What we collect, why, for how long, and how you get rid of it.
Vibeing works without an account. If you open one, we keep the minimum needed to make it work: name, email, an encrypted password, your sparks, the decks you open and the answers you choose to write.
Nobody reads the answers you write except you. We do not profile you with them, we do not sell them, we do not feed them to anyone.
Analytics and the Meta advertising pixel only start if you consent, one at a time, and you can withdraw that consent whenever you want.
You can download everything we hold about you, and you can delete your account with all its content, from your profile, at any time.
The data controller is Michele Pierangeli, Via Corno di Cavento 7, 20148 Milano (MI), Italia — P. IVA 08874630968.
For any question about your data, or to exercise the rights described in section 7, write to weare@vibeing.it.
| Data | When | Why |
|---|---|---|
| Name and email | when you create an account | to identify you, let you back in, and contact you if the service requires it |
| Password | when you create an account | stored encrypted only (scrypt with salt): it is not readable, not even by us |
| Written answers | only if you choose “Write the answer” | to show them back to you in your profile |
| Decks and questions you create, and the code to share them if you create one | when you use the workshop | so you can play your own decks; if you share one, whoever has the code or the link sees its name, subtitle and questions, never your name |
| Decks you received from other people | when you open a shared deck and keep it | to show them in your list; without an account the codes stay only in your browser |
| Cards drawn, outcomes, sparks, unlocks | while you play with an account | to open levels, avoid repeating cards, and count sparks |
| Question of the day: whether you answered, what you wrote, days in a row | when you answer with an account | to give you one question a day, and to count sparks and the run of days |
| Daily reminder: the address your browser gives us for notifications, the time you pick and your time zone; without an account, also the language and the day you have already answered | only if you turn the reminder on, with or without an account | to send you one notification a day that reminds you of today’s question (with the full version, the notification contains the question itself), if you have not answered yet; you remove them when you turn it off or close the account (without an account, when you turn it off or the browser withdraws permission) |
| Declaration of adulthood (the date) | when you state, from your profile, that you are at least 18 | to remember that you stated you are at least 18, so we do not ask again |
| Request for a new password: a code (we keep only its fingerprint) that expires after one hour | only if you click “I forgot my password” | to email you the link to choose a new one; the code is deleted as soon as you use it or it expires |
| Email verification: a code (we keep only its fingerprint) that expires after 48 hours, and the date you verified it | when you sign up, or when you ask for it from your profile | to check that the address is yours: it is needed to buy and to find you again |
| Your invitation code and, if you sign up with an invitation, who invited you | when you open your profile; when you sign up with a friend’s code | to give sparks to the person who invites. They only see how many friends joined, not who they are |
| Language you picked | when you switch language | to bring the site back in the right language |
| Look of the game | when you create the account (picked at random) and when you change it | to bring the game back with the look you have |
| Browsing analytics | only with your consent | to understand which parts of the site get used |
| The campaign you came from (the utm parameters in an ad’s link: source, medium, campaign name, ad) | when you create an account after arriving from a link that carries them | to know which campaigns bring people and purchases; the panel only shows totals per campaign, never who came from where |
| For Meta: a hash of your email and of your account number, IP address, browser and the pixel cookies | only with consent to advertising, when you create the account and when you buy | to tell Meta that an ad led to a sign-up or a purchase (Conversions API). The purchase context is deleted as soon as it is sent |
Without an account the game works just the same: your progress stays in your browser (localStorage) and never reaches us.
We do not collect your location. Without your consent to advertising we do not follow you across other sites and we run no targeted advertising; with it, see section 5.
These deserve their own section, because they are the most personal thing the site keeps.
They are visible only inside your profile, behind your login. We do not read or analyse them: from the game data as a whole we keep only counts (how many answers, how many written), never the content. We do not pass them to third parties. Writing them is always optional: the game works fine with just “I answered” and “I pass”.
Some decks touch delicate ground. If an answer of yours mentions your health, your beliefs or your intimate life, you are choosing to enter a special category of data (art. 9 GDPR): the legal basis for that processing is your explicit consent, given the moment you decide to save that text. You can erase all of it at any time by deleting your account.
The practical advice is the one we would give a friend: write what you need in order to remember the conversation, not what you would not want written down anywhere.
| Purpose | Legal basis (art. 6 GDPR) |
|---|---|
| Letting you use the service: account, login, sparks, decks, progress | performance of the contract — (b) |
| Keeping the answers you write | consent — (a), and art. 9.2(a) where they contain special category data |
| Handling a purchase and the tax obligations that follow | contract and legal obligation — (b) and (c) |
| Keeping the service safe: sessions, abuse prevention | legitimate interest — (f) |
| Browsing analytics | consent — (a) |
| Measuring our campaigns and showing our ads on Instagram and Facebook to people who visited the site (Meta pixel and Conversions API) | consent — (a), art. 122 of the Italian Privacy Code |
| Knowing which campaign accounts come from (utm parameters) | legitimate interest — (f) |
Nobody, apart from the technical providers we cannot do without, who act as processors and only on our instructions:
We do not sell data and we do not use it to train artificial intelligence models. Meta only receives what is described above, and only with your consent: never the answers you write or the decks you play.
We may be required to disclose data to judicial authorities where the law compels us to.
Google Analytics may involve a transfer of data to the United States. Google LLC is certified under the EU-US Data Privacy Framework and applies the European Commission’s standard contractual clauses. If you do not consent to analytics, this transfer does not happen.
The same goes for Meta: Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework. If you do not consent to advertising, nothing reaches Meta.
The GDPR gives you the right to access your data, correct it, erase it, restrict or object to its processing, receive it in a machine-readable format, and withdraw at any time a consent you already gave.
Two of those you exercise yourself, without asking anyone, from your profile:
For anything else write to weare@vibeing.it: we answer within one month.
If you believe we are handling your data badly, you can complain to the Italian data protection authority (www.garanteprivacy.it) or to the supervisory authority of the country you live in.
You need to be at least 14 to open an account, which is the age Italian law sets for digital consent. If we find an account belonging to someone younger, we close it.
Decks marked 18+ ask questions about intimacy and sexuality, frankly, and are for adults only. To see them in the list we ask you to state, from your profile, that you are at least 18. It is a statement, not a check: we do not ask for documents, and the responsibility for telling the truth is with whoever makes it. If you are under 18, do not state it.
If we change anything substantial in this notice we say so inside the site before it takes effect. The date of the last update is always at the bottom of this page.