Privacy Notice
What VanillaCity keeps about you, why, for how long, and how to see, correct or delete it.
Who we are
VanillaCity is made and run by TeamVanilla (“we”, “us”). We decide what information the game and this website collect and how it's used, so for data protection law we are the controller. To ask about your information, message the staff on TeamVanilla's Discord, or use the form at the bottom of this page.
This notice covers the game in your browser at vanillacity.me/game, the Windows and Android apps, and this website.
What we collect
We collect as little as we can, and only from you and from what you do in the game. We do not ask for your email address, real name, birthday, phone number, address or location.
- Your account: the citizen name you pick and your password. We never store the password itself, only a salted scrypt hash that can check it but can't be turned back into it.
- Your citizen: how they look, coins and VanillaBucks, what they own, their home and furniture, pets, mail, friends, Club, shop, level, reputation, ribbons, VIP, your name and chat colors, your settings, and where they were when you last left.
- What you say and do in town: public chat, postcards, letters and gifts, trades, purchases and sales, jobs, games, and reports you make or that are made about you.
- Safety records: sign-ins and account changes, with your internet address stored only as a keyed hash (a scrambled value we can match but can't read back), and the police record of rule-breaking (tickets, cells, bans).
- Your internet address, briefly: the server uses it, in memory, to slow down anyone making lots of accounts or guessing passwords. It's never shown in town.
- Store orders: if you buy VanillaBucks or VIP on this website, we keep the order code, the citizen it was for, what it was, the price, when, whether you paid with PayPal or Cash App, and their ID for the payment. PayPal or Cash App takes the payment; we never see your card or bank details.
- Your agreements: that you said you're 13 or older, that you accepted this notice, which version and when.
- Requests you send us: what you ask through the form below, and the contact details you choose to give for our answer.
Why we use it
| Purpose | What we use | Legal basis (UK and EU) |
|---|---|---|
| Running the game: your account, citizen, money, home and everything in town | Account, citizen, what you do in town | Contract: it's the service you asked for |
| Keeping the town safe: reports, moderation, the police ladder, stopping abuse and break-ins | Chat, reports, safety records, internet address | Legitimate interests, which we've weighed against your rights, especially for young people |
| Store payments and their records | Store orders | Contract, and legal obligation for payment records |
| Your page on this website | Your card and town numbers (see below) | Legitimate interests; you can turn it off at any time |
| Answering your requests and obeying the law | Requests, agreements, what the law asks for | Legal obligation |
We don't use your information for advertising, we don't sell it, we don't share it for cross-context behavioural advertising, and we don't build marketing profiles or make automated decisions about you that have legal or similarly significant effects. The automatic chat filter and police ladder are rules of the game: staff can review anything they do, and you can ask them to.
Who sees it
- Other citizens see your name, look, public chat, what you do in town, and what you put in your shop or home.
- VanillaCity staff see what they need to run the town and answer reports. Everything staff do to an account is written in an audit log that can't be quietly changed.
- Our web host stores the game and its data on servers in the United States, and may use it only to provide that service to us.
- PayPal and Cash App handle store payments, under PayPal's privacy notice and Cash App's privacy notice. We don't send them anything about you; you pay them directly.
- YouTube and radio stations: when a TV, screen or radio in town plays, your browser or app fetches it straight from YouTube (through its privacy-enhanced youtube-nocookie.com player) or from that station, and they see your internet address. Nothing plays unless you're in a room where it's on.
- Discord: if you contact us on Discord, Discord's own privacy policy applies to what you send there.
- Authorities: only where the law requires it, or to protect someone from serious harm.
Our servers are in the United States. If you play from outside it, your information is sent there so we can run the game you've asked to play.
Your page on the website
Every citizen has a page under Citizens. It shows your card (look, level and EXP, reputation's tier, VIP, Club and the ribbons you choose to show), your companions, your home, and numbers for what you've done in town, like jobs worked, fish caught and arcade bests. Your card's own choices apply there too. It never shows where you are, whether you're online, your money, your friends or your chat.
To take your page off the website, open the Menu in the game, then Account, and turn off My page on the website. To hide just the numbers, turn off What I've done in town.
How long we keep it
We delete things on a timer. This is the same schedule our server runs every night.
| What | How long | Why |
|---|---|---|
| Your account: name, password (as a salted hash), look, wallet, what you own, home, pets, mail, friends, shop | While your account exists, and until the erasure you ask for has run | To run your citizen and the game |
| Public chat lines | 30 days | Looking into reports of bullying and other rule-breaking |
| Sign-in and account-change records (your address only as a keyed hash) | 90 days | Spotting break-ins and abuse |
| Reports you make or that are made about you | 365 days after they are handled | Keeping the town safe |
| The police record (tickets, cells, bans) | 730 days | Fairness and repeat-offender rules |
| Shop sales and commissions | 365 days | Shop owners' accounts and fixing mistakes |
| Store orders paid with PayPal or Cash App: the order code, the citizen, what was bought, the price, how it was paid and the payment's ID | Kept as a record of payments; if the account is erased the order stays with no citizen on it | Accounting and tax records, and answering questions about a payment |
| Staff actions on accounts and shops (the audit log) | 1095 days | Accountability; personal details are blanked when the account is erased |
| Accounts that never finished the tutorial | 90 days after last visit | Not keeping abandoned sign-ups |
| A deleted account's name | 30 days (365 days if it was banned) | Stopping someone else taking the name straight away |
| Rights requests: contact details | 365 days after the request is finished | Answering you and showing we did |
| Rights requests: the register entry (no personal details) | 1095 days | Showing we answered on time |
When you delete your account we remove it and everything attached to it, and take your name and words out of other people's records, keeping only what's listed above (for example, a payment record with no citizen on it, or a gift you sent so the person who got it keeps it). Copies of the database we keep as backups can still hold erased information until those copies are replaced; if we ever restore one, we run the erasures again.
Cookies and storage
We use one cookie: when you sign in, your browser gets a random sign-in token that keeps you signed in for 30 days or until you sign out. We store only a hash of it. The Windows and Android apps keep the same kind of token on your device. This cookie is strictly necessary, so there's no cookie banner.
The game also saves a few settings in your browser's own storage (things like volume and whether the chat log is folded). They stay on your device and aren't sent to us. We use no advertising or analytics cookies, trackers or fingerprinting, in the game or on this website, and since we don't sell or share your information, there's nothing for a Global Privacy Control or Do Not Track signal to switch off.
Young people and parents
VanillaCity is for people aged 13 and over, and we don't knowingly collect information from children under 13. Everyone confirms their age when they join. If we learn that an account belongs to someone under 13, we delete it. If you think a child under 13 is playing, tell us with the form below, and we'll look into it within 24 hours.
In some countries, people aged 13 to 15 need a parent's permission to use online services. If that's you, ask a parent or guardian to read this with you. Safety tools are on for everyone from the start: the chat filter removes email addresses, phone numbers, street addresses, links and social media handles; anyone can be reported; mail from anyone can be blocked; and staff read every report. Parents and guardians can ask us to see, correct or delete their child's information. See Parents and Guardians.
Your rights
You can ask to:
- see what we hold about you, and get a copy to take elsewhere;
- correct it;
- delete it;
- restrict or object to how we use it;
- withdraw consent where we rely on it.
In the game: open the Menu, then Privacy & account. Download my data gives you everything we hold about your citizen as a file straight away, and Delete my account erases it after 7 days (sign in before then to cancel), or at once if you choose.
Anyone else, including parents: use the form below or message the staff on TeamVanilla's Discord. Because we hold no email address, we'll ask you to show the account is yours (for example, by sending a postcard from it to a staff member) before we hand anything over or delete it.
We answer within 30 days. Using your rights never changes how you're treated in town. If we turn a request down we'll tell you why, and you can ask us to look at it again (an appeal); we'll answer that within 45 days.
Where you live
California and other US states
In the past 12 months we collected: identifiers (your citizen name, a password hash, a sign-in token, and your internet address, briefly and as a keyed hash); commercial information (store orders, and PayPal's or Cash App's ID for the payment); internet or other electronic network activity (what your citizen does, owns and says in the game); and anything you write in a request to us. We collect it from you, for the purposes above, and keep it for the times in the table. We don't collect sensitive personal information like precise location, government ID, or card or bank details. We don't sell personal information or share it for cross-context behavioural advertising, including for anyone under 16. You have the right to know, delete and correct, to limit use, and not to be treated differently for using your rights. You can make a request yourself, or through someone you authorise, and a parent or guardian can make one for a minor.
The UK and the EU
You have the rights listed above. The legal bases for each use are in Why we use it. You can complain to your local data protection authority (in the UK, the Information Commissioner's Office at ico.org.uk), though we'd like the chance to sort it out first.
Security
Passwords and sign-in tokens are stored only as hashes. Sign-in attempts are rate-limited, downloading or deleting your data needs your password again, and staff actions are recorded in a tamper-evident audit log. We keep a register of any security incident. If a breach is likely to put you at risk, we'll tell the authorities within 72 hours and tell you as the law requires. No system is perfectly secure, so pick a password you don't use anywhere else.
Changes
If we change this notice in a way that matters, we'll change its version and date at the top, say so in the news, and ask you to accept it again the next time you sign in.