Privacy Policy

Last updated: October 19, 2026

Vibe Tower ("we," "our," or "us") is developed and operated by Volodymyr Shmidt. This Privacy Policy explains what information we collect when you use the Vibe Tower mobile application ("the App"), how we use it, and your rights regarding that information.

Information We Collect

When you create an account and use the App, we collect:

Account information — your email address and username when you register with email, or your Google account name and email when you sign in with Google.
Game data — your tower progress, unlocked floors, coin and gem balances, purchases, achievements, tournament history, and gameplay statistics.
Device information — device model, operating system version, and app version, used for troubleshooting and compatibility.

How We Use Your Information

To create and manage your account.
To sync your game progress across devices and sessions.
To authenticate your identity securely (Google OAuth, email + password).
To send transactional emails — account confirmation, password reset links, and welcome messages.
To respond to your support requests.
To operate tournament and leaderboard features that compare scores across players.

Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data on the following legal bases:

Performance of a contract — processing necessary to provide the App and its features to you.
Legitimate interests — processing necessary for our legitimate interest in operating and improving the App, preventing fraud, and ensuring security.
Legal obligation — where we are required to process data under applicable law.
Consent — where we have obtained your explicit consent, which you may withdraw at any time without affecting prior processing.

What We Don't Do

We do not sell your personal data to third parties.
We do not serve third-party advertising.
We do not share your information with anyone except the infrastructure services required to run the App (see below).

Third-Party Services

We use the following third-party services to operate the App. Each has its own privacy policy governing data it processes.

Google Sign-In (OAuth 2.0) — used as an optional authentication method. Google's privacy policy applies to the sign-in flow.
Resend — used to deliver transactional emails (password reset, welcome). Only your email address is shared for delivery.
Sentry — used for crash reporting and error monitoring. Sentry may receive error details, device information, and anonymized user identifiers to help us diagnose and fix issues. See sentry.io/privacy.
Cloud infrastructure — our server, database (PostgreSQL), and cache (Redis) are hosted on secure cloud infrastructure. No personal data is shared with the provider beyond what is needed to run the service.

Data Retention

Your account data and game progress are retained for as long as your account remains active. If you delete your account or request deletion, we remove your personal information within 30 days, except where retention is required by law.

International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that differ from those in your country. Where we transfer personal data from the EEA, UK, or Switzerland to a country not recognised as providing an adequate level of data protection, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission.

Children's Privacy

The App is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us and we will delete it promptly.

Your Rights

Depending on your location, you may have the following rights:

Right of access — request a copy of the personal data we hold about you.
Right to rectification — request correction of inaccurate or incomplete data.
Right to erasure ("right to be forgotten") — request deletion of your personal data under certain circumstances.
Right to restriction — request that we limit how we use your data.
Right to data portability — receive your data in a structured, machine-readable format.
Right to object — object to processing based on our legitimate interests.
Right to withdraw consent — withdraw consent at any time without affecting prior processing.
Right to lodge a complaint — contact your local data protection authority.

To exercise any of these rights, contact us at privacy@vibetower.app. We will respond within 30 days.

California Privacy Rights (CCPA/CPRA)

If you are a California resident, the CCPA as amended by the CPRA grants you additional rights:

Right to Know — request disclosure of the categories and specific pieces of personal information we collect, use, and disclose about you.
Right to Delete — request deletion of your personal information, subject to certain exceptions.
Right to Correct — request correction of inaccurate personal information.
Right to Opt-Out of Sale — we do not sell your personal information.
Right to Non-Discrimination — we will not discriminate against you for exercising your CCPA rights.

To exercise your rights, contact us at privacy@vibetower.app.

Security

We use industry-standard practices to protect your information, including encrypted connections (HTTPS), hashed passwords, and short-lived authentication tokens stored in Redis. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

Changes to This Policy

We may update this policy from time to time. When we do, we will update the "last updated" date at the top of this page. Continued use of the App after changes take effect constitutes acceptance of the updated policy.

Contact

Questions or requests about this policy:

Privacy privacy@vibetower.app