Privacy Policy

Effective date: Nov 11, 2025 • Jurisdiction: EEA/UK & global
Minimal collection No precise location Consent for ads Transparent moderation

Contents

1) Who we are

Vanish ("we", "us", "our") is a chat application and sandbox society game. Users participate in groups with roles (admin, elder, member), elections, in-app currency ("Veils"), a marketplace, and visibility mechanics. The separate Rules & How it Works page describes the game systems in more detail. This policy focuses on how any personal data involved is processed.

We design the service to run with minimal personal data: you can participate under a pseudonym and we avoid collecting real-world contact details or precise location for normal use.

Data Controller for in-app data: Vanish (Ireland). Some services we use (for example, Google AdMob) act as independent controllers for their own processing.

2) Quick summary

3) Data we collect

3.1 Data you provide

  • Username (required to participate and shown to other users).
  • Country & city selection (chosen from a list; not GPS-derived).
  • Password (only for persistent accounts). We store a salted/hashed value, not the plaintext password.
  • User-generated content (messages, group names and descriptions, votes, marketplace listings, shaming posts, transfers, group-tax changes, and other in-game actions that appear in ledgers).

3.2 Data collected automatically

  • Service logs (basic technical and security logs needed to operate and protect the service; for example, timestamps, coarse IP region, crash and diagnostic reports). We do not use precise GPS.
  • Ad data via AdMob (Google may process Advertising ID/AAID, IP address, device and app information, ad interactions, approximate location, and similar signals. See AdMob/Google privacy documentation for full details.)
  • Moderation and spam signals. Our automated moderation, honeypot, and spam systems generate internal risk scores and enforcement history (for example, how many suspensions an account has had, or whether a honeypot trap was triggered). These are linked to your account identifier.
  • Anti-abuse signals (exception-based). Only when enforcing hard bans for severe offences do we temporarily associate device identifiers and IP/coarse location with an account to reduce ban evasion. Outside these safety scenarios, we do not use persistent device identifiers or precise location for normal operation.
We deliberately do not collect real name, email address, phone number, payment card data, or precise GPS location. Device identifiers and IP/coarse location are used only in limited security and abuse-prevention scenarios, primarily for enforcing hard bans.

4) Why we use your data (purposes & legal bases)

Provide the service (Contract)

  • Enable accounts (temporary and persistent), messaging, groups, elections, economic features, ledgers, and the marketplace.
  • Operate disappearing messages and deliver content across devices and regions.
  • Run group governance logic, including roles (admin, elder, member), votes of no confidence, elections, shaming actions, and restrictions on leaving groups during active votes.

Security & integrity (Legitimate interests)

  • Prevent spam, fraud, and abuse; detect ban evasion; protect users and the integrity of the game economy.
  • Maintain availability and diagnose incidents, including protecting against automated attacks and bot farms.
  • Run honeypot traps and spam-detection systems that identify abnormal automated behaviour and apply escalating penalties.

Moderation & compliance (Legitimate interests / Legal obligation)

  • Enforce community rules; remove illegal or unsafe content; cooperate with lawful requests from authorities where required.
  • Automatically evaluate reported content and behaviour using internal rules and third-party moderation models (for example, models that classify suspected child sexual abuse material, extreme violence, or other safety violations).
  • Apply automated enforcement actions, including message removal, progressive suspensions, and permanent bans for severe violations. For the most serious offences, we may process device/IP signals to apply and maintain hard bans.

Advertising (Consent / Legitimate interests where permitted)

  • Serve ads and rewarded ads via AdMob. In consent regions we ask for your choice between personalised and non-personalised ads and honour your preference.

Some enforcement actions (for example, automated message removal, suspensions, and bans) are the result of automated processing and profiling of reports and behavioural signals. See the "Your rights" section for information about rights related to automated decision-making where applicable law provides them.

5) Third-party services

We minimise vendors. When we use third parties, we ensure appropriate contracts are in place. Key services:

Third-party practices may change; see their privacy documentation for the latest details. Where a vendor is an independent controller, you may need to exercise certain rights directly with them.

6) Retention

7) International transfers

Our infrastructure and vendors may process data in multiple countries. When transferring personal data from the EEA/UK, we rely on appropriate safeguards (for example, Standard Contractual Clauses) and implement additional measures when required.

8) Security

We use administrative, technical, and organisational measures appropriate to the risk, including access controls, encryption in transit, rate-limiting, abuse detection, honeypot traps, and regular reviews. No system can be 100% secure; you should use strong passwords and keep your device updated.

9) Your rights

GDPR / UK GDPR

  • Access, rectify, erase, or port your data.
  • Restrict or object to processing where applicable.
  • Withdraw consent (for example, switch ad personalisation off) at any time.
  • Lodge a complaint with your local supervisory authority; in Ireland, the Data Protection Commission.

CPRA (California)

  • Right to know, delete, correct, and limit use of sensitive data.
  • We do not sell your personal information for money. Ad-supported delivery may be considered “sharing” for cross-context behavioural advertising; you can opt for non-personalised ads via the in-app consent controls.
  • Right to opt out of sharing for cross-context behavioural advertising.

Moderation and enforcement are largely automated and may have significant effects (for example, account suspensions or permanent bans). There is currently no in-app appeal interface. However, you may contact us by email if you believe an enforcement action is clearly wrong or was applied to you in error. Where applicable law grants you the right to obtain human review of an automated decision, we will comply with those obligations.

10) Children

Vanish is not directed to children. In the EEA/UK, you must be at least 16 (or the lower age of digital consent set by your country) to use the app. We do not knowingly process personal data of children. If you believe a child is using the service, contact us and we will take appropriate action, including deletion where required.

11) Cookies & tracking

The app itself does not use browser cookies. Our website may use essential cookies for security and performance. AdMob and other vendors may use SDK-based identifiers (for example, AAID) and similar technologies for ad delivery and measurement.

User controls

  • Use the in-app consent prompt to choose personalised or non-personalised ads; change later in settings where available.
  • Reset your device’s advertising ID (Android: Settings → Google → Ads).
  • Limit ad tracking in your device settings.

12) Do Not Track

Some browsers send a “Do Not Track” signal. Because there is no common industry standard, we do not respond to DNT. We honour regional legal requirements (for example, consent choices in the EEA/UK).

13) Law-enforcement & compliance

We may preserve and disclose information if we reasonably believe it is necessary to: comply with applicable law, a valid legal process, or governmental request; enforce our Terms and Rules; protect the safety, rights, or property of users or the public; or detect and prevent fraud, security, or technical issues. We narrowly scope any disclosure and challenge overbroad requests where appropriate.

14) Changes to this policy

We may update this policy to reflect changes to the app, our practices, or legal requirements. We will post the updated version here and adjust the effective date. If changes are material, we will provide additional notice in-app where feasible.