. If the languages diverge, both may be considered; neither overrides the other merely because one party prefers it.

This edition invents no company number, appoints no EU or UK representative, registers no US Copyright Office agent, claims no CCPA threshold, does not say pay.wusper.com charges, does not call the gomoku engine high-risk AI, does not call the project a licensed virtual-asset service, and does not drop the “not lawyer-reviewed” premise.

Rights requests, takedown notices, abuse reports and legal process go to [email protected]. Suggested subjects are “PDPO Data Request”, “GDPR Request”, “US State Privacy Request”, “Copyright Notice” and “Abuse Report”. A missing subject is not a refusal. There is no paid hotline and no twenty-four-hour staffed desk. Immediate danger should go to local emergency services.

To stop a third party deleting or reading an account we may ask the requester to confirm the login email, the OAuth identifier, or control by a one-time password to that account. We do not ask for a national-identity image, a full passport page, or a payment password as routine verification. Excessive collection would itself fail DPP1 and Article 5(1)(c). A guardian request must explain the relationship and locate the account without over-collecting about the child.

Access may be refused for another person’s data, crime prevention, legal privilege, and the other section 20 cases. Erasure may leave security logs, backups not yet rolled off, and data a law requires us to keep. An objection to legitimate interests may be refused if compelling grounds override the data subject’s interests, with reasons. Portability does not extend to other people’s UGC, compiled engine weights, or localStorage we do not hold.

Article 30 requires a record of processing for some controllers, with an exemption for organisations under 250 employees where processing is occasional, low-risk and not special-category. This project has no employee roll. The table is a voluntary record so Section 14 requests can be answered: account, session, guest, match and chat, toolkit, human verification, location, mail, and AI inference, with the bases and retention already stated.

A refusal may be asked to be reviewed within thirty days by email with new facts. Review is by the same maintainer, because there is no independent data-protection officer. It does not replace Article 77 GDPR or a PDPO complaint. A refusal will point to the Commissioner, the ICO, a Union authority, or a state attorney general.

Requests may be in Traditional Chinese or English. Other languages will be read without a translation SLA. Both texts of this Agreement may be considered in a dispute. Neither overrides by preference alone.

013 deletes the former Section 34 worked examples. That section did not match the register of the terms and privacy policy. Discarded-WebSocket RTC, COMG textures and models, and Color Link rooms and sharing remain in Sections 21, 22.6, 24.1 and 31.11 to 31.12.

This Part compares Mainland China PIPL, Singapore PDPA, Japan APPI, Australia Privacy Act, Canada PIPEDA and New Zealand Privacy Act. Where establishment, turnover or scale prevent statutory application, we still endeavour to align with the Section 14 procedure as a contractual floor (not statutory equivalence). It supplements Parts 7–10; Hong Kong PDPO remains primary.

PIPL may claim extraterritorial effect where overseas processing aims to provide products or services to individuals in Mainland China or to analyse their behaviour (Art. 3). This project has no Mainland establishment and does not build advertising profiles. For users in Mainland China who voluntarily use the Services, we contractually commit to purpose notice, minimisation, no legal-effect automated decisions, no sale, and email access/erasure/correction under Section 14. We do not claim PIPL Art. 38 SCC filing or certification; we disclose processors in Section 15 and users may stop using the Services.

Singapore’s PDPA binds “organisations.” No Singapore establishment. Contractual mirror: purpose notice, reasonable security, accuracy, retention limits, access/correction, prompt significant-breach notice (Section 38). No commercial marketing messages. No phone telemarketing; DNC registries are irrelevant to our channels.

APPI obliges purpose specification, notice, security, third-party limits and individual rights. Not Japan-directed, but JP-language or JP-IP users may appear. Contractually: purposes on this page; no ad-sale; disclosure/correction/use-stop via email; security in Sections 15.3 and 38; no sale of cookie identifiers to advertisers.

APPs mainly bind entities above turnover thresholds — typically unmet here. Voluntary mirror of APP 1–13: open policy, guest option, collection notice, use/disclosure limits, cross-border notes, quality, security, access/correction, no national unified ID. No My Health Record participation.

PIPEDA and provincial statutes (including Québec Law 25) may apply to commercial activity. We do not claim a completed PIPEDA compliance programme. Contractual: reasonable purposes, gate consent, security, access, breach notice. Québec residents receive the same contractual floor where practicable.

No NZ establishment. Contractually: purpose limits, collection from the individual where practicable, security, access/correction, prompt user notice of serious-harm breaches; Commissioner notice only if the Act applies.

Korea’s PIPA may claim overseas reach. Not Korea-directed. Access/deletion/marketing-opt-out requests follow Section 14; we do not send marketing SMS.

The matrix is a map, not a certificate. Where a statute does not apply by threshold, the contractual floor still applies via Section 14 email.

Governing law remains Hong Kong only (Part 27). For readers in Hong Kong or Taiwan: where local mandatory law (including non-derogable rules of Taiwan’s Personal Data Protection Act) requires otherwise, that mandatory law prevails; the Hong Kong choice does not strip it. This page does not claim a completed Taiwan adaptation, an in-territory agent, or a special-purpose business registration. Contractual floor: purpose notice; access/copy/correction/erasure-style requests via Section 14; no direct marketing; sensitive categories only with separate consent if ever processed.

Maps key GDPR/UK GDPR articles to practice. Territorial scope: Section 9.1. If Art. 3 does not apply, contractual columns remain commitments to EU/UK users. Expands Part 9.

No non-essential analytics cookies. OTP is transactional. AI paths intend board/text without account identifiers. UGC moderation may rely on contract, legal obligation or legitimate interests.

No intent to collect Art. 9 data for identification. Camera/mic are user-triggered; media are not kept as biometric templates. Voluntary UGC disclosures are not used to build sensitive profiles.

Exercised under Section 33. One-month clock when Art. 3 applies; otherwise contractual. Art. 22 does not apply to game rules or anti-abuse gates.

Art. 28: vendor DPAs/SCCs where offered; no invented DPA numbers. Art. 32: TLS, HttpOnly sessions, least privilege, human verification, secrets out of git, Coolify, log minimisation — Section 38.

Honesty: no claim of a filed Transfer Impact Assessment. Vendor SCCs where offered; minimisation and encryption as supplementary measures.

See Section 9.4. Strictly necessary session/gauntlet cookies; UI preference keys; no cross-site ad cookies; no PECR marketing email.

The six Data Protection Principles in Schedule 1 to the Personal Data (Privacy) Ordinance (Cap. 486) are the primary framework. This Part maps DPP1–6 to statute, controls and contractual reinforcement.

DPP1: lawful related purposes; fair collection via gate and OAuth; adequate not excessive; notice on this page. No routine national-ID images.

DPP2: correction paths; no adverse automated decisions from inaccurate data; retention capped by Section 13 TTLs.

DPP3: no new purpose without prescribed consent. Matchmaking, anti-abuse and tool computation are original or directly related purposes. Direct marketing would require a Section 2 update and consent.

DPP4 security summary: TLS, Secure cookies, server-side session tokens, human verification, Coolify hardening, secrets in env. Detail in Section 38.

DPP5 openness: this page is the public policy; processors in Section 15; operational annex in Sections 31 and 40.

DPP6 and ss.18–24: email intake under Section 33; about thirty days where practicable; complaints to the Privacy Commissioner for Personal Data.

Section 33 is not yet in force. We voluntarily disclose overseas processors, minimise transfers, encrypt in transit and do not sell. This page will update when the section is commenced.

No PDPO Part VIA direct marketing. OTPs and policy notices are operational. A change would require Part VIA consent and an opt-out.

Beyond Section 10, this Part lists further state consumer-privacy statutes. Where revenue, consumer-count or sale thresholds are unmet, contractual rights still apply. Not a law-firm opinion; no state registration is claimed.

Typical thresholds involve revenue, annual consumer counts, or sale-derived revenue. This hobby project does not sell personal information and has no ad-broker revenue. Statutory “business” status is often unmet. Rights below are contractual for US users after reasonable verification.

Crosswalk: California through Nebraska and others. Contractual floor is at least know/delete/opt-out-of-sale. GPC is honoured as a sale/share opt-out signal under Section 10.2.

No sale to data brokers of email, mobile ad IDs, precise location trails or browsing profiles. Processor disclosures for hosting, OAuth, mail and inference are not a “sale” for monetary consideration. No cross-site remarketing audiences.

Internal appeal: Section 33.5. Users may also complain to a state Attorney General or, where applicable, the CPPA. Refusals will point to a complaint path.

This Part expands Section 15.3 into verifiable technical and organisational measures and incident timelines. Scale is a single-maintainer hobby project; measures are reasonable and proportionate, not a SOC 2 certificate.

Inventory: TLS, session cookie flags, OTP/OAuth, env secrets, Cloudflare edge, human verification, WS/msgpack backpressure, Coolify images, TTL minimisation, log masking, rolling backups, thin APK com.wusper.

Organisation: single maintainer; version gate sync; vendor advisories; fix-first on credible vulnerability reports; no routine ID-document collection for support.

A personal-data breach is a security breach leading to accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of or access to personal data. Incidents limited to public or adequately anonymised data, or pure short availability blips without confidentiality/integrity impact, may not be notifiable but may still be logged.

018 contractual floor: Even where a regime has no mandatory 72-hour authority notice, we contractually aim to notify affected users of high-risk incidents without undue delay by email or in-product banner (stricter mandatory law prevails). We may be unable to reach guests or users who cleared contact details.

Timelines: 72-hour authority notice where GDPR/UK GDPR apply; PDPO guidance-based; contractual prompt user email/banner for high risk in all cases. No false claim of completed Mainland filings.

User notices include nature, categories affected, mitigation, contact email and complaint routes where applicable, without operational detail useful to attackers.

Email security issues to [email protected] with subject “Security Report”. Do not exfiltrate data or harm others. No bug-bounty programme is promised.

Store-build sync: This Part must match the then-shipping com.wusper package (versionName/versionCode and Manifest permissions). If the store build changed and this Part did not, the store build and in-app disclosure control, and this page must be updated promptly. A draft “pending sync” note is not a reviewed store statement.

The Android client is a Kotlin full-screen WebView thin shell, package com.wusper, loading the web app and tools on wusper hosts, plus desk-pet, triggers and on-device automation. This Part expands Section 31.9 on purposes, data flows and the non-ads-SDK boundary.

018: The WebView shell does not create a separate cloud-account system; this Agreement covers Wusper content loaded in-shell. Store permission/data-safety disclosures must stay aligned with §39.2 and the shipping APK; if they diverge temporarily, the stricter of the live store listing and this page guides user-facing explanation until aligned. Store developer policies may also apply to the shell.

Most game logic is web-delivered; native code bridges permissions, notifications, accessibility actions, foreground services and overlay. Login usually shares the site session model. Local-only catalog rules still may call site download APIs. Node-config is not a public VPN.

Every permission row states on-device purpose, whether data leaves the device, and that ads/tracking is “no”. Camera/mic/media upload only when the user triggers an upload-class tool.

WebView follows Section 12 storage rules. Third-party scripts are limited to those the site loads (OAuth, Turnstile, reCAPTCHA). No cross-site ad-network SDK. Clearing site or app storage may require re-consent and login.

The App is not directed to children under 13. Store age ratings, if any, are separate labels. Guardians may email to disable/delete a locatable minor account.

Android version and permissions are not locked to a historical versionName printed in an older annex (e.g. former “1.1.33”). At adoption/review, the then-current store (or sideload) Manifest / versionName / permission list controls; an optional as-of date may be noted on this page or in store copy (draft review anchor (Asia/Hong_Kong 2026-10-19): repo versionName=1.1.42 / versionCode=47; later store builds supersede this page’s numbers. A versionCode bump alone does not necessarily bump this document id.

This Part updates the operational annex: the primary realtime path is WebSocket (incl. msgpack) with client priority/backpressure; WebRTC is an optional/legacy low-latency path for some modes only (Part 21). Code/image baseline is not locked to a historical SHA (e.g. former annex tip e128639) — the then-deployed public-repo tip / Coolify image tag controls. Public repo wins; no secrets or undisclosed vulnerabilities are printed.

Realtime design affects what leaves the device, whether retries duplicate logs, whether coalescable state is dropped under congestion, and whether debug HUD exposes room metadata. Backpressure exists to reduce useless retransmission — not to add ad telemetry.

Paths: WS/msgpack is primary for match/chat/signalling with high vs low priority/backpressure; short HTTP remains for some flows; WebRTC is optional/legacy for some modes and may expose peer-reflexive IPs (Section 21).

Debug HUD counters (drop/coalesce/queue depth; labels such as cL/dH/sH/L) are on-device performance metrics, not an ad-analytics suite. Aggregated upload would require a page update and, if needed, a gate bump.

App logs may include connects, errors and limited room events. Backpressure should reduce duplicate error lines. Sparse WS heartbeat lines can be normal. IP/UA may appear via Cloudflare. Tokens/cookie values should not be routinely logged in clear text.

Room/match state may live in memory or Redis-like stores with room-end or TTL expiry. Short player codes and scores are not a long-term dossier. Backups: Sections 13 and 38.

Coolify: new container on success; image tagged to tip; non-fatal post-deploy ip/apk_sync skips do not disable privacy controls; origin region may be outside Hong Kong (Section 15).

#74 completed client outbound priority/backpressure; it did not change collection categories, sale policy, or AI-training claims. Short HTTP was not fully removed. Edition 014 bumped the gate to GH-PRO-LGL-014; edition 015 bumped the gate to GH-PRO-LGL-015 and expanded Cookie terms (historical). Edition 018 sets the gate to GH-PRO-LGL-018 on publication (§31.10).

Expands Parts 12–13 with GPC/DNT handling, storage loci and deletion cascades for data-subject requests.

Locus matrix covers cookies, localStorage, edge, origin, Redis, processors and TTLs. Desk-pet assets default on-device.

DNT is not treated as a binding opt-out due to inconsistent implementation; we already avoid cross-site ad tracking. GPC is treated as a sale/share opt-out signal (Section 10.2). Because we do not sell or share for cross-site ads, GPC confirms that posture. GPC does not delete accounts; deletion remains Section 14.

Cascade: verify → disable login → clear sessions → erase/anonymise account → TTL room/Redis → toolkit files → backups roll off → processor requests where applicable → reply with residual TTLs.

Expands Section 15.1. Regions are operational summaries and may change; vendor documents control. No invented BR numbers or DPA contract IDs.

Sub-processor notes (EN): Cloudflare (DNS/CDN/WAF/Turnstile); VPS host (origin/DB); Resend (transactional email); Google (OAuth/reCAPTCHA/STUN); Discord OAuth (login, if enabled) ≠ Discord music bot (commands/voice relay, if enabled)—separate rows/purposes; Microsoft OAuth if enabled; DeepSeek-compatible inference (minimised); transit open APIs; node.wusper.com STUN/TURN (not a public VPN). Regions and tools as in the Chinese table. No DPA contract IDs published. See §22.1A for music-bot disclaimer.

Register lists CDN, VPS, mail, OAuth, inference, transit APIs and TURN. TURN credential is not printed. Node is not a public VPN.

New processor categories that systematically process personal data trigger a page update; material changes follow Section 2.2’s seven-day notice and may bump the document id. Emergency security replacements may ship first, with a prompt page update.

Disclosure in the register is not a “sale.” We do not sell email lists, mobile ad IDs or precise location trails to brokers or ad exchanges.

A solo maintainer cannot on-site audit every vendor. Accountability is vendor selection, minimisation, anomaly watch, and Section 38 notices on vendor incidents.

Expands Parts 24 and 9.5. The DSA tiers intermediary duties; this project is far below VLOP thresholds. We still contractually provide report, action and reply paths.

Categories: CSAM (zero tolerance), terrorism propaganda, malware/phishing, copyright infringement, severe harassment/credible threats/unlawful hate, doxxing for stalking.

Email [email protected] with subject “Abuse Report” or “Illegal Content”. Include URL/room code, time with zone, screenshot/hash if feasible, contact, and legal theory. Bad-faith false reports may lead to reporter restrictions.

Ladder: ack → preserve logs → remove/restrict → law-enforcement referral when warranted → reply without revealing others’ data → internal appeal.

See Sections 24.1 and 31.12. Share codes do not shift the uploader’s legality burden to the Operator. Rooms may be restricted after valid notice.

No formal DSA transparency report at current scale. If scale changes, this page updates. Removal counts may be withheld when too small to publish without identifying cases.

Disclaimers in Parts 25–27 do not diminish the following mandatory laws. Mandatory rules prevail.

HK: Cap. 71 s.7 (death/personal injury from negligence) cannot be excluded; reasonableness tests; Cap. 458 unconscionability; sale/supply implied terms where applicable; PDPO rights.

EU/UK: unfair terms controls; GDPR rights not waived by disclaimers; mandatory consumer jurisdiction/law rules override Section 27’s HK choice only where those rules mandatorily apply.

US: state limits on waiving willful/gross negligence or statutory consumer rights; no forced claim that a class-action waiver binds where prohibited; FTC Act §5 truthfulness.

Where ACL guarantees or other consumer statutes mandatorily apply, they prevail over contractual disclaimers. The contractual floor is: mandatory rights are not excluded.

If a disclaimer is unenforceable, the remainder survives and mandatory protections fill the gap.

Records material changes from GH-PRO-LGL-013 to GH-PRO-LGL-014; read with Part 30.

Added Parts 34–45 as listed; modern UI with sticky TOC, language chips, dark preference, print CSS and skip-link. Gate bumped so prior consent re-prompts.

Preserved: hobby independence; contact and domains; no sale/ad profile; not law-firm advice; no fake registrations; contractual rights where statutes do not apply; honest guest/OTP/OAuth/toolkit/WebRTC/COMG/AI disclosures.

Still no claim of law-firm opinion, GDPR representative/DPO, PIPL filing, SOC 2/ISO 27001, bug bounty, emergency services, official transit, or public VPN.

Published 12 October 2026; effective 19 October 2026. Gate constant GH-PRO-LGL-014 re-prompts 013 consenters. Continued use after the effective date is acceptance; mandatory law is not waived.

Records material changes from GH-PRO-LGL-014 to GH-PRO-LGL-015.

Rewrote Part 12 as formal Cookie terms; expanded Part 41 matrices; formalised the on-site Cookie banner; bumped the gate to GH-PRO-LGL-015.

Published 15 October 2026; effective 22 October 2026. Gate GH-PRO-LGL-015 re-prompts 014 consenters. The Cookie banner shows until wusper_cookie_ok is set. Continued use after the effective date is acceptance; mandatory law is not waived.

Draft only. Do not bump the gate constant until the group accepts and legal review (if any) is done.

Aligns modes and leaderboards with the live registry; clarifies operator upstream cookies for media tools; documents account-deletion vs consent-withdraw; adds a Taiwan comparative note; softens gate implementation detail; marks draft status.

The submitted file matched the older 014 line (GameHub Pro / obsolete app host game.wusper.com). Live branding since 015 is Wusper with primary app host g.wusper.com. Draft 016 was based on 015, not a revert. Edition 018 restates: game.wusper.com is historical-alias-only (redirects: actual hostname controls) and must not be listed as the current primary app host.

Dispositions adopted in 017: HK law + mandatory carve-out; leaderboard opt-out; two-layer cookies; gate bump only on go-live; Android store sync; Discord 22.1A.

This Part compares US, UK, EU, Mainland China, Hong Kong, Singapore and other common regimes on top of Parts 7–10, 27, 34 and 44. Default governing law remains Hong Kong. “To the extent applicable” means we do not invent establishment, representatives, filings or thresholds. Comparison ≠ certification or filing. This is a map and contractual floor — not a certificate or legal advice.

No contradictory claims (no Art. 27 rep, no PIPL SCC filing claim, no CCPA business-threshold claim, no registered DMCA agent safe harbour, no §230 displacing HK law, no VLOP/Ofcom categorisation). Contractual floor via Section 14 even below thresholds. Mandatory law carve-out in §27.1 prevails. No “all data only in Hong Kong” claim. No sale/share for ads.

PDPO DPP1–6, access/correction, no Part VIA direct marketing, section 64 anti-doxxing. Section 33 non-commencement disclosed. PCPD complaint path in Section 14. No fake registration number.

No EU establishment; if Art. 3(2) applies, Parts 9 and 35 answer it. Bases 6(1)(b)/(f)/(a)/(c). Rights 15–21 contractual. Transfers: Art. 49(1)(b)(c) disclosed, no filed TIA/SCC archive claim. ePrivacy: necessary cookies only; no ad cookies. DSA notice channel = email; not a VLOP. Consumer mandatory rules survive HK choice.

UK GDPR/DPA 2018 and PECR apply to the extent applicable. No UK representative. ICO path in Section 14. OSA 2023: practicable removal of notified illegal content (especially CSE and doxxing); not an Ofcom categorised large service. AI transparency still given (Part 23).

FTC §5 truthfulness. COPPA: not child-directed; delete on actual knowledge. CCPA/CPRA: no business-threshold claim; voluntary rights; GPC treated as opt-out of sale/share (we do neither). DMCA: voluntary notice handling; no registered-agent safe-harbour claim. §230 does not displace HK law. No US-style absolute class-action waiver.

Part 34.1 primary. No Mainland ad profiling; no ad use of precise location; no Art. 38 filing claim; rights via Section 14. If mandatory law requires stopping a processing path, we stop or limit it where practicable.

Part 34.2 primary. No Singapore organisation-establishment claim. Contractual: consent/notice, purpose limits, security, access/correction, significant-breach notice, portability where practicable. No commercial marketing messages.

Australia: voluntary APP mirror; ACL mandatory rights not excluded. Japan/Korea: Section 14; no ad-sale of identifiers. Canada/NZ: contractual floor; no fake compliance programme. Other emerging laws: Section 14 + purpose limits; no invented registrations.

We do not claim that data localisation satisfies any country’s full localisation mandate unless later announced and actually built. Cross-border paths are in Parts 15 and 42. Users may reduce further transfers by stopping use of features, deleting the account and clearing local storage.

COPPA, GDPR Art. 8, PIPL guardian-consent spirit, PDPO principles: not child-directed; no technical age gate (disclosed); disable/delete on actual knowledge; guardians may email to locate accounts.

UGC: remove/restrict without promising prior review. Notice = email. HK notice-and-takedown practice, US DMCA elements without safe-harbour claim, DSA Art. 16, UK OSA illegal-content duties — shared floor of practicable action on verified notices, priority on CSE and doxxing. No absolute §230/safe-harbour disclaimer.

You must not use the Services to violate export controls, economic sanctions, or computer/telecom law applicable to you. This hobby project is not offered as a sanctions-evasion or unauthorised commercial proxy/VPN service. Clear unlawful abuse may lead to access limits and responses to valid legal process under §29.2.

Force majeure in §29.3. Severability with mandatory protections filling gaps. Disclaimers, caps, indemnity, IP/UGC, governing law and this Part 48 survive to the extent permitted.

No uptime percentage, RPO/RTO or support SLA. Toolkit, Discord music, transit APIs, human verification and WebRTC relay may fail. Ordinary remedy (where mandatory law allows) is to stop using and request account deletion.

Draft only. Do not bump the gate until go-live after review.

Root cause: 015/016 shipped language chips and setLang(), but the lang-en CSS rules were empty and lang-zh never hid .en — so the UI did not change. Fix: hide .en in zh mode and .zh in en mode; restyle .en as body text in en mode; split header titles; highlight active chip; mark paired Chinese nodes with class="zh".

Incorporates group consensus (HK law + mandatory carve-out; leaderboard opt-out with real §31.7A body; two-layer cookie principle; gate bump only on go-live; Android store sync; Discord 22.1A). Adds Part 48 multi-jurisdiction hardening. No fake registrations, no secrets.

Still not law-firm advice; no EU/UK rep; no PIPL filing; no CCPA threshold; no DMCA agent registration; no SOC2/ISO; no uptime SLA; not official transit/emergency; not a public VPN.

Records material changes from draft 017 to 018. Status: published. Gate constant GH-PRO-LGL-018.

ID GH-PRO-LGL-018 (draft). Replaces draft 017. Live remains 015. Gate string 018 is go-live-only.

See Chinese table for the 017 hole → 018 patch map (version hygiene, Discord 22.1A, processor rows, definitions, consent≠deletion, a11y, children, indemnity carve-out, DMCA elements, breach floor, WebView/store, no-secrets, EN parity, anti-overclaim).

Folded: grok Discord notes; claude / chief-of-staff / Grok-新 second-round holes; prior consensus retained.

Still not law-firm advice; no reps/filings/thresholds/DMCA agent/SOC2/WCAG certificate; no uptime SLA; draft does not replace live privacy or bump the gate.