Pipplop Privacy Policy

DRAFT — pending legal review. This text has not been reviewed by a lawyer and is not yet in force. Items in [square brackets] are for the operator to fill in.

Last updated: [date]

This policy explains what personal information [Operator legal name] ("Pipplop", "we", "us") collects when you use the Pipplop platform at piplop.com and the Pipplop apps (the "Service"), how we use it, who we share it with, and the choices you have. It is part of the Terms of Service at piplop.com/terms.

1. Who Pipplop is for

Pipplop is for people 13 and older. We ask for a birth month and year at sign-up and refuse anyone under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has an account, email [email protected] and we will delete it.

2. What we collect

Information you give us

• Account details: your email address, handle, display name, and birth month and year. We use your birth month and year to work out your age group; we do not ask for your full date of birth.
• Sign-in through a provider: if you sign in with Google, Discord or Apple, we receive the provider's id for you, your email address and your name, as the provider shares them.
• Content you make: games, scripts, scenes, thumbnails, titles, descriptions, tags and version notes, and what you type to the AI builder.
• Reports and appeals: what you write when you report a player or game, or appeal a ban.
• Support messages: what you send to [email protected].
• Guest play: on the website you can play without an account after answering whether you are 13 or older. A guest account has a generated name and no email or birth date; it keeps your game progress so you can sign up later and keep it.

Information created as you use the Service

• Game activity: the games you play and when, likes, which server you are on, friends, friend requests, parties, blocks, private-server memberships, and your presence (online, or playing a game) shown to your friends.
• Saved game data: player data that games save for you, such as in-game money or progress.
• Purchases and credits: your credit balance and its history, credit packs you buy, items, passes, templates, plans and server tiers you buy, and refunds. Avatar items you own and the outfit you wear, which game servers show to other players. For Premium members, time spent in games is measured to split the monthly creator engagement pool.
• Creator data: sales and earnings, game analytics (plays, players, likes, sales, templates and ads), AI builder runs, and withdrawals.
• Ads: for rewarded ads, a record of each ad started and confirmed as watched, per game.
• Invites: when you open a link someone shared, we record who shared it, so they can see how many players they brought and earn avatar rewards. A first-party cookie (`pp_ref`) holds a random visitor id and the sharer for 30 days. To stop people rewarding themselves, we keep a one-way hash of the network you sign in from (not your IP address itself) for 30 days.
• Moderation records: reports, the results of automatic scans of published games, bans and appeals.
• Chat: text chat passes through game servers and an automatic filter. Game servers keep recent chat lines in memory; when someone reports a player in a game, the report includes the last 50 chat lines from that server.
• Voice: proximity voice is relayed live from your device to nearby players through the game server. We do not record or store voice. The microphone opens only when you hold the talk key.
• Technical data: your IP address, used while you are connected to apply rate limits and connect you to game servers, plus session cookies and sign-in tokens. We do not use advertising cookies on the website.

Information from payment and ad partners

• Stripe processes card payments on the web. We receive a record of the checkout and whether it was paid, not your full card number.
• Apple and Google process in-app purchases. We receive the purchase receipt to confirm it.
• Stripe Connect handles creator cash-out. Stripe collects the identity, tax and bank details it needs; we receive your connected-account id and whether payouts are enabled.
• Google AdMob serves rewarded ads in the Android app and tells us when an ad was watched. AdMob may collect device identifiers and other data under Google's own privacy policy.

3. How we use it

• To run the Service: accounts, sign-in, matchmaking, hosting games, friends, parties, saves and purchases.
• To keep people safe: filtering chat and names, scanning published games, handling reports, blocks and appeals, applying age-based defaults and limits, and preventing fraud, cheating and abuse.
• To pay creators and keep accurate financial records.
• To show creators analytics about their own games.
• To send you sign-in links and messages about your account or these policies. We do not send marketing email without asking you first.
• To fix problems and improve the Service.
• Where the law requires us to.

We do not sell your personal information, and we do not use it for targeted advertising.

4. What other people can see

Your handle, display name, games you publish, and (to friends) your online status and the game you are playing are visible to other users. Chat and voice reach the players in your game. Your email address and birth month and year are never shown to other users or sent to game servers; game scripts see only your name and an in-game id.

5. Who we share it with

We share personal information only with service providers that help us run the Service, under contracts that limit how they may use it, and where the law requires:

• Cloudflare: content delivery, security and DNS for piplop.com, and sending sign-in email.
• Hosting: our servers and database ([platform host, e.g. Fly.io or a VM provider], Neon for the database, Cloudflare R2 for game files), and OVHcloud for game servers.
• Payments: Stripe, Apple and Google, as above.
• Ads: Google AdMob, for accounts 16 and older only.
• AI: Anthropic, which provides the AI models behind the AI builder and may assist moderators by suggesting how to handle reports. What you type to the AI builder, and the content of reports sent for triage, go to Anthropic for that purpose. [Reviewer: confirm which AI features are on in production.]
• Sign-in providers: Google, Discord and Apple, when you choose to sign in with them.
• Legal and safety: to law enforcement or others when the law requires it, or when needed to protect someone's safety, including reports to child-safety authorities where required.
• Business transfers: if Pipplop is sold or merged, to the new owner under this policy.

6. Children and teens

Accounts under 18 are treated as teens: they get the strictest chat filter, and voice starts off; once turned on, it reaches nearby players unless they limit it to friends. Accounts under 16 see no ads. We do not cap spending by age; parents can use the app stores' and payment providers' parental controls. We do not use teens' data for targeted advertising.

7. How long we keep it

• We keep your account information until you delete your account. Guest accounts are deleted after 30 days without play.
• Invite visit records and sign-in network hashes are deleted after 30 days.
• Voice is never stored. In-game chat lines are held only in the game server's memory, except where they are attached to a report.
• Reports, moderation and ban records are kept as long as needed for safety [period]. If a banned account deletes itself, we keep a one-way hash (SHA-256) of each of its email addresses and sign-in identities, and when the ban ends, so the same sign-in cannot return until the ban would have ended; nothing else of the account is kept for this.
• Purchase, ledger and payout records are kept as long as tax and accounting law requires [period].
• Backups are overwritten on a rolling basis [period].

8. Deleting your account and your choices

• Delete your account at piplop.com/me, from the app (which links there), or with the API. Deletion removes your account, sign-ins, sessions, friends, blocks, pending sign-in links and saved player data. Your games stay on the platform without an owner and are made private. Records we must keep (section 7) are kept.
• Control voice and chat: turn voice off or limit it to friends, mute or block players, and report anything that breaks the rules.
• Access and correction: you can see your account details at piplop.com/me, and ask us for a copy of your data or to correct it by emailing [email protected].
• Your rights by region: depending on where you live (for example the EU, UK or California), you may have rights to access, correct, delete or port your data, to object to or restrict some uses, and to complain to a data protection authority. Email [email protected] to use them. We will not treat you differently for using them. [Reviewer: name the legal bases for processing and an EU/UK representative if required.]

9. Security

We store sign-in tokens only as hashes, send traffic over TLS, run games in a sandbox with no access to your device, and limit who on our team can reach personal data. No system is perfectly secure; if a breach affects you we will tell you as the law requires.

10. International transfers

We and our providers may process your information in the United States, the European Union and other countries. Where required, we use safeguards such as standard contractual clauses for those transfers.

11. Changes to this policy

We may update this policy. If a change is significant we will tell you in the Service or by email before it takes effect.

12. Contact

Questions or requests about your privacy: [email protected]. [Operator legal name and postal address.]