Privacy Policy

1. Who we are

This Privacy Policy explains how Vestosia ("Vestosia", "we", "us", or "our") collects and uses personal data when you use the Vestosia website, web application at vestosia.com, or mobile apps (the "Service").

We are the data controller for personal data processed in connection with the Service, and are based in the United Kingdom.

Privacy contact: [email protected]. Legal enquiries: [email protected].

This Policy should be read together with our Terms of Service. Using the Service does not by itself mean you "consent" to every processing activity described here. Where UK law requires consent (for example for certain cookies), we ask for it separately.

2. Personal data we collect

2.1 Information you provide

• Account data: email address, username, password (stored as a secure hash), and details from Google sign-in if you choose that option.
• Profile data: display name, bio, avatar, optional phone number, date of birth (used for age eligibility and age-appropriate features), and profile privacy settings.
• User content: games, code, assets, thumbnails, comments, reports, appeals, and other materials you upload or create.
• Cloud saves: in-game progress stored with your account. History is a listing of those saves; pause, clear, and remove hide it. Progress remains until you delete your account.
• AI inputs: prompts, images, and related instructions you submit to Vibecoding.
• Communications: messages you send via our contact form or support email, including your name and email address.

2.2 Information collected automatically

• Technical and usage data: IP address, browser type, device and operating system information, pages viewed, referral URLs, and approximate location derived from network or CDN headers where available (for example country).
• First-party service metrics (needed to operate the Service, including for guests who play without signing in): game play activity for popularity and capacity, coarse session activity for growth and reliability, and diagnostic signals such as load/runtime errors. These do not include fingerprints, search history, interest profiles, or behavioural advertising signals.
• Gameplay and product analytics (when you allow optional analytics): richer session activity, gameplay duration and interactions, search history, interest signals used for recommendations, sampled browser page and interaction timings, and a device fingerprint hash used to recognise returning sessions and reduce abuse.
• Security signals: Google reCAPTCHA scores and related bot-protection data on signup and contact forms.
• Error monitoring: diagnostic information about crashes or errors, which may include device and request context, when error monitoring is enabled.

2.3 Information from third parties

If you sign in with Google, we receive basic account identifiers and profile information from Google as permitted by your Google account settings and Google's policies.

3. How we use personal data and our lawful bases

Under the UK GDPR we need a lawful basis for each purpose. The main bases we rely on are: contract (to provide the Service you request), legitimate interests (where our interests are not overridden by your rights), consent (where we ask and you can withdraw), and legal obligation.

Our legitimate interests include operating a secure, reliable game platform, preventing abuse, improving features, and communicating with users about their accounts. You may object to processing based on legitimate interests in certain cases (see Section 9).

4. Cookies and similar technologies

We use cookies, local storage, and similar technologies. Strictly necessary technologies do not require consent. Optional analytics and personalised-ads storage require your consent under PECR / UK GDPR. You can Accept, Reject, or Manage choices in our cookie banner, and change optional preferences later in account Settings (Privacy).

Device fingerprinting used for analytics or abuse prevention in connection with optional tracking is treated as a similar technology and is only used when analytics is allowed, except where strictly necessary for security.

5. Who we share data with

We do not sell your personal data. We share personal data with service providers who process it on our instructions, and in other limited cases below.

• Google: sign-in (OAuth), Gemini AI for Vibecoding, and reCAPTCHA.
• Google Cloud Storage: storage of media and game assets.
• Email delivery provider (for example Gmail SMTP): transactional email.
• Error monitoring providers (for example Sentry, when enabled): crash and error diagnostics.
• Hosting and infrastructure providers that run our servers, database, and cache.
• Professional advisers and authorities where required by law or to protect rights, safety, and security.
• Business transfers: if we reorganise or transfer assets, personal data may be disclosed under appropriate confidentiality and continuity arrangements.

Some providers are located outside the UK. See Section 7 on international transfers.

6. How long we keep data

We keep personal data only as long as needed for the purposes above, including legal, accounting, and security needs. Typical periods:

• Account and profile data: for as long as your account remains active, then deleted or anonymised within a reasonable period after deletion (subject to backups and legal holds).
• User content: until you delete it or your account is deleted, unless we must retain it for moderation, dispute, or legal reasons.
• Analytics and session events: typically retained for about 30 days, then deleted.
• Session records: typically retained for about 90 days, then deleted.
• Aggregates and public play counts: non-identifying platform aggregates (for example game popularity counters and growth summaries) may be kept longer.
• Support correspondence: typically up to 24 months after the matter is closed.
• Security and server logs: typically up to 12 months, longer if needed to investigate incidents.

Backups may retain residual copies for a short additional period until rotated.

7. International transfers

We are based in the United Kingdom. Some providers (including Google and other cloud or monitoring services) may process data in the United States or other countries.

Where we transfer personal data from the UK to a country without an adequacy regulation, we use appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses, or another mechanism permitted under UK GDPR. You can contact us for more information about these safeguards.

8. Security

We use technical and organisational measures designed to protect personal data, including encrypted transport (HTTPS), hashed passwords, access controls, and secure cloud storage. No method of transmission or storage is completely secure; please use a strong unique password and keep your credentials confidential.

9. Your rights

Under UK GDPR you have rights including:

• Access — request a copy of personal data we hold about you;
• Rectification — correct inaccurate data;
• Erasure — ask us to delete data in certain circumstances (you can also delete your account in Settings);
• Restriction — ask us to limit processing in certain cases;
• Objection — object to processing based on legitimate interests;
• Portability — receive certain data in a portable format;
• Withdraw consent — where processing is based on consent (for example optional analytics or personalised ads). Withdrawing stops future optional collection and we delete or anonymise optional personalisation/profiling data linked to your account (such as interest profiles, fingerprints, and related analytics-session history). Strictly necessary service metrics and non-identifying aggregates are retained as described in Section 6.

To exercise these rights, email [email protected]. Account deletion is available in Settings. We do not yet offer a self-serve data export download; for access or portability requests, contact the privacy address and we will respond as required by law.

We may need to verify your identity before fulfilling a request. We aim to respond within one month, or longer where permitted for complex requests.

9.1 Complaints to us (Data Use and Access Act)

You can complain to us about how we handle your personal data by emailing [email protected]. Please describe the issue and any relevant dates or account details. We will acknowledge your complaint within 30 days and respond without undue delay.

9.2 Complaints to the ICO

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO). See ico.org.uk/make-a-complaint. We would appreciate the chance to address your concerns first.

10. Children

The Service is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, contact [email protected] and we will take steps to delete it.

11. California and other US state notices

If you are a California resident, you may have rights under the CCPA/CPRA to know, delete, and correct certain personal information, and to non-discrimination for exercising those rights. We do not sell personal information as that term is commonly understood. To make a request, contact [email protected].

12. Changes to this Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top shows the latest revision. For material changes, we will take reasonable steps to notify you (for example by email or an in-Service notice).

13. Contact

• Privacy: [email protected]
• Legal: [email protected]