oncehuman.world (the site) is an unofficial Once Human fan site. This page explains what personal data the site handles, why, how long it is kept and how it is erased. We collect no email, phone number or real name.
1. Why we process data
- Identifying you, logging you in, recovering your ID and password
- Beta tester invites (issuing and using invite keys)
- Syncing your collection checklist
- Saving and sharing builds (public builds show their name, setup and your nickname to others)
- Running the community (posts, comments, votes, reports, notifications) and handling page feedback
- Stopping abuse such as spam, impersonation and unauthorised automated collection, and checking disputes
- Security and visit statistics
- Showing ads (Google AdSense — pays for running the site)
2. What we process
| Group | Data | When |
|---|---|---|
| Members (required) | ID (issued by the site), one-way hashes of your password and recovery phrase, when you agreed to the terms and which version | At sign-up |
| Login | Hashes of session tokens, sign-up and last login times, passkey public keys (if added) | At login or passkey setup |
| Community | Nickname (if set), posts, comments and uploaded images, votes, reports, page feedback (sent with “Send feedback” under info pages), notifications you receive | When you write or receive them |
| Collection checklist | Deviation numbers | When you tick them while signed in |
| Builds | Builds you save (name and setup), whether they are public, build votes | When you save, publish or vote |
| Beta invite keys | Keys you issue, when they were issued and used, and, if you signed up with a key, that key (linking you to the account that issued it) | When you issue or use a key |
| Member IP | IP address, first and last time, count | At sign-up, login, posting, commenting, reporting and sending feedback |
| All visitors (automatic) | Server access log — IP address, requested URL, time, browser information | Every request |
| All visitors (automatic) | Visit statistics — pages viewed (address and title), referring address, time on page, device, browser and OS type, screen size, language, approximate region (worked out from the IP address, which is not stored) | When a page opens |
| All visitors (automatic) | Ads — Google itself collects the page address, ad views and clicks, device and browser information and IP address with ad cookies and device identifiers (the site does not receive them) | When a page with ads opens |
3. How long we keep it
| Data | Kept for | Then |
|---|---|---|
| Account, passkeys, collection checklist, saved builds, votes, invite keys you issued | Until you delete your account | Erased at once |
| Login sessions | 30 days | Erased |
| Member IPs | 90 days after last use | Erased |
| Notifications | Until read; unread ones 90 days after you receive them | Erased |
| Page feedback | 1 year after it is handled | Erased |
| Reports | 1 year after they are handled | Reporter and note erased; only the count stays |
| Moderation records (hiding, suspension, nickname resets, …) | 1 year | Target (member or post) and notes erased; only the action and time stay |
| IP blocks | 90 days after the block (at most 1 year) ends | Erased |
| Staff access log | 1 year | Erased |
| Server access log | 14 days | Erased |
| Automatic security blocks (IPs detected as attacks) | 7 days | Erased |
| Access statistics (aggregated, last part of IP removed) | 30 days | Erased |
| Visit statistics | 1 year | Erased |
| Ads (collected by Google) | Per Google’s privacy policy | Erased or anonymised by Google |
| Database backups | 30 days | Files deleted |
When you delete your account, its data, sessions, member IPs and notifications are erased at once regardless of the periods above, along with staff notes about you in moderation records and any nickname staff reset. Posts, comments and page feedback stay under “Deleted member” — delete them yourself first if you want them gone.
Backups are used only for disaster recovery; data from a deleted account stays in backups for at most 30 days.
If another law ever requires us to keep something, we will keep it separately for that period only (none today).
4. How data is erased
- An hourly cleanup job deletes expired data from the database (it cannot be restored).
- Backup files and access log files are deleted whole once they expire.
- Images of posts deleted by their authors, and images not attached to any post, are deleted from storage.
- We keep no paper records.
5. Sharing with third parties
We do not give personal data to anyone else, except when the law requires it.
6. Service providers and overseas transfer
The site uses the two services below, both outside Korea. Visit statistics are processed by the site itself on the Oracle Cloud server.
| Recipient | Country · contact | Data | When and how | Purpose | Kept for |
|---|---|---|---|---|---|
| Oracle Corporation (Oracle Cloud) | Japan (Tokyo) · oracle.com/legal/privacy | Everything in section 2 | Sent over the network and stored as you use the site | Site server, database and backups | Same as section 3 |
| Google LLC (Google AdSense) | United States · policies.google.com/privacy | The ads data in section 2 | Sent by your browser straight to Google when a page with ads opens | Showing and measuring ads, stopping click fraud | Per Google’s privacy policy |
To refuse: Oracle Cloud is the site’s own server, so refusing means not using the site (you can stay signed out or delete your account). Visit statistics and ads can be blocked with a tracker or ad blocker; the site still works. Personalised ads can be turned off in Google’s ad settings (adssettings.google.com).
7. Cookies and browser storage
- Login cookie (oh_session) — keeps you signed in. Without it you cannot sign in.
- Passkey check cookie (oh_webauthn) — used for 5 minutes while signing in or adding a passkey.
- View cookie (ohw-view) — remembers PC or mobile view if you chose one.
- Ad cookies (Google) — Google AdSense uses them to show and measure ads, pick personalised ads from your browsing and avoid showing the same ad again (behavioural data). Google sets and reads them itself; the site never receives their values.
- Browser storage — your collection checklist, recent searches, build drafts, builds saved before signing in and display settings stay on this device (not sent to the server; when you sign in the collection checklist syncs, and saved builds move to your account only if you choose).
Visit statistics use no cookies or browser storage. You can block or delete cookies in your browser settings; to block only ad cookies, block third-party cookies in your browser or turn off personalised ads in Google’s ad settings (adssettings.google.com) — you still see ads, but not based on your browsing.
8. Your rights and how to use them
You can ask at any time to see, correct or delete your personal data, or to stop processing it.
- Yourself, on the account page: change your nickname, manage your password, recovery phrase and passkeys, delete your account
- Yourself, in the community: edit or delete your posts and comments
- Yourself, in the build planner: rename, make private or delete your builds
- Anything else (access, checking IP records, stopping processing, …): email privacy@wooa.dev with your ID and request. Since we hold no email address, we may ask you to confirm it is you through your signed-in account page (for example, by briefly changing your nickname to a given word).
We handle requests within 10 days and tell you the result. If the law lets us refuse, we tell you why.
9. How we protect data
- Passwords (scrypt), recovery phrases (SHA-256) and login tokens are stored only as one-way hashes.
- All traffic is encrypted with HTTPS.
- Admin pages open only for staff roles, full IPs are visible to admins only, and the content editor opens only from allowed IPs.
- When staff open a member’s details or search by IP, the access is logged for 1 year.
- Login attempts are rate-limited per ID and IP.
- The live Isles of Abyss status goes only to page requests from browsers. Cloud and data-centre networks and non-browser requests get it 15 minutes late; the request IP is only checked against those ranges and is not stored.
- The server automatically checks access and SSH logs and blocks, for a while, IPs that probe for vulnerabilities or try to brute-force logins. The detected IP, reason and time are erased after 7 days and never sent elsewhere.
- Backups are kept in private storage with restricted access.
10. Privacy officer
- Privacy officer: the oncehuman.world operator
- Contact: privacy@wooa.dev
Send questions, complaints or requests for remedies about personal data to the contact above.
11. Remedies
You can also ask these Korean bodies for advice, reports or dispute mediation.
- Personal Information Infringement Report Center: privacy.kisa.or.kr, 118
- Personal Information Dispute Mediation Committee: kopico.go.kr, 1833-6972
- Supreme Prosecutors’ Office: spo.go.kr, 1301
- Korean National Police Agency: ecrm.police.go.kr, 182
12. Children under 14
The community is for adults, and we do not collect personal data from children under 14. If we learn of any, we erase it at once.
13. Changes
When this policy changes we announce it here and notify members, who are asked to agree again.
- 2026-10-26 (version 8): Stopping unauthorised automated collection: the live Isles of Abyss status goes only to page requests from browsers, while cloud and data-centre networks and non-browser requests get it 15 minutes late (the request IP is only checked against those ranges at that moment and not stored); the purposes now name unauthorised automated collection
- 2026-10-26 (version 7): Terms of use: collecting with automated tools without permission and reposting or relaying what was collected that way are not allowed, taking login data (such as session cookies) out to other programs is not allowed, and the actions against automated collection (logout, blocking the account, blocking IPs) are listed (the privacy policy itself is unchanged)
- 2026-10-26 (version 6): Google AdSense ads added (Google collects ad views and clicks itself with ad cookies and sends them to the US) — how this works and how to opt out
- 2026-10-22 (version 5): Beta invite keys added (keys you issue and whether they were used, and the link between an account that signed up with a key and the account that issued it)
- 2026-10-21 (version 4): Google Analytics replaced by cookie-free visit statistics run by the site itself (no more overseas transfer or analytics cookies); staff can no longer see which page you are viewing; automatic attack blocking records added
- 2026-10-20 (version 3): Saving, publishing and voting on builds added
- 2026-10-20 (version 2): Full policy published; page feedback, backups, statistics, staff access logs and overseas storage added; retention set for reports, moderation records and IP blocks
- 2026-10-15 (version 1): First version (consent to collection and use at sign-up)