Privacy Policy

This Privacy Policy (the "Policy") explains how Vibo Games (the "Operator", "we", "us") collects, uses, shares, and protects personal data when you use our service available at app.vibo.games and our website vibo.games (together, the "Service"). By using the Service, creating an account, or submitting your email address, you acknowledge that you have read and understood this Policy.

1. Who we are

The data controller responsible for your personal data is OOO "Vaibo" (ООО «Вайбо»), a company registered in the Russian Federation — OGRN 1262400014150, INN 2465374330 — operating the Service under the Vibo Games brand (the "Operator"). For any questions about this Policy or how we handle your data, contact us at info@vibo.games.

2. Key terms

• Personal data — any information relating to an identified or identifiable natural person.
• Processing — any operation performed on personal data, such as collection, storage, use, sharing, or deletion.
• Adult user — the person aged 18 or over who holds and controls the account.
• Service — the Vibo Games software and websites that let families create browser games from a text description using AI, including the Voxel World 3D environment and room-code co-op play.

3. What data we collect

We collect only the data we need to provide and operate the Service:

• Email address — when you register an account and to send service-related messages.
• Password — stored only as an irreversible hash; we never have access to it in plain text.
• Sign-in data from third-party providers (OAuth) — when you sign in through a supported third-party provider, we receive a user identifier and the name and email address in your profile, to the extent you authorize.
• Profile name — the display name you provide or that we receive from your sign-in provider.
• Requests you send us — the name, email address, and message text you submit through the feedback form in the app at app.vibo.games, or that you provide yourself when you email us or write to us on Telegram, as well as records of reports about published games: which game was reported, the reporting account, the time, and technical data (IP address, user-agent) — used to moderate the catalog and prevent abuse. The website vibo.games has no forms that collect personal data. Please do not include sensitive personal data in these messages.
• Anonymous session identifier — a technical identifier stored in your browser to associate games created without registration with your device.
• Technical and log data — IP address, date and time of requests, browser and device type (user-agent), and cookies.
• Payment status — for paid options, we receive the status of a payment from our payment provider. Card details are handled by the payment provider and are not collected or stored by us.
• Content you create — the text prompts describing your game ideas, chosen parameters, generated games, and messages you exchange with in-game AI characters (NPCs). See Section 6 on how prompts and dialogues are shared with our AI technology provider.

We do not knowingly collect special categories of data (such as data about health, religion, or political opinions), and we do not request them.

4. Our approach and legal bases

The Operator is established in the Russian Federation, and processing is governed by Russian Federal Law No. 152-FZ "On Personal Data". We do not direct the Service to the European Economic Area or the United Kingdom: we do not advertise there, do not offer local pricing or payment methods, and do not publish local-language versions for those markets. This Policy is therefore not a statement that the EU General Data Protection Regulation applies to us.

We do follow the principles the GDPR is built on, and we set them out here so you know what to expect:

• We process your email address and account data because it is necessary to provide the service you asked for.
• We rely on your consent for analytics cookies and for optional marketing messages. You can withdraw either at any time, without losing access to the Service.
• We rely on our legitimate interest in keeping the Service secure, preventing abuse, and answering requests you send us.
• We process data where the law we are subject to requires it.

Wherever you live, you can ask us to access, correct or delete your data. We handle every such request the same way, regardless of where you are — see Section 11.

5. Children's privacy

Vibo is made for an adult and a child to play together, with the adult present. Accounts are created and controlled by an adult aged 18 or over, who confirms at sign-up that they are the child's parent or legal guardian. The Service is not directed to children for independent, unsupervised sign-up.

We do not ask for, and do not knowingly collect, personal data from children. We do not collect a child's name, age, date of birth, photograph, voice, or contact details. Whatever a child creates in the Service is stored under the adult's account; there is no separate profile for the child.

Please do not enter personal details about your child — names, ages, locations or contact information — into game prompts or in-game dialogues.

Some countries require a parent's consent before a service may collect personal data from a child, for example the U.S. Children's Online Privacy Protection Act (COPPA). Our approach is to avoid collecting children's personal data at all, so that such collection does not take place.

If you believe a child has given us personal data, write to info@vibo.games and we will delete it. The adult who holds the account can review or delete everything stored under it at any time — see Section 11.

6. Third parties and AI processing

We do not sell personal data. We share data only as needed to operate the Service:

• Payment provider — processes payments for paid options. Card data is submitted directly to the payment provider and is not shared with or stored by us; we receive only the payment status.
• AI technology provider — to generate a game, we send the text of your prompt and chosen parameters, including descriptions of images (sprites, covers, patterns); for dialogues with in-game characters, we send the text of your messages in that dialogue. We do not send your account identifiers (such as your email address) to this provider. Please do not include personal data (names, contacts, and similar) in your game prompts or in-game dialogues.
• Sign-in provider (VK ID) — when you open the sign-in screen and when you authorize, it receives technical data from your browser (IP address, user-agent) and, with your authorization, passes us your identifier, name, and email address. The provider is located in the Russian Federation.
• Infrastructure and email delivery providers — hosting and email services process data strictly to operate the Service under appropriate confidentiality and data-protection terms.

7. Where data is processed

Personal data is stored and processed on servers located in the Russian Federation, where the Operator is established; email delivery is handled by a provider in the same country. We do not transfer personal data to other countries.

One clarification about AI generation: the text of your prompts and in-game dialogues is sent to our AI technology provider, whose infrastructure may be located elsewhere. That text is sent without any account identifiers (no email address, no user ID), so it is not accompanied by data identifying you — which is also why you should not include personal data in prompts or in-game dialogues (see Section 6).

8. Cookies and similar technologies

We use cookies and browser storage (localStorage, sessionStorage) in two categories. Strictly necessary ones are used without consent — the Service does not work without them. Analytics are loaded only after you agree in the banner shown on your first visit.

How to opt out. Choose "Decline" in the banner on your first visit and no analytics are loaded at all. You can change your mind later via the "Cookie settings" link at the bottom of any page. You can also block or delete cookies in your browser settings, but some features of the Service (such as signing in) may then not work correctly.

9. Data retention

We keep personal data only for as long as necessary to fulfill the purposes described in this Policy — typically for the life of your account and while required to provide the Service, resolve disputes, and comply with legal obligations. When data is no longer needed, we delete or anonymize it.

10. Your rights

Whatever your country, you can:

• Access — ask what personal data we hold about you and receive a copy;
• Correct — change your display name yourself in the profile, and ask us to fix anything else that is inaccurate;
• Delete — delete your account yourself in the app, or ask us to delete your data;
• Withdraw consent at any time — analytics cookies via "Cookie settings" in the footer, marketing messages and public display of your name via the profile toggles — without losing access to the Service and without affecting processing carried out before the withdrawal;
• Complain to the supervisory authority for personal data protection.

We do not sell personal data, and we will not treat you worse for exercising any of these rights.

11. How to exercise your rights

You can delete your account yourself in the app (Profile → Privacy & data): the data is deleted after a 14-day grace period, during which you can cancel by signing back in. To exercise any of the rights above, email us at info@vibo.games. We may need to verify your identity before responding, and we will reply within the timeframes required by applicable law.

12. Security

We apply appropriate organizational and technical measures to protect personal data against unauthorized access, alteration, disclosure, or destruction — including access controls, storing passwords as hashes, and transmitting data over encrypted connections (HTTPS).

13. Changes to this Policy

We may update this Policy from time to time. The current version is always available at vibo.games/en/privacy and takes effect when published. Material changes will be communicated where appropriate.

14. Contact