Privacy Policy

Wyldwolf Games LLC, a Minnesota company, determines why and how personal information is processed through the Service. In privacy-law terms, we act as the controller or business for that information unless this Policy says otherwise.

This Policy does not govern a third party's own service or website. For example, ClickUp, Google, Stripe, and CoreScreening process information under their own privacy notices when you interact directly with them. A program partner may also be independently responsible for information it collects and provides to us.

We receive personal information from:

• You, when you register, build a profile, apply to be a Game Master, claim or book a session, send a message, upload a file, connect another service, or contact us.
• Administrators, other users, and program partners, when they create assignments, provide program details, communicate with you, submit a rating or incident report, or maintain personnel and operational records.
• Connected services, when you authorize ClickUp, complete Stripe onboarding, or use another integration.
• Automatically, through authentication, hosting, security, and error-monitoring systems when you use the Service.

The information we process depends on your role and which features you use:

• Account and identity information

  Name, nickname, email address, account role, account status, profile image, login and verification records, and account creation and last-active dates. Our authentication provider stores password credentials in protected form; we do not display or retrieve your plaintext password.

• Contact, profile, and availability information

  Phone number, Discord username, mailing address, state or service region, nickname, pronouns, biography, gaming systems and experience, availability and unavailability, status message, and emergency-contact name and contact details.

• Applications, onboarding, and contractor records

  Game Master application answers, cover letters, resumes and other uploaded documents, application status, onboarding progress, electronically accepted agreement versions, typed signatures and acceptance timestamps, background-screening workflow status and dates, interview scheduling details, administrator notes, roster membership, ratings, incident reports, and assignment reliability history.

• Programs, bookings, and attendance

  Session titles and descriptions, dates and times, venues and sites, age ranges, staffing assignments, claimed jobs, booking and waitlist entries, number of seats, check-in status, completion responses, session notes, substitution requests and limited participant-behavior notes, partner and coordinator contact information, and calendar events.

• Messages, files, tasks, and preferences

  Direct and session messages, reactions, replies, read status, message attachments, notifications, personal Nexus tasks, notification choices, saved searches, and interface preferences. Message drafts and some interface settings may remain only in your browser until you clear them. Authorized administrators may review in-app conversations for support, safety, compliance, and contractor oversight; those review events are recorded in the administrative activity log.

• Pay and payout records

  Compensation rates, pay adjustments, completed and paid session history, payout amounts and status, Stripe connected-account identifier and readiness status, transfer identifiers, and payout failure or reversal records. Stripe, not Nexus, collects the bank-account, identity, taxpayer, and similar financial details entered on Stripe's hosted onboarding pages. We do not store full payment-card or bank-account numbers in Nexus.

• Integration information

  For a connected ClickUp account, we process the ClickUp user identifier and username, an encrypted OAuth access token, and the workspaces, hierarchy, tasks, assignees, comments, and attachment information that your ClickUp permissions allow Nexus to access. Nexus may send task changes or files to ClickUp when you direct it to do so.

• Technical, security, and activity information

  Authentication cookies and tokens, OAuth state, IP address used for abuse prevention and rate limiting, browser and device information made available to our hosting providers, request and event timestamps, security and audit events, feature activity, and limited diagnostic and error information. Production error monitoring is configured to remove user objects, cookies, request bodies, headers, and query strings before an event is sent.

Some of this information may be considered sensitive under certain laws, including emergency-contact data, account credentials, screening information, financial information processed by Stripe, or information a user places in a message or file. Please do not submit Social Security numbers, bank details, health information, or other highly sensitive information in general-purpose profile fields, tasks, messages, or attachments.

We use the categories above to:

• create, authenticate, maintain, secure, and support accounts;
• operate bookings, waitlists, staffing, schedules, attendance, calendars, reminders, and program communications;
• evaluate applications, complete onboarding, administer contractor relationships, coordinate safety requirements, and make human staffing decisions;
• calculate compensation, administer payouts, maintain transaction and tax records, and resolve payment issues;
• deliver messages, attachments, notifications, transactional emails, and account communications;
• provide personal task management and user-directed ClickUp functionality;
• detect abuse, enforce access controls and agreements, investigate incidents, troubleshoot errors, maintain audit trails, and protect users, partners, the public, and the Service;
• comply with law, respond to lawful process, establish or defend legal claims, and perform accounting and business administration; and
• improve the reliability, accessibility, and operation of the Service using operational information. We do not currently use third-party advertising analytics in Nexus.

If we want to use personal information for a materially different, incompatible purpose, we will provide notice and obtain consent where required.

We disclose personal information only for the purposes described in this Policy and based on role and need:

Depending on the feature, the categories disclosed may include account and contact information; application, onboarding, and contractor records; program, booking, attendance, and calendar information; messages, files, tasks, and preferences; payout or integration status; and limited technical, security, and activity information.

• Service providers. Netlify provides application hosting; Supabase provides authentication, database, file storage, realtime, and server functions; Resend delivers transactional email; Sentry receives limited, privacy-filtered error diagnostics; and uptime and infrastructure providers help us operate and secure the Service.
• Payment, screening, and connected services. We disclose or receive the information needed to use Stripe, ClickUp, Google Calendar, and CoreScreening as described in the next section.
• Authorized users and program partners. Administrators can access information needed to manage the Service and contractor operations, including in-app conversations when reasonably needed for support, safety, compliance, or oversight. Public Game Master profiles may display a name, avatar, pronouns, biography, gaming systems, ratings, and review text. Signed-in staff may also see work contact details made available to the team. Game Masters, customers, and guests may see program information, participant or staffing names, and communications relevant to their role. Schools, libraries, venues, and other partners may receive the contact, staffing, booking, attendance, incident, or safety information reasonably needed to deliver a program.
• Professional advisers. We may disclose information to attorneys, accountants, insurers, auditors, and similar advisers who need it to provide services to us.
• Legal and safety recipients. We may disclose information when we reasonably believe it is required by law or necessary to investigate fraud or abuse, enforce agreements, respond to valid legal process, or protect a person's rights, property, or safety.
• Business transactions. If we are involved in a merger, financing, reorganization, sale of assets, or similar transaction, information may be reviewed or transferred subject to appropriate confidentiality and legal requirements.
• At your direction. We may disclose information when you request it or give consent.

• ClickUp. Connecting ClickUp is optional and user-specific. Nexus uses your authorization to retrieve and display permitted ClickUp content and to perform changes you request. The OAuth token is encrypted before storage. You can disconnect ClickUp in Settings; this removes the Nexus connection but does not delete information from ClickUp.
• Google Calendar. When the organizational calendar sync is enabled, Nexus sends selected program information to a shared Wyldwolf calendar: session title, date and time, site or city, venue, age range, staffing count, and assigned Game Master names. After at least one Game Master accepts a session, the event also includes the selected onsite contact's name and work or cell phone numbers. People who have been granted access to that shared calendar can see those event details. Contact email addresses, private coordinator instructions, and partner quote fields are excluded from the sync. When guest invitations are enabled, assigned Game Masters' email addresses are sent to Google to invite them to their sessions. Applicant interviews use a separate restricted calendar and include the applicant and interviewer email addresses, interview time, and a Google Meet link. Application notes, resumes, cover letters, and screening records are not included. Calendar owners and people with elevated calendar permissions may still access events marked private.
• Stripe Connect. Game Masters may be sent to Stripe-hosted pages to provide identity, tax, and bank details needed for payouts. Stripe processes those details under Stripe's privacy notice. Nexus receives and stores limited connected account, readiness, transfer, and payout status information.
• CoreScreening. A background check may be completed through CoreScreening under a separate disclosure and authorization process. CoreScreening collects screening information directly under its own privacy practices. Nexus is designed to store the screening workflow status, relevant dates, and administrator classification—not the Social Security number or identity-verification details entered with CoreScreening. This Privacy Policy is not a background-check authorization.
• Have I Been Pwned. During account creation and password reset, your browser may check whether a proposed password appears in a known breach. The check sends only the first five characters of the password's SHA-1 hash to the provider. The plaintext password and complete hash are not sent.
• Embedded training media. Authorized onboarding pages may load training videos from YouTube using its privacy-enhanced domain or from Vimeo. Loading or playing an embedded video sends routine connection information, such as an IP address and browser details, to that provider under its own privacy practices.

Information already held by a third-party service remains subject to that service's retention, security, and privacy practices. You should review its privacy notice before providing information.

We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. We also do not use solely automated profiling to make decisions that produce legal or similarly significant effects.

Nexus may automatically flag a Game Master application as potentially matching a previously deactivated account. That flag supports human review and does not automatically accept, reject, deactivate, or terminate anyone. Background-screening outcomes and staffing or account decisions are reviewed by authorized people.

Because we do not currently engage in sales or targeted advertising, there is no separate advertising opt-out needed. Browsers may send Do Not Track or Global Privacy Control signals. There is no uniform response required for Do Not Track, and it does not change Nexus functionality. If our practices change in a way that makes a legally recognized opt-out signal applicable, we will update our process and honor the signal as required.

The Service uses authentication cookies or similar tokens to keep you signed in, protect routes, and maintain account security. A short-lived, secure cookie is used to validate a ClickUp connection request. These technologies are necessary for requested functionality and are not advertising cookies.

Your browser may also store message drafts, interface layout choices, recent actions, selected ClickUp views, installation-hint preferences, and, for legacy guest-booking flows, a temporary guest reference. This information stays on that device until it expires, the feature removes it, or you clear browser data. The installed web app's service worker caches only basic offline assets such as the offline page and app icon.

We keep personal information only while it is reasonably necessary for the purpose described in this Policy, considering the account or contractor relationship, operational needs, sensitivity, legal and accounting requirements, dispute and safety needs, and available deletion or de-identification controls.

• Active accounts and operations. Profile, booking, assignment, message, application, and program records are generally retained while the account, application, assignment, or operational need remains active.
• Account deletion workflow. Accounts scheduled for deletion enter a 30-day waiting period during which an authorized administrator can reverse the deletion. Once processed, sign-in access is permanently disabled, the authentication record is soft-deleted, and profile identifiers are anonymized; the user's application files, personnel files, message attachments, and avatar are removed; message content is replaced with a deletion notice; and user-linked bookings, waitlists, applications, notifications, ClickUp credentials, personal tasks, availability, roster memberships, and saved searches are deleted.
• Contract, payroll, safety, and audit records. We generally retain restricted assignment, agreement acceptance, payout, tax, accounting, incident, lifecycle, and audit records for seven years after the later of the end of the account or contractor relationship or the related transaction, incident, or record date. We may keep a record longer when required by law or reasonably necessary for an active audit, investigation, dispute, fraud or safety matter, or to establish or defend legal claims. Where practical, retained records are limited or de-identified.
• Prior-account safeguard. We may retain a restricted cryptographic fingerprint derived from a former account email, together with limited deactivation and lifecycle information, to alert administrators if a previously deactivated person reapplies. The fingerprint is not the plaintext email and is not available through normal user access. It is used for human review, not automatic rejection.
• Email operations. Completed or failed transactional email queue records are designed to be removed after 30 days. Pending records may be kept long enough to complete delivery or diagnose a failure.
• Security and diagnostics. Short-term rate-limit records are designed to be purged after about one day. Other security, hosting, and error records follow operational and provider retention settings and are kept only as needed for reliability, security, and legal compliance.

Deletion may not be immediate in encrypted backups, disaster-recovery copies, or a provider's systems; those copies are isolated from ordinary use and age out under the applicable backup or provider schedule. We may also deny or limit deletion where retention is permitted or required by law.

We use administrative, technical, and organizational safeguards designed to protect personal information. Depending on the information, these include encrypted network connections, role-based access, database row-level security, private file-storage rules and short-lived download links, audit trails, restricted administrator functions, server-side secret management, rate limits, security headers, and encryption of stored ClickUp OAuth tokens.

No internet transmission, storage system, or security measure is completely secure. You are responsible for using a unique password, protecting your devices, signing out of shared devices, and promptly telling us if you suspect unauthorized access.

Depending on your location and the context in which we process your information, you may have the right to:

• confirm whether we process your personal information and access it;
• correct inaccurate information;
• request deletion, subject to legal exceptions;
• receive information you provided in a portable format where technically feasible;
• obtain a list of specific third parties to which we disclosed your personal information, where applicable;
• withdraw consent where processing depends on consent, without affecting processing completed before withdrawal;
• opt out of sale, targeted advertising, or qualifying automated profiling if we engage in those practices in the future; and
• appeal a denial of a privacy request and not be discriminated against.

You can correct much of your profile and change notification choices in the Service. For any other request, email info@wyldwolfgames.com with the subject “Privacy Request” and describe the right you want to exercise. Include the name and email associated with your account and your state or country of residence. Do not email a password, Social Security number, bank information, or a copy of an identity document unless we specifically request a secure verification method.

We may need to verify your identity or authority before completing a request. We will respond within the period required by applicable law. Where the Minnesota Consumer Data Privacy Act applies, the ordinary response period is 45 days and may be extended once when reasonably necessary with notice. Requests are free to the extent required by law, although manifestly unfounded or excessive requests may be handled as permitted by law.

If we deny a request, you may appeal by emailing info@wyldwolfgames.com with the subject “Privacy Appeal” and explaining why you believe the decision should be reconsidered. We will respond to an appeal within the time required by applicable law. If an appeal under Minnesota law is denied, you may contact the Minnesota Attorney General's Office.

Some privacy laws exclude records processed in an employment, applicant, or independent-contractor context or do not apply to every organization. Nothing in this Policy limits rights that cannot lawfully be limited.

Nexus accounts are intended for adults age 18 and older. The Service is not directed to children, and we do not knowingly allow a child under 13 to create an account or provide personal information directly through the Service. If you believe a child has done so, contact us so we can investigate and delete the information as appropriate.

Wyldwolf programs may serve minors at schools, libraries, and other partner sites. Adult users and program partners may place limited participant or emergency information in authorized booking, roster, message, attachment, incident, substitution, or program-coordination workflows. Substitution notes may briefly describe participant behavior when reasonably needed to prepare a replacement Game Master; access is limited to currently assigned Game Masters and administrators, and the note is deleted when the session is completed or otherwise closed. Users must provide only information they are authorized to share and only what is reasonably necessary to deliver and safeguard the program. Nexus is not intended to collect a minor's Social Security number, financial account details, online account password, or similar high-risk information.

We send service communications such as account verification and security messages, assignment and booking confirmations, schedule changes, and other operational notices. Some of these are necessary to provide the Service and cannot be disabled while the related account or booking is active.

Where enabled, you can change optional reminder preferences in Settings. Turning off a reminder removes pending reminder emails associated with your account. We do not currently use Nexus to send third-party marketing or advertising email.

The Service is offered only in the United States and is not directed to people outside the United States. Wyldwolf Games is based in Minnesota, and personal information is processed in the United States by us and our service providers. If you are outside the United States, you should not register for or use the Service.

We may update this Policy to reflect changes in the Service, our practices, or legal requirements. We will post the revised Policy with a new “last updated” date. If a change is material, we will provide additional notice through the Service, by email, or by another reasonable method and provide any choice or consent opportunity required by law.

Contact us at that address if you have a question, need this Policy in an alternate accessible format, or want to submit a privacy complaint.