Privacy policy

Gwislab publishes Camer Vibes and is responsible for your personal data (the data controller). Legal name and form: [to be completed before launch]. Registered address: [to be completed before launch]. Registration number: [to be completed before launch].

Privacy contact: [to be completed before launch]. You can write to us at [email protected].

Our reference is the law of Cameroon on personal data and cybersecurity. Because some players and our servers are in Europe, we also follow the principles of the European GDPR.

We collect only what the game needs. This is the full list, by what you do.

• Your account. A username (visible to other players), a password (we keep only an irreversible argon2id hash, never the password itself), your language, and the date and version of the terms you accepted.
• Your confirmation that you are 18 or older. The tick box is required to sign up, and we record when you ticked it.
• Optional contact details. A phone number and/or an email address. We verify each with a code or a link before we keep it. They let you recover your account and receive security notices and receipts. Without one of them, nobody can recover a forgotten password.
• Optional date of birth. If you give it, it must show that you are 18 or older, and it cannot be changed afterwards without proof. We use it only to apply age rules.
• Optional location. A Cameroonian region (or “outside Cameroon”) and a free-text address or neighbourhood. It is private: it is never shown to other players. We use it to know where our players play from. The address is stored encrypted, and you can clear it in your account at any time.
• Your character and gameplay. Your Camer's name and look, home city, needs, job, skills, inventory, homes, land, vehicles, progress, achievements, scores and the actions you take in the world.
• Your wallet. Every change to your vCFA and Coins balances is recorded in a ledger (what, when, why). The ledger is how we keep the game's money honest.
• Messages, posts and reports. What you write in chat, direct messages, njangi groups, clubs and posts, and the reports and blocks you make.
• Purchases. If you buy Coins: the order, the amount, the type of payment method, a reference from the payment provider and, at most, a masked identifier (such as the last digits). Never the full card number or a PIN.
• Feedback. The bug reports and suggestions you send, with the details you type.

Please do not put sensitive personal information in chat, in your address or in free-text fields: other people may see some of it, and the game does not need it.

If you choose “Sign in with Google”, Google tells us your name, your verified email address and a stable Google account identifier. We never receive your Google password.

We use them to create or find your Camer Vibes account, to link the two and to recognise you next time. A new account is created only after you choose a username and confirm that you are 18 or older. If an account with the same verified email already exists, we do not merge them automatically: you sign in the usual way and link Google yourself in Settings.

You can link or unlink Google in Settings, in your account (it asks for a fresh confirmation and sends you a security notice). Google handles its part under its own privacy policy. The Google sign-in script is loaded only where the feature is switched on.

The game is a persistent world. To run it we keep your character's state on our servers: where you are, what you own, what you earned and spent, your jobs, your homes and your progress.

vCFA and Coins. vCFA is earned and spent in the game. Coins are bought with real money (when purchases are open) and can be converted, one way, into vCFA. Neither can ever be cashed out or converted back into real money, and the ledger records every movement. See the terms of use.

Payments. Real-money purchases are handled by a separate Payment Microservice and its card and Mobile Money partners. They collect your card or Mobile Money details on their own screens. We never see or store your full card number, PIN or one-time codes. They send us a signed confirmation, we credit your Coins once, and we keep the order and the payment reference.

Gifts. Gifting Coins is only possible between friends who are both adults, within limits. Gifts are recorded in the ledger.

Age checks on money. Our server checks that you are 18 or older before any real-money purchase or Coins gift. The screen may hide buttons, but the server decides.

Camer Vibes is a social game. This is what other players can and cannot see.

• Your public profile. Your username, your Camer's name and look, and what you do in shared places. Your phone number, email, date of birth, region and address are never shown to other players.
• Presence. While you play, a real-time server knows which district and place your Camer is in, so that others nearby can see you move. It holds this only while you are online, and it never holds money.
• Who can see where I am. In Settings you choose whether your friends see your district and place, or nobody does (friends still see that you are online).
• Collapse alerts. Two switches decide whether your friends are alerted when you collapse, and whether you receive alerts when a friend does.
• Leaderboards. “Show me on leaderboards” controls whether your name and portrait appear in rankings. When it is off, you still see your own rank.
• Messages. Chat and direct messages are checked automatically before they are shown, to block insults, scams, links, phone numbers and talk of real-money trading. Friend and message requests are yours to accept or decline, and you can block anyone.
• Reports and moderation. When a message, player, name or build is reported, our moderators can see the reported item, the messages around it, the account's age and its sanctions history, and decide what to do (warn, mute, rename, suspend). Reports and actions are logged.

Some townsfolk and workers in the game are virtual characters run by the game. They are not people, and they do not collect extra data about you.

When you use the site and the game, our servers receive technical data: your IP address, browser and device type, language, the pages and requests you make, errors and timestamps. We use it to deliver the game, to limit abuse (rate limits), to detect suspicious sign-ins and fraud, and to fix bugs.

For each sign-in session we keep the time, the IP address and the browser or device details, so that you can see and revoke your sessions and so that we can spot account theft. Security-relevant actions (changing a password, linking Google, moderation decisions) are written to an audit log.

A random identifier is kept in your browser so that we can tell requests from the same device apart, for security and fraud prevention. It contains no personal information.

Our network provider (Cloudflare) processes traffic to protect and speed up the site.

We use few cookies and similar storage. All are necessary to run the game, except Google Analytics, which runs only after you accept.

• cv_rt (cookie, necessary): the refresh token that keeps you signed in. It is httpOnly (page scripts cannot read it), is sent only to our API and is replaced each time it is used. It lasts up to 30 days.
• cv_locale and NEXT_LOCALE (cookies, necessary): your language choice, for up to one year.
• Browser storage (localStorage and sessionStorage, necessary): your short-lived access token for the tab, a “signed in” hint, your theme (light, dark or system), language, display and sound settings, tutorial and tour progress, and small conveniences such as drafts and shopping carts. It stays on your device. You can clear it in your browser, or with “Clear cached data and reload” in Settings.
• Offline cache: the app can be installed and keeps files in the browser cache so that it loads faster and works offline.
• Google Analytics (cookies named _ga and _ga_ followed by an identifier, optional): only if you accept the analytics card. We measure page views and a few game milestones with no personal data (never your username, email, phone, user id, amounts, messages or location). Ads and Google signals are off, IP addresses are anonymised, and data is kept for 2 months. Change your mind at any time in Settings, under Analytics: it stops sending and deletes the cookies.

We use no advertising cookies or trackers. If your browser sends Do Not Track or Global Privacy Control, we treat it as a refusal: no analytics is loaded and no question is asked.

We use your data for the purposes below. The legal basis, where the GDPR asks for one, is in brackets.

• To create and secure your account, sign you in and let you recover it (contract; our legitimate interest in security).
• To run the game: your character, the world, the economy and the multiplayer features (contract).
• To process purchases and keep accounting records (contract; legal obligation).
• To keep players safe: moderation, age checks, anti-fraud, anti-cheating and enforcing the terms (legitimate interest; legal obligation).
• To send you service messages: verification codes, security notices, receipts and in-game notifications in your language (contract; legitimate interest).
• To understand how the game is used and improve it, with Google Analytics, only if you accept (consent).
• To know broadly where our players play from, using your optional region (consent, which you can withdraw by clearing it).
• To answer you when you write to us and to comply with the law (legitimate interest; legal obligation).

We do not sell your personal data and we show no advertising. Automatic checks on messages and payments can block a message or hold a payment; you can ask for a person to look at the decision.

Only the people who need it see your data: our team under confidentiality, with access limited to what each role requires and an audit log of staff actions. Outside the company we share it only with:

• Hosting and network: our server provider (Hetzner, Germany) and Cloudflare, who deliver the site.
• Payment partners: the Payment Microservice and the card and Mobile Money operators, for purchases and refunds.
• Message delivery: the email and SMS providers that send your codes and notices (they receive your address or number and the message).
• Google: for “Sign in with Google” if you use it, and for Google Analytics if you accept it.
• Authorities and advisers: when the law requires it, on a valid request, or to protect people; and our lawyers and accountants, under confidentiality.

If the company is sold or reorganised, your data may pass to the new owner, who must respect this policy. Other players see only what is described under chat, friends and leaderboards above.

Our servers are in Germany (Hetzner, Falkenstein), behind Cloudflare. Your data is therefore stored and processed in the European Union, which means that data of players in Cameroon leaves Cameroon.

We follow the rules of applicable Cameroonian law on sending personal data abroad, and the GDPR safeguards for European players: the European level of data protection, written agreements with our providers (including standard contractual clauses for providers outside the EU or EEA, such as Google) and sending only what is needed.

We keep data only as long as we need it. These are our periods; we may keep something longer when the law requires it, or to handle a dispute or a security case.

• Account details (username, contacts, date of birth, region, address): while your account exists, then removed within 30 days after it is deleted.
• Character, gameplay and inventory data: while your account exists. After deletion your character becomes an anonymous “Former Camer”.
• Sign-in sessions and IP addresses: 90 days; the IP address is shortened after 30 days.
• Chat messages: 90 days. Messages that were reported: 1 year. Messages stopped by the automatic filter: 30 days.
• Reports and moderation actions: 2 years.
• Orders and payment references: usually 10 years, the period required by accounting and tax law.
• Wallet ledger: kept for the life of the game to keep the economy honest, and anonymised when your account is deleted.
• Support requests: 2 years.
• Google Analytics data (only if you accepted): 2 months.

Under the data-protection law applicable in Cameroon and, for people in Europe, the GDPR, you have the right to:

• know what data we hold about you and receive a copy (access);
• correct data that is wrong or incomplete (most of it you can edit in your account);
• have your data deleted and your account closed (erasure);
• receive your data in a usable format (portability);
• object to or limit some uses of your data, and withdraw a consent at any time;
• ask for a person to review an automated decision;
• complain to the data-protection authority of your country (in Cameroon, the competent authority; in the EU, your national authority).

How. Write to [email protected] from the email address on your account, or with your username and a way for us to check that it is you. We answer within 30 days. It is free unless a request is clearly abusive. We may ask for proof of identity.

Deleting your account and exporting your data. For now, both are done on request to the address above (a self-service button in Settings is planned). We confirm your request and wait 14 days, during which you can cancel. Then your personal data is erased, your character is anonymised, land and houses go back to the market or the system, njangi obligations are settled first according to the group's rules, and orders are kept in anonymised form for the legal period. Coins left on the account are forfeited after the 14 days unless the law says otherwise; we tell you your balance before you confirm.

Analytics is yours to switch on or off at any time in Settings.

• Passwords are stored only as an argon2id hash.
• Connections use HTTPS. The refresh cookie is httpOnly and rotates at every use; if an old one is replayed, the whole session family is revoked.
• Your optional address is stored encrypted.
• Staff access is limited by role, sensitive actions need a second approval, and staff actions are logged.
• Age and money rules are checked on the server, not only on your screen.

No system is perfectly secure. If a breach puts your data at risk, we will tell you and the authority as the law requires. Please choose a strong, unique password and never share your codes. To report a vulnerability, write to [email protected].

Camer Vibes is for people aged 18 or older, to sign up, to play and to buy. We do not knowingly collect data from anyone under 18. Signing up requires you to confirm that you are 18 or older, and an optional date of birth must show 18 or more.

If we learn that someone under 18 has an account, we close it, erase the data and refund unspent paid Coins where applicable. If you think a minor is using the game, tell us at [email protected].

We may update this policy when the game, our providers or the law change. The date at the top shows the last update. For important changes we tell you in the game or by email before they apply, when we can, and where the law requires it we ask for your agreement again. Earlier versions are available on request.

Questions, requests and complaints: [email protected].

Publisher: Gwislab ([to be completed before launch]), [to be completed before launch]. Registration number: [to be completed before launch]. Privacy contact: [to be completed before launch].

See also the terms of use.