// Legal

Privacy Policy

Last updated: 16 May 2026

This privacy policy explains how WastedStudios UG (haftungsbeschränkt) ("Wasted Studios", "we", "us", "our") processes personal data in connection with the Choppy Waves website, the Choppy Waves demo and full game, and related online services. We aim to keep this policy clear, honest and free of unnecessary legalese.

1. Scope

This policy applies to:

• the Choppy Waves website at choppy-waves.wastedstudios.com;
• the Choppy Waves demo and full game, distributed via Steam (additional storefronts may follow);
• online multiplayer, friend invites, public matchmaking and in-game voice chat;
• support and contact requests sent to us by email;
• any other online services we operate that link to this policy.

When you buy, install or play Choppy Waves through a third-party storefront such as Steam, that storefront is the operator of its own account, payment and community systems and processes your data as an independent controller under its own privacy policy. This policy only covers what we do with personal data.

2. Data Controller

We have not appointed a Data Protection Officer because we are not legally required to. For any privacy-related question or request, please use the email above.

3. Data We Process

We try to collect as little personal data as possible. The exact data depends on how you interact with us:

Website

• Server log data: IP address, browser/user-agent, referrer, requested URLs, response status, and timestamps. This is recorded by our hosting provider to keep the site running and to protect it against abuse.

Contact and support

• your email address;
• your name, if you provide one;
• the contents of your message and any attachments or log files you choose to send (for example, a game log included with a bug report).

Steam (storefront and platform)

• your SteamID, used as your in-game identifier;
• your Steam persona / display name, shown to other players in your lobby;
• achievement progress, which the game writes to your Steam account.

Your Steam account, purchase, payment, region, ownership/license status and friends list are managed by Valve under Valve's own privacy policy. We do not receive your real name, address, payment data or email address from Steam. We do not use Steam Cloud, Steam stats or Steam leaderboards.

Multiplayer and matchmaking

• your Steam display name and SteamID, exchanged with other players in your lobby;
• lobby/session identifiers and connection state;
• technical network data (including IP addresses and port information) needed to establish a peer-to-peer connection between you and the other players in your session;
• gameplay session metadata such as the lobby you joined, who else is in it, and connection timestamps, held in memory while the session is active.

Voice chat

• your live voice audio while you are speaking and voice chat is active;
• your player identifier and lobby/session ID, used to route voice to the right peers;
• technical voice-connection metadata (such as connection state, packet loss, voice room ID).

We do not record, store, transcribe or analyse your voice audio. See Voice Chat below for details.

Crash reports and diagnostics

At demo launch the game does not run an automated crash-reporting service of its own. If you encounter a crash or bug, you can voluntarily send us your local game log via email; in that case the log may contain technical information such as game version, operating system, hardware details, timestamps and a session ID. We plan to introduce an automated crash-reporting service (BugSplat) before or shortly after the full release. If we do, we will update this policy accordingly before that service goes live.

Reports and moderation

We do not operate our own in-game report system. Reports and blocks are handled through Steam's built-in tools. We may receive a moderation report from Valve if another player reports you via Steam. See Reports & Moderation.

Analytics

We do not use any analytics, tracking, advertising or fingerprinting tools on the website or in the game.

4. Legal Basis (GDPR)

Under Art. 6(1) GDPR we rely on the following legal bases:

Processing activity	Legal basis
Operating and securing the website (server logs)	Art. 6(1)(f) GDPR — legitimate interest
Responding to support and contact requests	Art. 6(1)(b) GDPR (pre-contract / contract) and Art. 6(1)(f) (legitimate interest)
Providing online multiplayer, lobbies and matchmaking	Art. 6(1)(b) GDPR — performance of contract (EULA)
Transmitting voice chat between players	Art. 6(1)(b) GDPR — performance of contract; and Art. 6(1)(f) where appropriate
Writing achievement progress to your Steam account	Art. 6(1)(b) GDPR — performance of contract
Receiving and acting on safety / moderation reports from Valve	Art. 6(1)(f) GDPR — legitimate interest in a safe community
Crash logs that you voluntarily submit (and any future automated crash-reporting once enabled)	Art. 6(1)(f) GDPR — legitimate interest in stability and bug fixing
Any optional non-essential cookies or analytics (none today)	Art. 6(1)(a) GDPR — consent (only if we ever introduce them)

Our legitimate interests are operating and securing the website and game, enabling and maintaining multiplayer connectivity, preventing abuse and fraud, debugging crashes, improving stability, and replying to users who contact us. We balance these interests against your privacy rights and minimise the data we collect.

5. Multiplayer & Matchmaking

Choppy Waves is an online co-op game for up to four players. To make multiplayer work, certain technical data has to be exchanged between you, the platform and the other players in your session.

How sessions are set up

• Identity: your in-game identity is your Steam account. We do not run our own account system.
• Lobbies and matchmaking: we use Steam Matchmaking lobbies to host the lobby (including for friend invites and public matchmaking). Your SteamID and Steam persona name are visible to other members of the same lobby.
• Friend invites: you can invite Steam friends through the Steam friends list and overlay. Whether you appear online and to whom is controlled by your Steam privacy settings.
• Networking: the actual gameplay traffic uses Epic Online Services (EOS) peer-to-peer networking. EOS handles the connection between players. Depending on network conditions, EOS may relay traffic via Epic's infrastructure or establish a direct peer-to-peer connection. Where a direct peer-to-peer connection is used, peer IP/port information may be exposed to the other players in the session as a technical necessity of P2P networking.

What we store on our own servers

We do not operate our own multiplayer backend. Lobby state, matchmaking, networking and voice are handled by Valve (Steam) and Epic (EOS). We do not maintain our own log of who played with whom, your SteamID history, IP addresses, lobby histories or match results. The only Steam-side persistent state we write under your account is your achievement progress.

6. Voice Chat

Choppy Waves includes in-game proximity voice chat, so players who are close to each other on the deck can hear each other.

How it works

• Provider: voice chat is powered by Epic Online Services (EOS) Voice, integrated via the third-party "EOS Online Subsystem" plugin (Redpoint Games). Voice traffic is transmitted via Epic's voice infrastructure.
• Default state: voice chat is enabled by default in a multiplayer session.
• Input mode: push-to-talk — your microphone is only active while you hold the push-to-talk key. The game does not stream open-mic audio.
• Player control: you can mute or unmute other players individually, and you can disable voice chat entirely in the game settings.
• No recording: we do not record, store, transcribe or run any AI/analysis on your voice audio. There is no server-side voice archive on our side, and we do not request any voice recordings from Epic.

Voice-related abuse

Because we don't record voice, we can't review what was said. If you experience voice abuse, please mute and/or block the player and use Steam's report tools (see Reports & Moderation).

7. Reports & Moderation

We rely on Steam's built-in reporting and blocking tools for community moderation. From a Steam user's profile or the in-game Steam overlay you can:

• block another player (you will not be matched with or hear them);
• report them to Valve for harassment, cheating or other violations.

We do not run our own in-game report UI at demo launch. If Valve forwards a report or sanction to us, or if you email us directly about another player's behaviour, we may process the information necessary to investigate (player identifiers, lobby/session identifiers, timestamps and any evidence you provide). Depending on the case we may decide to take action under our community rules, such as restricting access to our online services. We do not currently use automated moderation, automated toxicity detection or automated bans.

8. Crash Reports & Diagnostics

At demo launch the game does not include an automated crash-reporting SDK. If the game crashes or misbehaves, you can help us by emailing us your local game log file; any data we receive that way is limited to what is in that log (typically game version, operating system, hardware information, timestamps and a session identifier).

Steam may collect its own crash dumps via the Steam client. That is controlled by Valve and covered by Valve's privacy policy.

We plan to introduce automated crash reporting using BugSplat (BugSplat Software Inc.) before or shortly after the full release. Once enabled, the game would automatically send technical crash information — such as crash dumps, stack traces, game version, operating system and hardware details — to BugSplat on our behalf, so we can diagnose and fix the issue. BugSplat would act as our processor under Art. 28 GDPR. This section will be updated, and the relevant entry added to the third-party services table, before the integration goes live.

9. Analytics

We do not use any analytics, telemetry, advertising or fingerprinting tools — neither on the website nor in the game. We do not run Google Analytics, Plausible, Mixpanel, EOS Player Data Storage telemetry, Unity Analytics or any equivalent service. The only aggregated, non-identifying statistics we see are the wishlist, sales and engagement dashboards that Valve provides to developers about the Steam store page.

If we ever add optional analytics in the future, we will update this policy and ask for your consent (Art. 6(1)(a) GDPR) before activating it.

10. Third-Party Services

The site and game integrate the following services. Each has its own privacy policy and operates as an independent controller for the data it collects directly from you.

Service	What it is used for	Provider & policy
Steam — storefront and platform	Distribution of the game/demo, player identity (SteamID, persona name), friends list, friend invites, matchmaking lobbies, achievements, store community features and Steam-side reporting/blocking tools.	Valve Corp. (Privacy Policy)
Epic Online Services (EOS)	Peer-to-peer networking between players for online co-op sessions, and proximity voice chat (EOS Voice). Player identity is your Steam account; EOS is not used as a primary account system for Choppy Waves.	Epic Games, Inc. (Privacy Policy)
Web hosting	Serving this website, including server log data such as IP address and request metadata for security and operations.	ALL-INKL.COM — Neue Medien Münnich (Privacy Policy)
Email	Receiving and replying to your support and privacy emails sent to [email protected].	Hosted as part of our ALL-INKL.COM mail service (see hosting provider above).

Web fonts (Lilita One, Nunito, JetBrains Mono) are self-hosted on our own domain. The website does not make any requests to Google Fonts, Google CDNs or other third-party font services when loading fonts.

11. International Transfers

Some of the services listed above are operated by companies established outside the European Union/European Economic Area, in particular in the United States (Valve Corp. — Steam; Epic Games, Inc. — EOS; and BugSplat Software Inc. once that integration goes live). When you play Choppy Waves online, personal data necessary to provide multiplayer, voice and platform features will therefore be transferred to and processed in those countries by the respective provider.

Such transfers are based on appropriate safeguards under Chapter V GDPR, including adequacy decisions where applicable (for example the EU–U.S. Data Privacy Framework for participating U.S. companies) and Standard Contractual Clauses (SCCs) under Art. 46(2)(c) GDPR. Each provider's own privacy policy describes the specific safeguards they rely on.

12. Data Retention

We keep personal data only as long as it is needed for the purpose it was collected for, or as long as required by law.

Data	Retention
Website server logs	Up to 14 days, then deleted or anonymised by our hosting provider.
Support / contact emails	For as long as needed to handle your request, plus any statutory retention period that applies (under German tax/commercial law, business correspondence may need to be kept for up to 6 or 10 years).
Multiplayer lobby / session data	Held only in memory by Steam and EOS while a session is active. We do not store our own copy.
Voice chat audio	Not recorded or stored — transmitted live between players only.
Achievement progress	Stored on your Steam account by Valve for as long as your Steam account exists; controlled by you and Valve.
Crash logs voluntarily submitted by email	Kept together with the related support ticket and deleted when the ticket is closed and no longer needed, typically within 12 months.
Automated crash reports (once BugSplat is enabled)	Planned retention: up to 180 days. This will be confirmed in writing here before the integration goes live.
Moderation correspondence (e.g. reports forwarded by Valve or sent by users)	For as long as needed to investigate and, if a measure is taken, to document and enforce it.
Records of access restrictions we ourselves impose	For as long as needed to enforce the restriction and prevent circumvention.
Consent records (only if we add a feature that requires consent)	For as long as needed to demonstrate that consent was given, and for any related limitation period.

13. Required vs. Optional Data

Some data has to be processed for online features to work at all. Without it, those features cannot be provided:

• your SteamID and Steam persona name (used for identity and to be visible to your teammates);
• network data (IP/port information) used to connect you to other players;
• lobby/session identifiers and basic connection state.

If you do not want this data to be processed, you can still launch the game offline / in single-player contexts where available, but the online co-op, matchmaking and voice features will not be usable.

Other data is fully optional: contacting us via email, sending us a crash log, enabling/disabling voice chat, and (once available) consenting to any future optional feature.

14. Automated Decision-Making

We do not use automated decision-making that produces legal effects concerning you or similarly significantly affects you, within the meaning of Art. 22 GDPR. We do not run automated toxicity detection, automated bans or anti-cheat scoring of our own. If we ever introduce such systems, we will update this policy first.

15. Children & Young Players

Choppy Waves is intended for players who meet the minimum age required by the applicable storefront and by the law of the country they play from. Because the game involves a bar setting and mixing drinks, we expect an age rating around 12+ in most regions.

We recommend that younger players use the game with the involvement of a parent or guardian where local law requires it. We do not knowingly process the personal data of children below the relevant local consent age in a way that would require parental consent without taking the steps the law requires. If you believe a child has provided us with personal data in a way that requires parental consent, please contact us at [email protected] and we will take appropriate steps.

16. Cookies, Local Storage & Fonts

This website does not set tracking, advertising or analytics cookies, and it does not use browser local storage for tracking. We may set a single, technically necessary preference cookie if and when we add a feature that genuinely needs one (for example, to remember a consent choice). Any optional non-essential cookies would only be loaded after you opt in.

Web fonts are self-hosted from our own domain. The website does not make any request to Google Fonts, fonts.gstatic.com or any other third-party font CDN when loading fonts.

The site does not embed YouTube, Vimeo, Discord, Twitch, social-media widgets, pixels or other third-party iframes. External links (for example, to the Steam store page) only open after you actively click on them.

17. Security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or loss. These include:

• encrypted transport (HTTPS / TLS) for the website;
• secure hosting with our provider, including baseline server-side logging and protections;
• limiting access to personal data to the team members who need it;
• minimising the data we collect in the first place;
• relying on established platform providers (Valve, Epic) for the heavy lifting of online identity and networking instead of building our own backend.

No system is perfectly secure, and we cannot promise absolute security. We will notify users and supervisory authorities of any personal data breach to the extent and within the timeframes required by law.

18. Your Rights

If you are in the EU/EEA or the UK, the GDPR (and equivalent UK data protection law) gives you the right to:

• Access the personal data we hold about you (Art. 15 GDPR);
• Rectify inaccurate or incomplete data (Art. 16);
• Erasure ("right to be forgotten") in certain cases (Art. 17);
• Restriction of processing (Art. 18);
• Data portability for data you provided to us based on consent or a contract (Art. 20);
• Object to processing based on legitimate interests (Art. 21);
• Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3));
• Lodge a complaint with a data protection supervisory authority (Art. 77).

To exercise any of these rights, email [email protected]. We may ask for information needed to verify that the request comes from you (for example, the SteamID associated with your account).

The supervisory authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany — www.lda.bayern.de. You may also contact the supervisory authority in your country of residence.

19. Updates to this Policy

We may update this policy as the game and the services around it evolve — for example when we enable automated crash reporting, add a new storefront, add a new third-party service, or change retention practices. The "Last updated" date at the top of the page will always reflect the current version. Significant changes that affect you will be communicated in-game or on the website before they take effect.

20. Contact

← Back to the deck