WAPP privacy policy

Applies to wapp.cz. Last updated: 26 August 2026.

This policy describes what personal data we process when you use wapp.cz, why we process it, how long we keep it and what rights you have. WAPP is a games brand operated as part of Progity; progity.com has its own separate policy.

1. Data controller

2. What data we process

The scope depends on what you do on the site.

2.1 Server operation and security logs

Every request to the site produces a standard server log entry containing:

• the IP address,
• the date and time of the request,
• the requested URL,
• browser, operating system and device type,
• the referrer, if the browser sends one.

These logs are used solely to run the site, diagnose errors, keep it secure and protect it from abuse (for example repeated automated form submissions). They are not used for analytics or profiling and are not linked to form data.

2.2 First-party analytics – only with your consent

On wapp.cz the analytics script is not loaded at all until you give consent. Until then no analytics request is sent and no visitor identifier is created – this is not a setting that switches measurement off, the measurement code is simply not on the page.

Once consent is given, our own analytics processes:

• a random visitor identifier (stored in the pg_visitor_id cookie),
• the pages viewed and their addresses,
• date, time and length of the visit,
• referrer and traffic source,
• the page language,
• device type, browser, operating system and screen resolution,
• approximate location (country, city) and the name of the network or connection provider,
• selected on-site events: clicks on the main buttons, starting and submitting the signup form, and a confirmed newsletter subscription.

Approximate location and network name are derived from the IP address by querying the external service ip-api.com. Only the result of that lookup is stored in the analytics database, not the IP address itself – in the dataset the address is replaced by a SHA-256 digest. That digest is pseudonymous, not anonymous: on its own it does not reveal the address, but we cannot rule out that it could be reversed by brute force, so we treat it as personal data.

The analytics is strictly first-party and runs on our own infrastructure. We do not use Google Analytics, Meta Pixel, Hotjar or any other external measurement or advertising tool, and we do not track you across other websites.

2.3 Newsletter and interest check

When you submit the form on wapp.cz we process:

• your email address,
• the language you submitted the form in,
• your answer to which WAPP project you liked most,
• your preferred platforms,
• optional answers about what matters to you in a future simulator, including free text if you choose “something else”,
• the signup source and referrer (without URL parameters),
• the dates of signup, confirmation and, where applicable, unsubscription,
• the version of the consent wording you agreed to, and your confirmation of being 15 or over,
• technical data needed for abuse protection – in particular a digest of the IP address the signup came from.

The IP digest is computed with a secret key (HMAC) and is used only to count attempts; the IP address itself is not stored with the subscription. Confirmation and unsubscribe links contain a single-use random code; only a digest of that code is stored, never the code itself.

3. Purposes and legal bases

Analytics consent and newsletter consent are two separate things. Neither depends on the other, and the site works exactly the same whether or not you allow analytics.

4. Double opt-in

Submitting the form does not create a subscription. We send an email with a confirmation link to the address you gave, and the subscription only starts when you open that link. The link is valid for 48 hours.

If it is not confirmed, the record is deleted automatically within 7 days of signup. We will send the confirmation email to one address at most 3 times in total – after that you need to write to us directly. This limit exists so the form cannot be used as a tool for flooding someone else's inbox.

5. Age limit

The form and the newsletter are intended for people aged 15 and over, and you have to confirm this before submitting. We do not collect a date of birth or any other age data.

6. Cookies and browser storage

wapp.cz sets no other cookies. Language is not stored – it is part of the page address. The pg_visitor_id cookie is only created after consent is given, and is removed immediately if you withdraw it.

You can change your choice at any time using the Cookie settings link in the footer.

7. Retention

• Server operation and security logs: normally no more than 30 days.
• Analytics data: no more than 12 months.
• Unconfirmed signup: no more than 7 days, then the record is deleted.
• Confirmed subscription: until you unsubscribe or withdraw consent.
• Proof of consent and its withdrawal: for as long as necessary to defend legal claims, and only to the minimum extent (address, timestamps, consent wording version).

8. Recipients

We do not sell personal data and do not pass it to third parties for their own marketing.

The following are involved in processing:

• Our hosting provider, on whose servers the site and databases run.
• Our own mail server (mail.progity.com), which sends the confirmation and information emails. We do not use any external newsletter service.
• ip-api.com – an external service we query for approximate location for a given IP address, and only for visitors who consented to analytics.

The ALTCHA check that protects the form runs on our own server at altcha.progity.com. It sets no cookies, does not track you across sites and sends no data about you anywhere – your browser simply solves a mathematical puzzle whose result our server verifies.

9. Transfers outside the EEA

The website, databases and mail server run on our own infrastructure in the European Union. Subscriber data is not transferred outside the EEA.

The only external service queried in connection with this website is ip-api.com (see section 8). The query contains the visitor's IP address and is only sent when the visitor has consented to analytics.

10. Your rights

In relation to your personal data you have the right:

• to access the data we process about you,
• to have inaccurate data corrected,
• to erasure,
• to restriction of processing,
• to object to processing based on legitimate interest,
• to data portability where applicable,
• to withdraw consent at any time – for analytics via Cookie settings in the footer, for the newsletter via the unsubscribe link in every email or by writing to the controller.

Withdrawing consent does not affect the lawfulness of processing carried out before it.

You also have the right to lodge a complaint with a supervisory authority – in the Czech Republic this is the Office for Personal Data Protection.

11. What we use newsletter consent for

We use newsletter consent solely for communications about the WAPP brand:

• WAPP news,
• upcoming WAPP games and projects,
• development updates,
• testing and betas,
• releases,
• related WAPP content and offers.

We do not use this consent for marketing of unrelated products – not for Shipvise, not for Progity services, and not for other projects. If we wanted to write about something else, we would ask for separate consent.

Every marketing email contains a working unsubscribe link. Unsubscribing takes one step, requires no login, and from that moment we send you no further updates.

12. Form protection

We protect the form from automated abuse with several layers:

• a hidden field that only a bot fills in,
• a limit on submissions from one IP address,
• ALTCHA verification (proof-of-work on our own server),
• server-side validation of every value,
• double opt-in and a cap on the number of confirmation emails sent.

Confirmation codes and full personal data are never written to application logs.

13. Changes to this policy

We may update this policy as the site develops. Material changes will be marked by updating the date shown under the heading of this page. If the newsletter consent wording changes, new subscribers are recorded against the new consent version.

← Back to home