Privacy policy (how we keep ya private tins)

Gwislab na di one wey publish Camer Vibes and e di answer for ya personal data (di data controller). Ofishal name and kind of company: [we go put am before we launch]. Address: [we go put am before we launch]. Registration number: [we go put am before we launch].

Who yu fit tok to for privacy matter: [we go put am before we launch]. Yu fit write to us for [email protected].

Di law wey we di follow na Cameroon law for personal data and cybersecurity. As some players and our servers dey for Europe, we di follow di principles of European GDPR too.

We di take only wetin di game need. Na dis di full list, according to wetin yu di do.

• Ya account. Username (wey odas players go see), password (we di keep only one hash wey nobody fit open again, argon2id, we no di keep di password itself), ya language, and di date and version of di rules wey yu agree.
• Ya confirm say yu don reach 18 years or pass. Di box na must to open account, and we di write di time wey yu tick am.
• Contact wey yu fit give or no give. Phone number and/or email. We di check each one with code or link before we keep am. Dem help yu take back ya account and get security message and receipt. If yu no get one of dem, nobody fit help yu if yu forget password.
• Birthday (if yu want). If yu give am, e must show say yu don reach 18 years or pass, and nobody fit change am again without proof. We di use am only for age rules.
• Where yu dey (if yu want). One region for Cameroon (or “outside Cameroon”) and address or kontri-side wey yu write. Na private: we no di show am to odas players. We di use am only to know where our players di play from. We di keep di address locked (encrypted), and yu fit clear am for ya account any time.
• Ya character and how yu di play. Name and look of ya Camer, home town, needs, work, skills, things wey e get, houses, land, motor, progress, achievements, scores and wetin yu di do for di world.
• Ya wallet. Every time ya vCFA and Coins change, we di write am for one ledger (wetin, when, why). Na so we di keep game money straight.
• Messages, posts and reports. Wetin yu write for chat, private messages, njangi groups, clubs and posts, and di reports and blocks wey yu make.
• Buying. If yu buy Coins: di order, di amount, kind of payment way, one reference from di payment company and, at most, one hide number (like di last digits). Never di full card number or PIN.
• Feedback. Bug reports and suggestions wey yu send, with di details wey yu write.

Abeg no put heavy private tins for chat, for ya address or for di free-write boxes: odas people fit see some of am, and di game no need am.

If yu choose “Sign in with Google”, Google go tell us ya name, ya verified email and one steady Google account number. We no di ever get ya Google password.

We di use dem to open or find ya Camer Vibes account, join di two and know yu next time. We go open new account only after yu choose username and confirm say yu don reach 18 years or pass. If account with di same verified email don dey, we no di join dem by ourselves: yu go sign in di normal way and join Google yoursef for Settings.

Yu fit join or comot Google for Settings, for ya account (e go ask yu confirm again and send yu security message). Google di handle ya part under ya own privacy policy. We di load di Google sign-in script only where di feature dey on.

Di game na world wey di stay on. To run am, we di keep ya character state for our servers: where yu dey, wetin yu get, wetin yu make and spend, ya work, ya houses and ya progress.

vCFA and Coins. vCFA, yu di make am and spend am for di game. Coins, yu di buy dem with real money (when buying dey open) and yu fit change dem, one way only, to vCFA. None of dem fit ever comot as cash or turn back to real money, and di ledger di write every move. Look di rules for use am.

Payments. Real-money buying dey pass through one separate Payment Microservice and ya card and Mobile Money partners. Dem di take ya card or Mobile Money details for dem own screen. We no di see or keep ya full card number, PIN or one-time codes. Dem go send us one signed confirm, we go put ya Coins one time, and we go keep di order and di payment reference.

Gifts. To give Coins as gift, na only between friends wey two of dem be grown-up, with limit. Di gifts dey for di ledger.

Age check for money matter. Our server di check say yu don reach 18 years or pass before any real-money buying or Coins gift. Di screen fit hide buttons, but na di server di decide.

Camer Vibes na social game. Na dis odas players fit see and wetin dem no fit see.

• Ya public profile. Ya username, name and look of ya Camer, and wetin yu di do for places wey everybody share. Ya phone number, email, birthday, region and address, we no di ever show am to odas players.
• Presence. When yu di play, one real-time server di know which district and place ya Camer dey, so people wey near fit see yu di waka. E di hold am only when yu dey online, and e no di hold money.
• Who fit see where I dey. For Settings yu go choose if ya friends fit see ya district and place, or nobody (friends go still see say yu dey online).
• Collapse alert. Two switch di decide if ya friends go hear when yu collapse, and if yu go hear when friend collapse.
• Leaderboards. “Show me on leaderboards” decide if ya name and picture go show for rankings. If e off, yu go still see ya own rank.
• Messages. Chat and private messages, machine di check dem before dem show, to block insult, scam, link, phone number and talk of real-money trading. Friend and message requests na yours to accept or refuse, and yu fit block anybody.
• Reports and moderation. When dem report message, player, name or build, our moderators fit see wetin dem report, di messages around am, how old di account be and di sanctions before, and decide wetin to do (warn, mute, change name, suspend). Dem di write reports and actions.

Some townsfolk and workers for di game na virtual characters wey di game di run. Dem no be people, and dem no di take extra data about yu.

When yu di use di site and game, our servers di get technical data: ya IP address, kind of browser and phone, language, pages and requests, errors and time. We di use am to run di game, to stop abuse (rate limits), to catch strange sign-ins and fraud, and to fix bugs.

For every sign-in session we di keep di time, di IP address and di browser or phone details, so yu fit see and cancel ya sessions and so we fit see if person steal account. Security actions (change password, join Google, moderation decisions) dem di write for one audit log.

We di keep one random number for ya browser so we fit know requests wey come from di same phone, for security and to stop fraud. E no get any personal information.

Our network company (Cloudflare) di handle traffic to protect di site and make am fast.

We di use small cookies and similar storage. All na must to run di game, except Google Analytics, wey di run only after yu agree.

• cv_rt (cookie, must): di refresh token wey di keep yu sign in. E na httpOnly (page scripts no fit read am), e di go only to our API and dem di change am every time wey dem use am. E fit stay reach 30 days.
• cv_locale and NEXT_LOCALE (cookies, must): di language wey yu choose, reach one year.
• Browser storage (localStorage and sessionStorage, must): ya short-time access token for di tab, one “signed in” sign, ya theme (light, dark or system), language, display and sound settings, tutorial and tour progress, and small tins like drafts and shopping carts. E di stay for ya phone. Yu fit clear am for ya browser, or with “Clear cached data and reload” for Settings.
• Offline cache: yu fit install di app and e di keep files for browser cache so e go load fast and work even when network no dey.
• Google Analytics (cookies wey get name _ga and _ga_ with one number after, no be must): only if yu accept di analytics card. We di count page views and few game steps without personal data (never ya username, email, phone, user id, amounts, messages or where yu dey). Ads and Google signals off, IP addresses dem di hide am, and di data di stay 2 months. Yu fit change ya mind any time for Settings, for Analytics: e go stop to send and delete di cookies.

We no di use advertising cookies or trackers. If ya browser send Do Not Track or Global Privacy Control, we go count am as refuse: no analytics go load and we no go ask yu.

We di use ya data for dis reasons. Di legal reason, where GDPR ask for am, dey inside bracket.

• To open and protect ya account, make yu sign in and take am back (contract; our right to protect security).
• To run di game: ya character, di world, di economy and di multiplayer tins (contract).
• To process buying and keep accounts (contract; law say so).
• To keep players safe: moderation, age check, anti-fraud, anti-cheat and to follow di rules (our right; law say so).
• To send yu service messages: verification codes, security messages, receipts and game notifications for ya language (contract; our right).
• To understand how people di play and make di game better, with Google Analytics, only if yu agree (consent).
• To know small small where our players di play from, with ya region if yu give am (consent, wey yu fit take back by clearing am).
• To answer yu when yu write to us and to follow di law (our right; law say so).

We no di sell ya personal data and no ads dey. Machine check for messages and payments fit block message or hold payment; yu fit ask make person look di decision again.

Na only people wey need am di see ya data: our team wey promise to keep secret, with access wey small to wetin dia work need, and log of wetin staff do. Outside di company, we di share am only with:

• Hosting and network: our server company (Hetzner, Germany) and Cloudflare, wey di carry di site reach yu.
• Payment partners: di Payment Microservice and di card and Mobile Money operators, for buying and refund.
• Message sending: di email and SMS companies wey di send ya codes and messages (dem di get ya address or number and di message).
• Google: for “Sign in with Google” if yu use am, and for Google Analytics if yu agree.
• Authorities and advisers: when law say so, for correct request, or to protect people; and our lawyers and accountants, wey promise to keep secret.

If dem sell di company or change how e dey, ya data fit go to di new owner, wey must follow dis policy. Odas players go only see wetin we talk above for chat, friends and leaderboards.

Our servers dey for Germany (Hetzner, Falkenstein), behind Cloudflare. So ya data dey and dem di work am for European Union, wey mean say data of players for Cameroon di comot Cameroon.

We di follow di rules of Cameroon law wey apply for sending personal data go outside, and GDPR protection for European players: di European level of data protection, written agreement with our providers (including standard contract clauses for providers outside EU or EEA, like Google) and to send only wetin we need.

We di keep data only as long as we need am. Na dis our times; we fit keep something pass dis if law say so, or to settle palava or security case.

• Account details (username, contacts, birthday, region, address): as long as ya account dey, then we go remove am inside 30 days after dem delete am.
• Character, game and things-wey-yu-get data: as long as ya account dey. After delete, ya character go turn “Former Camer” wey nobody know.
• Sign-in sessions and IP addresses: 90 days; we go cut di IP address short after 30 days.
• Chat messages: 90 days. Messages wey dem report: 1 year. Messages wey di machine filter stop: 30 days.
• Reports and moderation actions: 2 years.
• Orders and payment references: normally 10 years, di time wey accounting and tax law want.
• Wallet ledger: we di keep am as long as di game dey to keep di economy straight, and we go hide who e belong to when dem delete ya account.
• Support requests: 2 years.
• Google Analytics data (only if yu agree): 2 months.

According to di data-protection law wey apply for Cameroon and, for people for Europe, di GDPR, yu get di right to:

• know wetin data we get about yu and get one copy (access);
• correct data wey wrong or no complete (yu fit change most of am for ya account);
• delete ya data and close ya account (erasure);
• get ya data for format wey yu fit use (portability);
• refuse or limit some use of ya data, and take back consent any time;
• ask make person look again one decision wey machine make;
• complain to di data-protection authority for ya kontri (for Cameroon, di authority wey get di power; for EU, ya national authority).

How. Write to [email protected] from di email wey dey for ya account, or with ya username and one way for us to check say na yu. We go answer inside 30 days. E no cost anything, except if di request na plain abuse. We fit ask for proof of who yu be.

To delete ya account and carry ya data. For now, both na by request to di address above (we dey plan one button for Settings so yu fit do am yoursef). We go confirm ya request and wait 14 days, wey yu fit cancel inside. After dat, we go delete ya personal data, hide who ya character be, land and houses go back to di market or di system, njangi matter dem go settle first according to di group rules, and orders go stay without name for di time wey law want. Coins wey remain for di account go finish after dem 14 days, except law say different; we go tell yu ya balance before yu confirm.

Analytics na yours to put on or off any time for Settings.

• We di keep passwords only as argon2id hash.
• Connections di use HTTPS. Di refresh cookie na httpOnly and e di change every time e dem use am; if person try use old one again, we go cancel all di sessions.
• Ya address (if yu give am) dey locked (encrypted).
• Staff access small small according to dia work, sensitive actions need second person to agree, and wetin staff do dem di write am.
• Age and money rules dem di check for di server, no be only for ya screen.

No system dey 100% safe. If breach put ya data for danger, we go tell yu and di authority as law say. Abeg choose strong password wey nobody else di use and never share ya codes. If yu see weak point, write to [email protected].

Camer Vibes na for people wey don reach 18 years or pass, to open account, to play and to buy. We no di knowingly take data from anybody wey no reach 18. To open account, yu must confirm say yu don reach 18 years or pass, and birthday wey yu give must show 18 or more.

If we hear say person wey no reach 18 get account, we go close am, delete di data and refund unspent paid Coins where e apply. If yu think say pikin dey use di game, tell us for [email protected].

We fit change dis policy when di game, our providers or di law change. Di date for top show di las time. For big changes, we go tell yu for di game or by email before dem start, if we fit, and where law say so, we go ask yu agree again. Old versions dey if yu ask.

Questions, requests and complaints: [email protected].

Publisher: Gwislab ([we go put am before we launch]), [we go put am before we launch]. Registration number: [we go put am before we launch]. Privacy contact: [we go put am before we launch].

Look di rules for use am too.