Legal
Privacy policy
Effective date: 3 November 2026
This policy explains what personal data the Awaitlab Wiki network collects, why, how long it is kept and how you can control it. It follows the EU General Data Protection Regulation (GDPR).
In short
- We collect only what the wiki needs: your account, your contributions, your settings, and a few technical data to keep the site secure.
- No advertising, no tracking cookies, no sale of data.
- You can download all your data and delete your account from your settings, at any time.
- If you are young, ask a parent to read this with you. You can always write to us, and so can your parents.
1. Who is responsible
The controller is Théo Crepin, trading as Awaitlab, sole proprietorship (French micro-entreprise), 8 rue Abel, 75012 Paris, France. Privacy contact: contact@awaitlab.com. Data protection officer: no DPO is appointed; privacy requests go to contact@awaitlab.com.
2. What we collect and why
| Data | Why | Legal basis (GDPR art. 6) |
|---|---|---|
| Email address, display name, password (stored hashed, never readable) | Create and secure your account, sign-in, account emails | Contract (b) |
| Identifiers of the external accounts you link (Discord, Google, Apple, Roblox) | Sign in with them; link your Roblox account to your game stats | Contract (b) |
| Profile picture, bio, privacy and notification settings, language | Your profile and preferences | Contract (b) |
| Wiki edits, forum topics and replies, votes, reports | Run the collaborative wiki and the forum; keep the page history | Contract (b), legitimate interest (f) in keeping an accurate history |
| Game statistics and badges sent by the games for your linked Roblox account | Show your stats on your profile and in leaderboards, as your privacy settings allow | Contract (b); you can hide them at any time |
| IP address and browser of your active sessions; security and moderation logs | Protect accounts, detect abuse and spam, rate limits | Legitimate interest (f) in a secure service |
| Moderation records (reports about you, warnings, mutes, bans) | Apply the Community rules, handle appeals | Legitimate interest (f); legal obligation (c) under the Digital Services Act |
| Support tickets (including those opened on Discord) and their messages | Answer your requests | Contract (b), legitimate interest (f) |
| Acceptance of the Terms, age confirmation, their date and version | Prove the acceptance and the age check | Legal obligation (c), legitimate interest (f) |
| Identification data of the contributors: the email address and display name given at sign-up, and the IP address and the date and time of each publication (edit, forum post, wall message, upload) | Keep them and provide them to the judicial authority on a judicial request or requisition, as a host (article 6-II of the LCEN and decree no. 2021-1362 of 20 October 2021) | Legal obligation (c) |
We never ask for your real name, address, phone number or date of birth. Do not put such information in your profile or posts.
3. Automatic moderation
Texts you post are checked by automatic filters (word lists and simple rules such as many links or capital letters). A filter can flag content for a moderator or hide it until a moderator reviews it. Sanctions are decided by people; you can ask for a human review of any automatic action (see the Terms, section 6).
4. Who receives the data
- Other users see what is public according to your privacy settings: your display name next to your contributions, and the sections of your profile you chose to show. Your email is never shown.
- Moderators and administrators see what they need to moderate and support.
- Our service providers, bound by data processing agreements, only on our instructions: Cloudflare (hosting, database, file storage, network security, and the translation service used when a reader asks to translate a post), Resend (sending account emails), and, only if you use them, the sign-in providers you choose (Discord, Google, Apple, Roblox) and Discord for the support tickets opened there.
- Authorities, only when the law requires it: the judicial authority can obtain the identification data of a contributor (see section 6) on a judicial request or requisition. Each such access by an administrator needs a written reason and reference and is recorded.
We never sell your data and never use it for advertising.
Nothing is translated automatically. When a reader presses "Translate" on a public post, the text of that post is sent to Cloudflare's translation service, and the result is kept for 90 days so the same text is not translated twice. Private data is never sent.
5. Transfers outside the EU
Some providers may process data outside the European Economic Area (for example in the United States). These transfers are protected by the EU-US Data Privacy Framework and by the Standard Contractual Clauses of the data processing agreements with Cloudflare and Resend.
6. How long we keep data
| Data | Kept |
|---|---|
| Account and profile | While the account exists; deleted at the end of the 30-day grace period after you ask for deletion |
| Inactive accounts | Deleted after 3 years without sign-in; we send you a warning email 30 days before, and signing in cancels the deletion |
| Sessions (IP address, browser) | Until you sign out or the session ends (30 days at most) |
| Security and audit logs | 12 months |
| Moderation records | 1 year after the end of the sanction (a warning ends when it is withdrawn, a mute or a ban when it expires or is lifted); a permanent sanction is kept while it applies |
| Support tickets | 2 years after the ticket is closed, with its transcript |
| Identification data of a deleted account that contributed (email address, display name, sign-in providers, list of its contributions) | 1 year after the deletion of the account, in a separate store, encrypted and readable only by administrators through an audited legal request; deleted automatically after that year |
| Connection data of each publication (IP address, date and time) | 1 year after the publication, in the same separate store, whether the account still exists or not |
| Wiki and forum contributions | Kept in the history after your account is deleted, without your name or any link to you, unless you ask to remove them (section 7) |
7. Your rights
You can, at any time:
- Access and portability: download all your data as a JSON file from Settings > Your data, including while you have not yet accepted updated terms (this right does not depend on accepting them).
- Rectification: change your name, email, picture and bio in your settings.
- Erasure: delete your account from Settings > Delete my account. Contributions stay in the history but are anonymized, unless you tick "Also remove my contributions" (the request is confirmed by a link sent to your email) or, later, use the form "Remove the contributions of my deleted account" (a code is sent to your email); the Terms, section 9, say what is removed and what stays to keep the page histories and the CC BY-SA attribution intact. The data we must keep by law (section 6, identification and connection data, 1 year) cannot be erased before the end of that period (GDPR article 17(3)(b)); it is used for nothing else.
- Restriction and objection: hide your profile, activity, stats and badges with the privacy settings, leave the leaderboards, or write to us to object to a processing based on legitimate interest.
- Withdraw a consent you gave, without affecting what was done before.
For anything else, write to contact@awaitlab.com. We answer within one month. You can also complain to the CNIL (https://www.cnil.fr) or to the data protection authority of the country where you live.
8. Children and teenagers
The Service may be used by young players. That is why:
- An account needs to be at least 13 years old; between 13 and 15, a parent or guardian must agree first.
- Profiles show as little as possible: no real name, no email, game stats visible only to signed-in members by default, never indexed by search engines.
- The Community rules forbid sharing personal information and any contact of a sexual nature; such content is removed and reported to the authorities.
- Parents and guardians can write to contact@awaitlab.com to see, export or delete their child's account.
9. Cookies
We only use the cookies and local storage the site needs to work (sign-in, language, display preferences, security against bots). No advertising or analytics cookies, so we do not ask for consent. Details: Cookie policy.
10. Security
Passwords are stored hashed, connections are encrypted (HTTPS), the identification data kept for the legal obligation is encrypted in a separate store, sessions can be listed and closed from your settings, sensitive changes ask for your password again, uploaded images are stripped of their metadata (such as GPS position) and sign-in attempts are rate limited.
11. Changes
We will tell you about important changes on the site or by email before they apply. The effective date at the top shows the current version.