• Account: your username, your password (stored only as a secure hash by our sign-in provider) and your recovery code (stored only as a hash).
• Sign-in security log: the IP address and country you connect from, and your device/browser type, each time you sign in from a new address.
• In-world activity: your avatar and outfits, Kredit balance, purchases, property, trades, jobs, casino results and limits, and chat messages.
• Payments: when you top up with ETH, the wallet address you paid from and the transaction hash. These are public on the Ethereum blockchain.
• Optional: a gender identity you choose in the avatar creator. It is only ever shown to you.
• Sponsors: brand name, website and logo you add to a sponsor profile (shown publicly on your ads).

• To run your account and the shared city, and keep your Kredits and property safe.
• IP address and country: to protect accounts, stop fraud, ban evasion and multi-account abuse, and enforce bans.
• To check ETH payments and credit your Kredits.
• To moderate chat and public content (plot pages, board messages, wall tags) and keep the city safe.

• Other residents see your username (or world name), avatar, chat, the things you choose to make public (plots, tags, board lines, ads) and recent public purchases in the city feed. They see a wealth tier and Status level, never your balance.
• City Hall staff (administrators) can see account details, the sign-in security log (IP and country) and activity, to moderate and support the city.
• Service providers that host the app and database process data for us. Ethereum transactions are public by design.
• We share data with authorities only when the law requires it.

Account and in-world data are kept while your account exists. Sign-in security logs are kept for up to 12 months. Payment records are kept as long as needed for accounting and fraud checks.

• You can change your avatar, outfits and public plot pages at any time.
• You can ask us for a copy of your data, to correct it, or to delete your account by contacting us. Some records (like payments) may be kept where the law requires.

We use your browser's storage to keep you signed in and remember settings like sound and the last room you were in. We don't use advertising trackers.

Vaybox is for people aged 18 and over.

If we change this policy we'll update the date at the top. Questions or requests: legal@vaybox.com.