What is this?

Warroom is a fan-made companion for wdgwars.pl: battle map, watcher (alerts when someone steps on your turf), raid planner and crew features. It is not official — WDGWars and LOCOSP do not build, run or endorse it. It is built and operated by a single player from the community.

What happens with your API key?

• At sign-up it is checked once via /api/me — your wdgwars name becomes your login. No email, no phone number; Warroom doesn't even ask.
• The key is stored encrypted (Fernet/AES) in the database and is only decrypted in memory to talk to the wdgwars API.
• Warroom only reads. It never uploads in your name, never scans, never changes anything on your wdgwars account. Every 5 minutes it fetches: your profile, your APs, your team, plus the public territory map and leaderboard — the same data the API shows every player.
• Use a key of its own. Mint a fresh one in your wdgwars profile just for Warroom. Then you can pull it back here without breaking anything else you run.
• You stay in control: rotate your key in your wdgwars profile and the stored one instantly becomes useless.

What Warroom stores about you

• Your wdgwars name, gang, a bcrypt hash of your Warroom password (never the password itself) and your encrypted key.
• Your turf as counts per map cell — the same cells you see on the wdgwars map. Your raw APs (exact positions, BSSIDs, names) are aggregated into cells on arrival and never stored.
• Ownership changes on your turf (the watcher feed) and your stats history (bare numbers for the charts).
• Only if you actively turn it on: crew links, your live position (a single, always-overwritten point — no movement history) and your device's push subscription. When you stop sharing, or the window runs out, the coordinate is erased, not merely hidden.
• Only while you record with the coverage brush: your own GPS trail (map point + reception radius per stamp). It is visible to nobody but you, can be wiped any time (↺ in the layer menu) and is deleted with your account. It does not expire on its own — it stays until you clear it.
• If you create an API token (info tab), its name and a hash of it — never the token itself. Such tokens may only read, and can be revoked individually.
• From the game feed Warroom fetches for the map anyway, it periodically records how many cells and APs every player and every gang holds — so not just you. Alongside it, the game's public leaderboards including the player names shown there, plus — from the member lists of gangs that users of this instance belong to — each member's name and join date. These are exactly the numbers, names and dates wdgwars itself displays, kept with a timestamp so development over time becomes visible. No positions, no individual APs.

What Warroom does not do

No analytics, no trackers, no ads, no selling or sharing of data. Through your key Warroom only sees what the API shows you yourself — nobody peeks into other accounts here. Ordinary web-server access logs exist like on any website; nothing is done with them.

Deleting

In the app under Account → Delete account: immediately and permanently removes everything — account, key, turf data, events, positions, coverage trail, push devices, crew links. It drops out of server backups within 14 days at most. Your wdgwars account is completely untouched by this.

Third parties involved

• OpenStreetMap tiles — your browser loads the map itself straight from tile.openstreetmap.org. That shows them which part of the map you are looking at (in follow mode, roughly where you are), plus your IP.
• OpenStreetMap Overpass — gets cell coordinates only, not who you are, to snap tour waypoints onto roads. Asked by the server, not by your browser.
• OSRM routing — gets the tour stops and, once you have a position set, your own position as the start point. During in-app guidance that goes out live again whenever you leave the route, or every 10 seconds. Without it there is no real route. Depending on your travel mode (car, bike or on foot) the server asks the matching routing service at the same provider. Server-side, and without your name.
• Google Maps — only when you tap "open in Maps" or Street View yourself. Then the stop coordinates go to Google, like with any Maps link.
• Cloudflare (TLS/CDN in front of the domain) and your browser's push service for notifications (payloads encrypted).

Straight talk about trust

As with any service you hand a key to: whoever runs the server could technically use it. No hosted tool can prove otherwise to you. Treat the key like a password — only hand it over if you trust the tool, and rotate it any time. Questions? Ask them openly on the WDGWars Discord.