Who operates Waypoint
Waypoint is independently operated by BushStorm Games. Privacy questions, access requests and deletion requests can be sent to privacy@bushstorm.com.
Information collected
- Invitation requests: a verified email address, desired username, name, optional country and optional introduction, together with submission, verification, approval, rejection and activation times. Administrators use these details to review applications. Legacy invitation requests may also contain a preferred name or gaming handle.
- Account information: name, username, email address, password hash, account status and creation or login timestamps.
- Regional information: country or region, used to help plan service locations and play times.
- Age confirmation: whether the account holder confirmed they are at least 18. Waypoint does not ask for or retain a full date of birth.
- Invitation records: who issued and redeemed an invitation, invitation status, expiry, credit history and the resulting invitation lineage.
- Service activity: game access, qualifying play time, account actions, moderation decisions and operational events needed to run Waypoint.
- Security information: limited network and device information, rate-limit events and authentication events used to detect abuse and protect accounts.
Waypoint does not sell personal information or use behavioural advertising.
Why information is used
Information is used to create and secure accounts, address account holders, verify email addresses, provide account recovery and service notices, operate Waypoint and connected services, issue and account for invitations, investigate abuse, enforce service rules, diagnose faults and improve reliability.
Invitation lineage
Every redeemed invitation records a direct inviter. Accounts approved through the application list record administrative approval instead of a personal inviter. This makes abuse patterns visible and supports proportionate moderation. An account is not automatically treated as responsible for another person’s behaviour merely because they appear in the same invitation tree.
Retention
- Unconfirmed or incomplete access applications are removed after seven days without another email request.
- Confirmed invitation-request details remain while the request is active and may be removed on request.
- Application email-verification links expire after 24 hours. Approval activation links expire after seven days and can be replaced by an administrator. Their secrets are stored only as hashes.
- Unverified registration attempts are removed after 24 hours.
- Single-use account-verification secrets expire after 60 minutes and are stored only as hashes.
- Account and invitation-lineage records remain while an account is active.
- Routine security and audit events are normally retained for no more than 12 months, unless an active incident or legal requirement calls for longer retention.
- After an approved deletion request, personal account data is removed or de-identified within 30 days, apart from a minimal record needed for security, dispute resolution or a legal obligation.
Sharing and service providers
Information may be processed by infrastructure and email-delivery providers acting for BushStorm Games, and may be disclosed where required by law or necessary to protect users and the service. BushStorm Games limits information shared with providers to what is necessary for their services.
Security
Waypoint uses encrypted transport for website and launcher authentication, one-way password hashing, single-use verification and game-entry tokens, rate limits, restricted administrative access and audit records. No internet service can promise absolute security; suspected account compromise should be reported promptly.
Access, correction and deletion
Account holders may ask what personal information is held, correct inaccurate information, or request deletion by emailing privacy@bushstorm.com. Identity may need to be confirmed before a request is completed.
Age limit
Early access registration is for people aged 18 or older. If BushStorm Games learns that an account holder does not meet the age requirement, the account may be suspended and associated personal information removed.
Changes
Material changes will be dated here and, where appropriate, communicated through Waypoint or by email.