This Privacy Policy (the "Policy") explains how Vibo Games (the "Operator", "we", "us") collects, uses, shares, and protects personal data when you use our service available at app.vibo.games and our website vibo.games (together, the "Service"). By using the Service, creating an account, or submitting your email address, you acknowledge that you have read and understood this Policy.
Draft. This document is a preliminary draft prepared for the international launch and is pending review by qualified legal counsel. It does not yet constitute the final, binding terms.
1. Who we are
The data controller responsible for your personal data is Vibo Games (the "Operator"). For any questions about this Policy or how we handle your data, contact us at info@vibo.games.
2. Key terms
- Personal data — any information relating to an identified or identifiable natural person.
- Processing — any operation performed on personal data, such as collection, storage, use, sharing, or deletion.
- Adult user — the person aged 18 or over who holds and controls the account.
- Service — the Vibo Games software and websites that let families create browser games from a text description using AI, including the Voxel World 3D environment and room-code co-op play.
3. What data we collect
We collect only the data we need to provide and operate the Service:
- Email address — when you register an account and to send service-related messages.
- Password — stored only as an irreversible hash; we never have access to it in plain text.
- Sign-in data from third-party providers (OAuth) — when you sign in through a supported third-party provider, we receive a user identifier and the name and email address in your profile, to the extent you authorize.
- Profile name — the display name you provide or that we receive from your sign-in provider.
- Feedback and request forms — the name, phone number or email address, and message text you submit through our contact, "report a problem", and consultation forms. Please do not include sensitive personal data in these messages.
- Anonymous session identifier — a technical identifier stored in your browser to associate games created without registration with your device.
- Technical and log data — IP address, date and time of requests, browser and device type (user-agent), and cookies.
- Payment status — for paid options, we receive the status of a payment from our payment provider. Card details are handled by the payment provider and are not collected or stored by us.
- Content you create — the text prompts describing your game ideas, chosen parameters, generated games, and messages you exchange with in-game AI characters (NPCs). See Section 6 on how prompts and dialogues are shared with our AI technology provider.
We do not knowingly collect special categories of data (such as data about health, religion, or political opinions), and we do not request them.
4. Legal bases (GDPR)
Where the GDPR applies, we process personal data on the following legal bases (Article 6):
- Consent — for example, when you submit a feedback form or accept optional cookies. You may withdraw consent at any time.
- Performance of a contract — to create and maintain your account and provide the Service you have requested.
- Legitimate interests — to keep the Service secure and stable, prevent abuse, and improve it, balanced against your rights and freedoms.
- Legal obligation — where processing is required to comply with applicable law.
5. Children's privacy
The Service is designed to be used together by an adult and a child aged 5 or over, under adult supervision. Accounts are created and controlled by an adult, and the Service is not directed to children for the purpose of independent, unsupervised registration.
- We do not knowingly collect personal data directly from children.
- Under the U.S. Children's Online Privacy Protection Act (COPPA), where the Service knowingly collects personal data from a child under 13, we will seek verifiable parental consent and rely on the supervising adult to provide it. A parent may review, request deletion of, or refuse further collection of their child's information by contacting info@vibo.games.
- Under the GDPR, the minimum age of digital consent varies by country (between 13 and 16). Where a child is below that age, the account and any consent are provided by the responsible adult.
- AI dialogues with in-game characters (NPCs) are currently intended for adults only.
- If we learn we have collected personal data from a child without appropriate consent, we will delete it. Please contact us if you believe a child has provided us data.
6. Third parties and AI processing
We do not sell personal data. We share data only as needed to operate the Service:
- Payment provider — processes payments for paid options. Card data is submitted directly to the payment provider and is not shared with or stored by us; we receive only the payment status.
- AI technology provider — to generate a game, we send the text of your prompt and chosen parameters; for dialogues with in-game characters, we send the text of your messages in that dialogue. We do not send your account identifiers (such as your email address) to this provider. Please do not include personal data (names, contacts, and similar) in your game prompts or in-game dialogues.
- Infrastructure and email delivery providers — hosting and email services process data strictly to operate the Service under appropriate confidentiality and data-protection terms.
7. International data transfers
The Service operates for an international audience, and our providers (including the AI technology and infrastructure providers) may process data in countries other than your own. Where personal data is transferred internationally, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or an adequacy decision, as applicable. Please keep in mind that prompts and in-game dialogues may be processed by our AI technology provider, whose infrastructure may be located outside your country.
8. Cookies
We use strictly necessary cookies (for example, to store your session and selected theme) and, where applicable, analytics cookies. You can disable cookies in your browser settings, but some features of the Service may then not work correctly.
9. Data retention
We keep personal data only for as long as necessary to fulfill the purposes described in this Policy — typically for the life of your account and while required to provide the Service, resolve disputes, and comply with legal obligations. When data is no longer needed, we delete or anonymize it.
10. Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you;
- Rectify inaccurate or incomplete data;
- Erase your data ("right to be forgotten");
- Restrict or object to certain processing;
- Data portability — receive your data in a structured, machine-readable format;
- Withdraw consent at any time, without affecting processing carried out before the withdrawal;
- Lodge a complaint with your local data protection authority.
California residents (CCPA/CPRA): you have the right to know what personal information we collect, to request its deletion or correction, and to opt out of any "sale" or "sharing" of personal information. We do not sell your personal information. We will not discriminate against you for exercising these rights.
11. How to exercise your rights
To exercise any of the rights above, email us at info@vibo.games. We may need to verify your identity before responding, and we will reply within the timeframes required by applicable law.
12. Security
We apply appropriate organizational and technical measures to protect personal data against unauthorized access, alteration, disclosure, or destruction — including access controls, storing passwords as hashes, and transmitting data over encrypted connections (HTTPS).
13. Changes to this Policy
We may update this Policy from time to time. The current version is always available at vibo.games/en/privacy and takes effect when published. Material changes will be communicated where appropriate.