Privacy Policy

Who we are

VU Bingo (“we”, “us”) is an online realtime bingo game operated at vubingo.com (the “Service”). The Service may be accessed from anywhere in the world; this policy describes how we handle your personal data when you use it.

If you are located in India, the Digital Personal Data Protection Act, 2023 (“DPDPA”) applies to our processing of your personal data in scope of that law. In that case we act as the Data Fiduciary (we decide how and why your personal data is processed), and you are the Data Principal.

Lawful basis and consent

We process personal data as needed to provide the Service you request: creating and maintaining your account, running games and chat, leaderboards, and security / anti-abuse. When you choose Sign in with Google, we rely on your consent as part of that sign-in flow, together with your use of the Service after reading this policy, where consent is required under applicable law (including the DPDPA when it applies to you). You may withdraw consent by discontinuing use and, where available, deleting your account; some processing may still be required to comply with law.

Information we collect

• Account and sign-in. If you sign in with Google, we receive an account identifier from our authentication provider (Supabase) and profile details that Google shares with us as part of that sign-in, such as your name and profile picture URL. Your email address is processed by the authentication provider as needed to operate sign-in; we use it to maintain your account and session.
• Profile you choose. You set or confirm a display name shown to other players. You may upload or crop a profile image. Images we store ourselves are resized to a small 120×120 pixel thumbnail (typically WebP), which keeps file size low and limits detail compared to an original photo. That thumbnail is hosted on our infrastructure (e.g. Cloudflare R2) at a publicly accessible URL — meaning anyone who knows or discovers the link can load the image, the same way other players see it in the lobby and in-game. Until we finish a one-time import from Google, your avatar may briefly use a Google-hosted picture URL under Google’s terms.
• Gameplay and rooms. We store game state needed to run sessions in real time: room metadata, player presence, board and turn data, and related records tied to your account while rooms exist. When a room ends or is removed, associated transient data may be deleted according to our retention practices.
• In-game chat. Messages you send in a room (short text or emoji reactions) are stored with your player identifier, the display name shown in that room, the room reference, and a timestamp. Chat is visible to participants in that room and is removed when the room is deleted.
• Stats and leaderboards. We record aggregate play statistics (for example games played, wins, and leaderboard points) and per-round results used for time-window leaderboards and fair play.
• Anti-abuse signals. To deter coordinated cheating or farming of leaderboard rewards, we may store a recent IP address associated with your session, a browser-stable random identifier generated on your device and sent to our servers (not hardware-based fingerprinting), an optional client-reported VPN suspicion flag, and timestamps. We may log additional internal signals when our systems detect suspicious patterns; those logs are used for abuse prevention, not marketing.

Data stored on your device

We use browser storage and cookies for essential functionality, including: keeping you signed in (session cookies via our auth integration), remembering UI preferences such as sound settings, storing a small local copy of your player id and display name for client-side flows, recording per-room chat “last read” timestamps so unread counts work after refresh, and the random play-signal identifier described above. If you install or use the app as a PWA, a service worker may cache static assets so the app loads faster offline; that cache does not replace our server-side records.

How we use information

We use the data above to provide and operate the Service (matchmaking, realtime play, chat, leaderboards), to secure accounts and detect abuse, to improve reliability, and to comply with law where required. We do not sell your personal information. We do not use your data for third-party advertising in the app.

Service providers

We rely on subprocessors to host and run the Service, including:

• Supabase — authentication, database, and realtime features. See Supabase’s privacy policy.
• Google — Sign in with Google and, when you choose it, profile data from your Google account. See Google’s privacy policy.
• Cloudflare — hosting (e.g. Pages) and object storage (R2) for avatars and related assets. See Cloudflare’s privacy policy.

Loading the app may request fonts from Google Fonts; Google may receive standard technical data (such as IP address) as part of that request, as described in Google’s policies.

Retention

We keep information only as long as needed for the purposes above: for example, account and profile data while your account exists; room and chat data for the life of the room; anti-abuse and leaderboard-related records as needed to enforce fairness and integrity. You may request deletion of your account; where we can verify and honor the request, we will delete or anonymize personal data subject to legal or security exceptions.

Security

We use industry-standard practices appropriate to the Service (encryption in transit, access controls on our providers, and database policies). Where Indian law applies to you, we also aim to follow reasonable security practices consistent with the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011, when they apply. No method of transmission or storage is 100% secure; we work to protect your information but cannot guarantee absolute security.

Your rights

Depending on where you live, local privacy laws may give you rights over your personal data (for example access, correction, deletion, or portability). Contact us using the details below to make a request; we will respond in line with applicable law. You can also revoke Google’s access from your Google account settings; you may still need an account with us to play while signed in.

If you are in India

The DPDPA gives Data Principals rights that include, in summary:

• Access and information — to obtain a summary of your personal data we process and certain related details, as prescribed under the Act and rules.
• Correction and erasure — to request correction of inaccurate or misleading data, completion of incomplete data, updating, and erasure, subject to applicable exceptions.
• Grievance redressal — to raise a grievance with us regarding our processing (see Contact below). You may also have the right to approach the Data Protection Board of India as provided under the DPDPA, once applicable processes are available.
• Nomination — where the Act allows, you may nominate another individual to exercise your rights in the event of death or incapacity.

Children

The Service is not directed at young children, and we do not knowingly collect personal data from anyone under 13 without appropriate parental involvement where required by law. If you are a parent or guardian and believe your child has provided personal data, contact us and we will take appropriate steps.

If you are in India, the DPDPA treats a child as someone who has not completed eighteen years of age; we do not knowingly process a child’s personal data without verifiable parental consent when Indian law requires it.

Cross-border processing

Our service providers (for example Supabase, Google, Cloudflare) may store or process personal data on servers in the United States and other countries where they operate. By using the Service, you understand that your data may be transferred to and processed in those locations, as described in our providers’ policies.

If you are in India, transfers of personal data outside India are subject to the DPDPA and related government notifications where they apply; we will comply with those requirements when they apply to our processing.

Changes

We may update this policy from time to time. We will post the new version on this page and update the “Last updated” date. Where applicable law (including the DPDPA when it applies to you) requires notice or fresh consent for material changes, we will comply. Otherwise, continued use of the Service after updates may mean you accept the revised policy where permitted by law.

Contact

For privacy questions, access / correction / erasure requests, and (for users in India) grievances about how we process personal data: privacy@vubingo.com.

Please include a clear description of your request or complaint and, if applicable, the email address you use with the Service so we can verify and respond. We aim to respond within a reasonable time, consistent with applicable law.

This policy is for transparency only and is not legal advice. If you need certainty for your situation, consider having it reviewed by qualified counsel in your jurisdiction.