Privacy Policy
Last updated: November 14, 2026
This Privacy Policy explains how AE Labs Inc. ("we", "us" or "our") collects, uses, shares and protects Personal Data when you use webPunk, including the webPunk mobile application (the "App") and webpunk.com (the "Website"), together the "Services". AE Labs Inc. is the controller of your Personal Data. Terms not defined here have the meaning given in our Terms of Service.
Please read this Privacy Policy carefully. If you do not agree with it, please do not use the Services.
Summary
- We collect what you give us (such as your email address, profile and the Content you create), what is generated as you use the Services (such as device, usage and in-game data), and limited information from partners (such as purchase and verification status).
- We use it to run webPunk, keep it safe, personalize what you see, improve the Services, and meet our legal obligations.
- We do not sell your Personal Data for money. Our use of advertising and measurement partners may count as "sharing" or "targeted advertising" under some laws; you can opt out as described below.
- Messages are encrypted in transit and stored on our servers. They are not end-to-end encrypted.
- We collect your device's precise location only while you choose to be on the map (only your latest position, never a history), and other people there see only an approximate area, never your exact location (see "The Map" below).
- If you add webPunk widgets or allow Live Activities, your friends' usernames, profile pictures and stars and your unread counts can show on your device's home screen and lock screen. You can remove them or turn them off at any time.
- You can access, download, correct and delete your data, and you can delete your account in the App at any time.
1. Personal Data
"Personal Data" means information that identifies, relates to, or can reasonably be linked to an identified or identifiable individual.
2. Personal Data we collect
2.1. Information you provide
- Account information: your email address, username, display name, profile picture and bio, and your age, which you tell us when you sign up, to apply age-appropriate protections.
- Content: posts, remixes, comments, messages, voice notes, photos and videos, polls, suggestions, chat topics, your avatar, its outfits and poses, your world and any other Content you create, upload or share.
- Videos you upload: the video file (we keep your original, privately, so we can make it again in new qualities), its title, description and thumbnail, whether it is published, and the comments and replies you write on videos. Uploading a video needs a webPunk ID.
- Inputs to AI features: the prompts, reference images (which may include a photo of you or your avatar) and messages you send to machine girl and our other AI features, and what those features generate for you.
- What you make in the Studio: what you type in the Studio to make an item or experience, and the scene and script written from it; the title, description, age rating and prices you set; the thumbnails you generate for an experience, with the people you tag in them; and the versions you submit for review. Your Studio conversation is stored with the item or experience it made and is shown to our reviewers.
- webPunk Studio for computers: when you sign webPunk Studio in, we store that your account approved it and a session for it (when it was made, last used, and when it ends), and nothing about the computer itself. When you publish, we store every version you upload: its package, script, meshes, textures and sounds, thumbnail and screenshots, its title, description, language and the answers about what it contains, and the result of our automatic check. Uploaded files are kept private and shown only to our reviewers until a version is approved.
- Reports on experiences: when you report an experience, we store your reason and what you wrote with it. Reports are read by our reviewers and never shown to the creator as yours.
- What AI-run accounts remember: a member account we run with AI keeps a memory of the people it interacts with: what it did with you (its comments and replies on your posts, its answers to your direct messages, chats and walks in the hub) and short notes of things you told it about yourself. It uses them only to write its own replies to you. It keeps no memory of, and does not answer direct messages from, members under 18 or whose age we don't know.
- Voice and video: your voice when you use voice chat in the hub, calls, voice notes, or a voice call with machine girl, and your camera's picture while you turn it on in a call or a group call (the other people in that call see it). Live voice chat and calls, their video included, are relayed in real time and are not recorded by us; voice notes are stored like other messages. When someone in a chat taps "View transcription" on a voice note, its audio is sent to ElevenLabs to be turned into text, and that text is stored with the message for the chat's members to read.
- Link previews: when a message contains a link, our servers fetch that page to build its preview card (title, description and picture) and store the card with the message. We also keep a copy of the picture on our own storage. The website shows the card's picture from that copy, and so does our mobile app, so the linked site does not learn who opened the chat. Older versions of the mobile app that have not updated yet still load the picture from the linked site, which can then see that request (including your device's IP address).
- The Map: if you choose to show yourself on the Map: your device's precise location while you are on it (only the latest position, no history, deleted when you hide or after three days without opening the app); the one line you write for the map; an optional map profile (a name, a bio and links); the graffiti you leave on the map (a drawing only, its strokes and colours, with the area of about 50 metres where you left it, never the exact spot), kept for 24 hours unless you wipe it, also after you hide; and, during a Find that you and someone you have an accepted chat with both agree to, your precise location and your phone's compass heading, shared with that person only, for up to 30 minutes. During a Find, if your phone supports Ultra-Wideband, the App also passes the other person's phone a short-lived device token (Apple Nearby Interaction) through our servers; it is kept only on that Find and deleted when it ends, and the distance and direction are then measured between the two phones and never sent to us. To limit how much of the map one account can look at, we count, for up to two hours, how many areas of about a kilometre you have looked at; each area is kept only as a keyed hash we can match but not read back as a place.
- Social connections: friend requests and friends, blocks, mutes, reports, group memberships and, where you use them, parental supervision links. For a member whose account is supervised by a parent: how many minutes a day the member spends in the App (counted on the device while the App is open and sent to us every minute), the daily limit a parent sets, and whether it was reached. The member always sees that supervision is on.
- Purchases and rewards: your subscription status, purchases of Volts and items, and your Volts and rewards history. Payment card details are collected by Apple, Google or Stripe, not by us.
- Wallet and bank transfers: your Wallet addresses and the transactions you initiate. If you use optional bank deposits or withdrawals, you give your identity and verification information to our provider Bridge directly; we receive your verification status and the identifiers needed to process your transfers.
- Communications with us: support requests, reports, appeals and feedback.
2.2. Information collected automatically
- Device and technical information: IP address, device model and manufacturer, operating system, App version, language, time zone, device performance class, push notification token, a device identifier used to keep one push token per device, notification settings, and browser type on the Website. While the App is open we also collect battery level, charging and low-power state, device temperature state, network type (Wi-Fi or mobile), memory size, and the screen you are on, to understand performance.
- Usage information: the features and pages you use, the posts you view and how long you view them, your likes, comments and other interactions, and whether you have seen a post or opened a chat. We use this to rank and personalize your feed and to improve the Services. On videos we record that you watched one (once a day per video, to count its views and to leave it out of your recommendations), your like or dislike, and the comments you like.
- Activity status: when you are online, in the hub or in a chat; when you are typing; and when you have read a message. Other people may see this as described in Section 4.
- Hub and game data: your position and movement in the hub (a virtual position in the game world, not your physical location), which instance of the hub you are in, your level and progress, items you collect, and the time you spend there. If "Leave a ghost behind" is on, recordings of your avatar's path are kept so other players can see them replayed for up to 24 hours. When you play Ophan live (the hub's game shows), we record what you did in each game — the answer or tile you stood on at each bell, your X's, whether you were caught, found or won, and your score — to run the game, settle its data rewards, keep its leaderboards and learn how hard each question is. A drawing you draw in doodle guess is passed to the players and audience in the theatre as you draw it and is not kept after the round. When you play an experience made in the Studio, we store your saved progress in it (up to 16 KB of game data per experience), your scores and your plays. The experience's script itself sees only your position in it and an opaque player identifier, never your name, profile or contacts. For each experience on the Hub tab (such as the garden) we record that you played it (the first and last time) and your like or dislike, if you give one. When you have not played for a few days, we may use the experience you played last to send you a notification inviting you back to it (at most one a week; you can turn these off in Settings).
- Diagnostics: crash reports, error logs and performance measurements.
- Widgets and Live Activities: on iOS, the push tokens Apple gives the App to start and update a Live Activity, which kind of Live Activity each belongs to (stars) and whether it is still running, and which kinds you have turned on. We use them only to start, update and end your Live Activities. For widgets, Control Center controls, Quick Settings tiles and Live Activities, the App keeps a copy of what they show (see Section 4) and the pictures they need on your device; widgets do not send it anywhere.
- Advertising and measurement data: where ads or install attribution are switched on (they are not in the mobile apps today), your device's advertising identifier (where your device settings and consent allow it), ad impressions and interactions, and the install and in-app events used to measure our advertising campaigns.
- Approximate location: your country or region, inferred from your IP address, App Store region or device settings. We use it to comply with regional rules, show the right consent choices and decide which features are available. Apart from the Map (below), we do not collect your precise location.
- Device permissions: with your permission, the App accesses your camera, microphone, photo and video library and motion sensors only to provide the features you use (for example, taking a photo, choosing a video of up to 90 seconds to post, scanning a Wallet's QR code, placing your avatar in the room in augmented reality, recording a voice note or joining voice chat). What the camera sees while you scan a QR code or use augmented reality is processed on your device and is never sent to us; only a photo or video you choose to save or post leaves it. You can change these permissions at any time in your device settings.
2.3. Information from third parties
- Sign-in and Wallet provider (Privy): confirmation of your sign-in and your Wallet addresses.
- App stores, RevenueCat and Stripe: the status of your purchases and subscriptions.
- Bridge: the status of your identity verification and bank transfers, if you use them.
- Advertising and measurement partners: where install attribution is switched on, information about the ad campaign that led you to install the App, where permitted.
- Public blockchains: transaction information associated with your Wallet addresses. Digital Assets are not anonymous: anyone who can link your Wallet address to other information about you may be able to identify you from on-chain activity.
- Other users: information others provide about you, for example when they mention you, send you a friend request, add you to a group or report Content.
3. How we use Personal Data and our legal bases
We use Personal Data for the purposes below. Where the law of your country requires a legal basis (for example, the EU or UK GDPR), we rely on the basis shown for each purpose.
- To provide the Services — creating and securing your account, signing you in, delivering messages, calls and notifications, showing your widgets and Live Activities, running the hub and its multiplayer features, generating AI Content you ask for (including the items and experiences you describe in the Studio, written by our AI provider xAI), running experiences and keeping your progress in them, processing purchases, rewards, creator sales and Wallet features, and providing customer support. Basis: performance of our contract with you.
- To personalize the Services — ranking your feed, suggesting people and content, and remembering your settings and where you left off in the hub. Basis: performance of our contract and our legitimate interest in showing you relevant content.
- To keep webPunk safe — preventing fraud, spam, cheating and abuse; enforcing our Terms and Community Guidelines; reviewing reports; reviewing items and experiences made in the Studio before they are shown to others; applying protections for younger members; and running automated safety checks on AI prompts and generations. Basis: our legitimate interests in a safe service, and legal obligations.
- To understand and improve the Services — analytics, diagnostics, testing and developing new features. Basis: our legitimate interest in improving the Services, or your consent where required.
- Advertising and marketing measurement — where we run them, showing ads in the App, rewarding you for rewarded ads you choose to watch, and measuring the performance of our advertising campaigns. Basis: your consent where required (including in the EEA, UK and Switzerland, and Apple's App Tracking Transparency on iOS), otherwise our legitimate interest in funding and growing the Services.
- To communicate with you — service and security messages, push notifications you have allowed, and responses to your requests. Basis: performance of our contract, and your consent for push notifications.
- To comply with law — tax and accounting, responding to lawful requests, and establishing or defending legal claims. Basis: legal obligations and legitimate interests.
We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you. Automated systems help rank content and flag possible abuse, and people review enforcement actions where required.
4. Information visible to other people
webPunk is a social platform. Depending on the feature and your settings, other people can see:
- your public profile (username, display name, profile picture, bio, avatar, world and the month and year you joined), the posts and remixes you publish and the stars you post (a photo, a video or one of your creations: on the stars rail for 24 hours, then in your constellation);
- the videos you publish (with their title, description, thumbnail, view count and like count), your comments and replies on videos, and how many people like each comment. Who liked or disliked a video is never shown to anyone, and a video's dislike count is shown only to the person who made it. A published video's page, with its comments, can be opened by anyone who has its link, including people who are not signed in; an unlisted video is left out of every list and recommendation, so only people with its link find it;
- who follows you and who you follow: any signed-in member can see, on your profile, how many people follow you and how many you follow and the two lists. Only accepted friendships are shown; friend requests still waiting, blocked people and suspended accounts are not;
- if a picture you published was made with our image generator, it may be chosen as the Explore page's picture of the day: for that day it is shown to every member, with your username and profile picture;
- messages, voice notes and media you send, to the members of that chat, and typing indicators and read receipts ("Seen"), to the members of that chat;
- on the Map, to people on it near you (if you or they are under 18, only to people you are connected to: friends, an accepted chat or your close friends list, never to strangers): the Map's anonymous figure (the same for everyone) and your one line, an approximate position (somewhere in an area of about 50 metres if they are within about 100 metres of you, about 400 metres otherwise, never your exact location), a rough distance and whether you have been away, but not your username or avatar; your avatar and webPunk username (or, without one, your account address) only once you accept their message, you follow each other, or you message them (a message you start from the Map reaches them as a request with your account, marked as sent from the Map, while they stay anonymous to you until they accept); the stars you post (their drawing, with your username and picture, placed like you are), from 3 hours after you post them until 24 hours after; your map profile to people you have an accepted chat with; your approximate position (somewhere in an area of about 400 metres, from anywhere on the map) and the same details to the people on your close friends list, which you fill by hand and can change at any time; to anyone using the map (on it or not), only a rough count of the people in areas of about a kilometre and, to people on it, a rough count of those within 1 and 5 kilometres of them, never who they are, only where there are five or more, and never counting members under 18; and your precise location, compass heading and Nearby Interaction token only to the person you Find, while the Find lasts;
- in the hub, your avatar, name, position, movement, chat bubbles, emotes and voice, to other players in the same hub instance;
- if "Leave a ghost behind" is on, a replay of your avatar's path (with your name), shown to other players in the hub for up to 24 hours;
- in Ophan live, your avatar, name, answers, X's and whether you won (and, in doodle guess, what you draw, while you draw it), to the other players and spectators in the same hub instance and on the theatre's screens in the hub; and your username, profile picture and game totals (games, wins, score) on each game's weekly and all-time leaderboards, to anyone using the App;
- your like or dislike of an experience only as part of its totals (its likes, dislikes and rating), never as yours;
- an item or experience you made in the Studio, once we have approved it: its title, description and thumbnail, your username and profile picture as its creator, and its play counts, to anyone, in Discover, on your profile, at webpunk.com/x/ followed by your handle and in search; an approved item is also worn on your avatar's back, to other players in the same hub instance. Until approval, only you and your friends can see it. What you typed in the Studio to make it is shown to our reviewers, not to other members;
- an experience you published with webPunk Studio, once we have approved a version: its title, description, thumbnail and screenshots, its maturity label, your username and profile picture as its creator, its likes, dislikes and play counts, to anyone who can see it in the App and on the Website (not to people in a block with you, and not to members under 18 when its label is above Mild), and its uploaded files at public addresses, so the people who play it can download them. Until approval, only our reviewers see what you uploaded;
- your likeness in an experience's thumbnail: a friend may tag you in a thumbnail they generate in the Studio, and the picture is drawn from your profile picture and avatar. Once the experience is approved, that thumbnail is shown to anyone wherever the experience is (see above). Ask the creator, or report the experience, to have it changed;
- that you are online in the hub, to your friends (for example, through a "your friend is online" notification);
- which experience you are playing (the garden or Ophan live) and which of its rooms you are in, to your friends (people you follow who follow you back), who can join that room from the "Playing now" list. Everyone else sees only how many people are playing each experience, never who;
- your Wallet address and on-chain transactions, to anyone, because public blockchains are public;
- your username, profile picture and stars, on the home screen and lock screen widgets and Live Activities of friends who use them.
If you add webPunk widgets (home screen or lock screen), Control Center controls or Quick Settings tiles, or allow Live Activities, your device can show your friends' usernames, profile pictures and stars and your unread message counts on its home screen and lock screen, and on iOS in the Dynamic Island, StandBy and a paired Apple Watch. Anyone who can see your screen can see them, even while your device is locked. They never show what a message says. On Android, if you allow bubbles for webPunk in your device's settings, a chat can float over other apps as a bubble with the other person's profile picture, and opens there with its messages; it is drawn on your device only.
Anything you share with others can be copied or saved by them. Please share thoughtfully.
5. How we share Personal Data
We share Personal Data only as described here:
- Service providers who process it on our behalf to operate the Services, listed in Section 6;
- Advertising and measurement partners (where switched on: Google AdMob and AppsFlyer, and through AppsFlyer, the advertising platforms on which we run campaigns), subject to your device settings and consent choices — never for ad personalization or attribution of members under 18 (Section 14);
- Other users, as described in Section 4;
- Public blockchains, when you initiate an on-chain transaction;
- Parents or guardians who supervise a minor's account with that minor's agreement, as described in our Age Suitability page;
- Professional advisors, such as lawyers, auditors and accountants;
- Authorities and others where required by law or legal process, or where necessary to protect the rights, property or safety of our users, the public or us;
- Business transfers, to a successor or counterparty in a merger, acquisition, financing, reorganization, asset sale or similar transaction;
- Affiliates, meaning entities that control, are controlled by or are under common control with us, who will handle it consistently with this Privacy Policy;
- With your consent or at your direction.
6. Service providers
We use the following service providers. They may process your Personal Data only to provide services to us, under contractual confidentiality and data protection obligations, except where a provider (such as Apple, Google, Stripe or Bridge) acts as an independent controller under its own privacy policy, which you should review.
Hosting, infrastructure and storage
Railway
Hosting of our servers and databases.
Data: All categories of Personal Data processed by the Services.
Google Cloud (Google LLC)
Hosting of the game servers that run rooms and experiences.
Data: Account identifier, username, IP address, gameplay inputs while you are in a room.
Cloudflare
Storage and delivery of uploaded and generated media, content delivery and network security.
Data: Media you upload or generate, IP address, technical request data.
Vercel
Hosting of the Website and privacy-friendly page analytics.
Data: IP address, browser and device information, pages visited.
Sign-in and wallets
Privy (HORKOS, Inc.)
Account sign-in by one-time email code, bot protection at sign-in, and embedded non-custodial Wallets.
Data: Email address, Wallet addresses, IP address, device information.
Helius, Alchemy and the Hedera network's public nodes (Hashio, mirror node)
Reading Wallet balances and relaying the transfers you send from your Wallet to the Solana, Ethereum and Hedera networks. Our servers make these requests, so these providers see our servers' address, not your device's.
Data: Wallet addresses and the signed transfers you send (which then become public on the blockchain).
hCaptcha (Intuition Machines, Inc.)
Bot and abuse protection on the Website's sign-in.
Data: IP address, browser and device signals.
Notifications
Expo (650 Industries, Inc.), Apple and Google
Delivery of push notifications through Apple Push Notification service and Firebase Cloud Messaging (directly from our servers, or through Expo for earlier versions of the App), and of Live Activity updates on iOS through Apple Push Notification service.
Data: Device push token, Live Activity push tokens, notification and Live Activity content. A device identifier that keeps one push token per device stays with us and is not shared.
Purchases and payments
Apple and Google
Billing for subscriptions and Volts bought in the App. We never receive your payment card details.
Data: Transaction identifiers, purchase history, country.
RevenueCat, Inc.
Management of subscriptions and in-app purchases.
Data: Account identifier, transaction identifiers, purchase history, subscription status.
Stripe, Inc.
Payment processing for purchases made on the Website.
Data: Payment and billing details (collected by Stripe directly), transaction information.
Shopify Inc.
The IRL shop: the store and checkout for physical merchandise, in the App and on the Website. Shopify runs the checkout itself, inside the App or on its own page; we never receive your payment card details.
Data: The products in your cart, and the name, email address, shipping address, phone number and payment details you enter at checkout (collected by Shopify directly), order information.
Bridge (Bridge Building Inc.)
Optional bank deposits and withdrawals for your Wallet, where available, including the identity verification that such services require by law.
Data: Identity, contact and verification information you give Bridge directly; we receive your verification status and account identifiers.
Voice, calls and real-time features
LiveKit, Inc.
Real-time audio for voice chat in the hub, and audio and video for calls between people and group calls. Audio and video are relayed live and are not recorded by us.
Data: Live audio, live video while your camera is on in a call, account identifier, IP address, connection data.
Google (Google Play Services for AR)
Augmented reality on Android: placing your avatar in the room around you. The App runs on Google Play Services for AR (ARCore), which is provided by Google LLC and governed by the Google Privacy Policy.
Data: Camera images and motion sensor data, processed on your device by ARCore; Google may collect device and usage data as its privacy policy describes.
Artificial intelligence
xAI (X.AI LLC)
machine girl's conversations, writing and translation features, prompt assistance, the replies of the member accounts we run with AI, the Studio (writing the scene and script of an item or experience you describe), and the short summaries in the Map's area panel (written from a Wikipedia article's text).
Data: Messages and prompts you send to these features, and related context; for an AI-run account, what you say to it (including direct messages you send it), the posts, comments and hub chat it reads, and what it remembers about you; in the Studio, what you type and the scene and script of the item or experience you are making.
OpenAI, L.L.C.
Text embeddings used to look up machine girl's knowledge base when you message her.
Data: Messages you send to machine girl.
Google (Gemini and Veo)
Image and video generation and automated safety checks.
Data: Prompts, reference images (which may include photos of you or your avatar), generated output.
fal.ai (Features & Labels, Inc.)
Hosting of third-party image and video generation and editing models.
Data: Prompts, reference images, generated output.
ElevenLabs (Eleven Labs Inc.)
Machine Girl's voice and voice calls with her, and turning a chat voice note into text when someone in that chat taps "View transcription".
Data: Your voice during a call with Machine Girl, conversation content, and the audio of a voice note someone in the chat asks to transcribe.
Meshy
Generation of 3D world models.
Data: Prompts and reference images you provide for a world.
Media search
Maps
Map tiles from our own CDN (Cloudflare)
The Map page of our iOS and Android apps draws its map from map tiles we build ourselves from OpenStreetMap data and serve from our own content delivery network (cdn.webpunk.com, on Cloudflare). No map company is involved, and the map sends no usage telemetry. On Android, the place names on the Map and its place search when choosing a new zone are read from these tiles on your device, so nothing you type or look at is sent to anyone for them.
Data: IP address and the approximate area the map shows (which tiles your device asks for), as with any request to our CDN. Map labels are drawn on your device.
Apple Inc. (Apple Maps)
Place search and place names on the Map page of our iOS app: the city or place you type when choosing a new zone, and the name of the neighbourhood, city, region or country the map is centred on.
Data: Your search text, the map centre being named, IP address, device information.
WeatherAPI.com
The weather line on the Map page of our iOS and Android apps. Your device sends our servers only the rough area the map shows (a square of about 28 km), never your location; our servers ask WeatherAPI.com for the current weather at that area's centre and keep the answer for 30 minutes for everyone looking there.
Data: The centre of the area being shown. Nothing about you or your device is sent to WeatherAPI.com.
Wikimedia Foundation (Wikipedia, Wikimedia Commons)
The area panel on the Map page of our iOS and Android apps, which tells you about the place the map is centred on. Our servers look the place up on Wikipedia, ask our AI provider xAI to write a short summary from the article's text, and show you the article's pictures with their authors and licences. Your device sends our servers only the name of the place the map shows and the rough area (a square of about 28 km), never your location; the answer is kept for a day for everyone looking at that place. The pictures load straight from Wikimedia's servers.
Data: The name of the place and the centre of the rough area, sent by our servers, not by you; the pictures are fetched by your device, so Wikimedia sees its IP address and device information. Nothing about you is sent with the lookup.
Analytics and diagnostics
PostHog, Inc.
Product analytics on the App and the Website, including how features are used and, on the Website, aggregated click and scroll heatmaps.
Data: Account identifier, usage events, device and browser information, IP address.
Sentry (Functional Software, Inc.)
Crash reporting and performance monitoring.
Data: Crash logs, device model and operating system version, account identifier. On the Website and in older versions of the App, also IP address.
Advertising and measurement
We do not currently show ads or run install attribution in the mobile apps. If we do, we will update this Privacy Policy first, ask for your consent where required (Apple's App Tracking Transparency on iOS) and add the controls to Section 8.
Google AdMob
Ads in the App, including optional rewarded ads that earn Volts.
Data: Advertising identifier (where permitted), IP address, device information, ad interactions.
AppsFlyer Ltd.
Measuring which advertising campaigns lead to App installs and activity, and reporting those results to the advertising platforms we run campaigns on.
Data: Advertising identifier (where permitted), IP address, device information, install and in-app events.
7. Cookies and similar technologies
On the Website we use cookies and browser storage (such as local storage) that are necessary to keep you signed in, remember your settings and complete purchases, and analytics cookies and storage from PostHog to understand how the Website is used, only if you accept them in the banner on your first visit (until you choose, nothing is stored, and a "Do Not Track" signal is respected). Vercel's page analytics does not use cookies. We do not use advertising cookies on the Website.
In the App we use similar technologies, such as device identifiers and the software development kits of the providers listed in Section 6. You can block or delete cookies in your browser settings; some parts of the Website may not work without the necessary ones.
8. Your choices
- Ad tracking on iOS: when ads are switched on, the App asks for permission before tracking you across other companies' apps and websites. You can change this in Settings → Privacy & Security → Tracking.
- Ad personalization on Android: when ads are switched on, you can delete or reset your advertising ID in your device's privacy or Google settings.
- Ad consent in the EEA, UK and Switzerland: when ads are switched on, you can review or change your choices at any time in Settings → Ad privacy in the App.
- Ghosts in the hub: you can turn off "Leave a ghost behind" in Settings. Turning it off also deletes the recordings we hold.
- Notifications: you can turn off all notifications or individual categories in Settings, or in your device settings.
- Widgets and Live Activities: you can remove a widget from your home screen or lock screen, and a control or tile from Control Center or Quick Settings, at any time. You can turn off star Live Activities in the App's notification settings, or all of webPunk's Live Activities in iOS Settings → webPunk → Live Activities; turning a kind off ends the one that is running.
- Safety tools: you can mute, block and report people, report any experience, and leave any chat, at any time. Blocking a creator also hides their experiences from you.
- Device permissions: you can withdraw camera, microphone, photo and motion access in your device settings.
- Delete your account: in the App, go to Settings → Account → Danger zone, or use our account deletion page.
9. Data retention
We keep Personal Data only for as long as we need it for the purposes described in this Privacy Policy. In particular:
- account and profile information, posts and other Content are kept while your account is active and deleted when you delete them or your account;
- messages are kept until they are deleted by you or other participants, removed by a chat's disappearing-message timer, or deleted with your account; view-once media is deleted shortly after it has been viewed;
- messages in the hub's public chat expire after one hour;
- your Map location is kept only while you are on the map (your latest position only), the graffiti you leave for 24 hours, and a Find's locations only until it ends;
- what an AI-run account remembers about you is deleted after 60 days, and with your account;
- ghost recordings of your hub walks are deleted after 24 hours, or immediately if you turn the feature off;
- your online status in the hub expires within minutes of leaving it; your last hub position is kept so you can continue where you left off;
- your saved progress and scores in experiences are kept while your account is active and deleted with it; what you typed in the Studio is kept with the item or experience it made, and deleted with that item or experience or with your account;
- a Live Activity's push token is deleted within 7 days after the Live Activity ends, and the token for starting Live Activities after 60 days without the App reporting it again; all of them are deleted with your account;
- game servers keep the IP address of each connection in their logs for 30 days, to keep rooms safe and working;
- analytics, diagnostics and advertising data are kept for limited periods set by us and our providers;
- purchase, rewards and transaction records are kept for as long as required by tax, accounting and other laws;
- we may keep information longer where needed to resolve disputes, enforce our Terms, prevent abuse or comply with law, and residual copies may remain in backups for a limited period.
Information recorded on a public blockchain cannot be changed or deleted by us.
10. Security
We use technical and organizational measures to protect Personal Data, including encryption in transit, access controls, private storage for chat media that is served only to members of the chat through short-lived links, and additional encryption at rest for certain sensitive photos. Wallets are non-custodial and provided by Privy; we do not hold your private keys.
Messages are stored on our servers and are not end-to-end encrypted. No system is completely secure, and we cannot guarantee the security of your information.
11. International data transfers
We are based in the United States, and we and our service providers process Personal Data in the United States and other countries whose data protection laws may differ from those where you live. Where we transfer Personal Data from the EEA, the UK or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, or on another lawful transfer mechanism. Our game servers run in Google Cloud's US East (Virginia) region.
12. Your rights
Depending on where you live, you may have the right to:
- know whether we process your Personal Data and access a copy of it, including in a portable, machine-readable format;
- correct inaccurate Personal Data;
- delete your Personal Data;
- object to or restrict our processing, including processing based on legitimate interests;
- withdraw consent at any time, without affecting processing carried out before you withdrew it;
- opt out of targeted advertising and of the "sale" or "sharing" of Personal Data;
- not be discriminated against for exercising your rights;
- appeal a decision we make about your request, and lodge a complaint with your local data protection authority.
To exercise these rights, email support@ael.org. You can also delete your account directly in the App, or request deletion on our account deletion page. We will verify your request using information associated with your account and respond within the time required by law (generally within one month, or 45 days in the United States). You may use an authorized agent where the law allows it; we may ask the agent for proof of authorization.
13. Additional information for US residents
In the last 12 months we have collected the following categories of Personal Data, for the purposes described in Section 3, from the sources described in Section 2: identifiers (such as email address, account and device identifiers, IP address and Wallet addresses); customer records; commercial information (purchases and rewards); internet and other electronic activity (usage and interactions); approximate geolocation; audio and visual information (photos, videos and voice); and inferences used to personalize your feed. Bridge collects government identification for optional bank transfers directly; we do not receive copies of it.
We disclose these categories to the service providers and other recipients described in Sections 5 and 6. We do not sell Personal Data for money. If ads or install attribution are switched on, disclosing identifiers, device information and activity to Google AdMob and AppsFlyer for advertising and campaign measurement may be considered "selling" or "sharing" Personal Data, or "targeted advertising", under some US state laws. You can opt out using the controls in Section 8 or by emailing us. We do not use or disclose sensitive Personal Data to infer characteristics about you. We do not knowingly sell or share the Personal Data of consumers under 18.
14. Children and younger members
You must be at least 13 years old to use webPunk, and older where your country or app store requires it. We do not knowingly collect Personal Data from children under 13. If we learn that we have, we will delete it. Members under 18 receive additional protections, such as limits on who can message, call or add them to a group and who can see them on the Map (only people they are connected to), and can choose to link their account with a parent for supervision, as described on our Age Suitability page. If ads are switched on, for members under 18 the App shows only non-personalized ads, asks Google AdMob to treat its ad requests as coming from someone under the age of consent with a teen content rating, and does not use AppsFlyer. Every experience made in the Studio carries an age rating (everyone, 13+ or 16+) set by its creator and confirmed by us at review; the App does not show an experience to a member whose declared age is under its rating. Parents or guardians with questions may contact us at support@ael.org.
15. Third-party services
The Services may link to or integrate with services we do not control, such as Wallet providers, public blockchains and app stores. Their handling of your information is governed by their own privacy policies.
16. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. We will post the updated version here and change the "Last updated" date. If we make material changes to how we use your Personal Data, we will notify you in the App or by email before the changes take effect and, where the law requires it, ask for your consent. Previous versions are available on request.
17. Contact us
For questions about this Privacy Policy or to exercise your rights, contact AE Labs Inc. at support@ael.org.
We have appointed a Data Protection Officer for the purposes of the EU GDPR and the UK GDPR, who can be contacted at:
Kuzey Köremezli