This Privacy Policy explains how Sparrow Soul ("we", "us", "our") handles personal information when you use Virtunatia: the website at virtunatia.com, the Virtunatia mobile app, and the services behind them (together, the "Services").
It is written to match what our systems actually do. Where we name a company, it is because your information really goes there; where we give a number, it is the one our systems are configured with. If something here does not match what you experience, tell us at contact@virtunatia.com.
Summary
- What we collect. An email address, a username, an optional display name and a password when you create an account. Technical records when you use the Services: the address and browser or device you connect from, error reports, and — with your consent — analytics about how the Services are used.
- What we do not collect. Your precise location, your contacts, photos, camera or microphone, payment details, or anything from social networks. We do not buy or receive data about you from anyone else, and we do not sell or share personal information for advertising.
- Who processes it for us. A small set of providers, all listed in Who we share information with — hosting, database, email delivery, analytics, error reporting, the screening of usernames, and app updates. They store data in the United States.
- How long. Your account for as long as you keep it; technical records for short windows; analytics the longest. Details are in How long we keep information.
- Your choices. Change or delete your account yourself at virtunatia.com/account, accept or decline analytics on the website and in the app — and change that choice at any time — and contact us to exercise any other right.
1. Who we are
The Services are operated by Sparrow Soul, the team building Virtunatia, which decides how and why the personal information described in this policy is processed. The company that will own and operate the Services is being registered; this section will name it, with its registered address, when that is done and before the Services open to the public. Until then you can reach us at contact@virtunatia.com.
2. What this policy covers
This policy applies to the website, the mobile app, and the servers and email messages that support them. It does not apply to other websites and services we link to — for example our social-media pages or the app stores you install the app from — which have privacy policies of their own.
Virtunatia is in pre-alpha development, and this policy describes the Services as they exist today: an account, the website and an early version of the app.
3. Information we collect
3.1 Information you give us
When you create an account we ask for:
- an email address, which we verify with a 6-digit code before the account is activated;
- a username, a public handle made of lowercase letters, digits and hyphens;
- an optional display name, shown in place of your username where the Services show a name;
- a password, stored only in hashed form.
When you sign up we also record the date and time you accepted the Terms of Service and this Privacy Policy. Later changes to your email address, username, display name or password are recorded in an audit log attached to your account, together with sign-ins to it.
Do not put anything in your username or display name that you would not want other people to see: they are shown to other users (see Other users). Before one is accepted we screen it for offensive content (see Service providers).
If you write to us — by email, or through any support channel we offer — we keep the message and your contact details for as long as we need them to reply and to keep a record of the exchange.
3.2 Information collected automatically
Session records. When you sign in we create a session. Alongside the session token we record the IP address and the browser or app identification string ("user agent") the session was created from. How long a session lasts, and how long its record is kept, is in section 8.
Server logs. Our hosting provider keeps short-lived request logs: the address you connect from, what you requested, the response and timing, and the user-agent string. We use them to keep the Services running and to investigate problems and abuse.
Error reports, logs and performance traces. Our website, app and servers report errors and technical logs to Sentry. A report contains the error, the code that produced it, the page or screen you were on, the requests it made and recent console messages. From the website it also carries the browser, operating system and device type derived from the user-agent string. From the app it carries what the reporting software reads from the device itself — the operating system's name and version, the device's model, manufacturer, memory, storage, screen size, locale, time zone and battery state, and similar details — and a random per-installation identifier that it attaches as the report's user id. From our servers a report carries the request's URL, including any query string, its method, the user-agent string, the content type of what was sent and our hosting provider's identifier for the request, and may include your account identifier. It carries no cookies — so never your session token — no authorisation header and no other request header, which keeps out the headers in which our hosting provider passes the approximate location of the address a request came from; and the reporting software does not record your IP address. Performance traces — how long a page load, navigation or request took — carry the same context, with the same exclusions; the website and the app send them only while you have accepted analytics, and our servers' traces do not depend on that choice. Every report and trace is labelled with the version of our software that produced it; those labels describe our software, not you.
Analytics. We use PostHog to understand how the Services are used. What it collects, and when, depends on where you are:
- On the website, analytics are off until you accept them in the cookie banner; declining, or ignoring it, means the analytics software is never loaded, and you can reset the choice at any time on your account page or in the Cookie Policy. Once accepted, PostHog records the pages you view and leave; your clicks and interactions with page elements, including the text of the element you clicked — which is your own username or display name when you open the account menu; the address you came from and any campaign parameters in the link you arrived by; the browser, operating system, screen size, language and time zone of your device; and labels naming the version of our software. It assigns your browser a random visitor identifier.
- In the app, analytics are off until you accept them in the prompt the app shows when it is first opened; declining, or ignoring it, means the analytics software is never started, and the Analytics switch on the account screen turns them on or off at any time. Once accepted, PostHog records the screens you view; when the app is opened (including the address of a link that opened it), brought to the foreground or sent to the background; that the device is a mobile device, and its screen size; the version of our app and of its code; and labels naming the version of our software. It does not receive the operating system, the device model, the locale or the time zone. The app assigns the installation a random identifier, stored on the device and removed when you turn analytics off.
PostHog receives the IP address with every event, as any server does, but our projects are configured to discard it on arrival and to derive no location from it, so neither is stored. We do not identify you to PostHog: it receives no email address or account identifier, and its records describe a browser or an installation rather than an account — although, as above, the text of what you click on the website can include your username.
Rate-limiting records. To protect the Services from abuse we count sign-in attempts per IP address over windows of a few seconds, and verification-code requests per email address over one-minute windows.
3.3 Information we do not collect
We do not collect your precise location, your contacts, your photos, or anything from your camera, microphone or other device sensors, and the app requests no such permissions. We do not offer sign-in through Google, Apple or any other identity provider, and we receive nothing about you from social networks or data brokers. We do not process payment information, because nothing in the Services can be bought yet. We do not knowingly process sensitive categories of information such as health, racial or ethnic origin, political opinions, religious beliefs or sexual orientation, and we ask you not to put any in your username, display name or messages to us.
4. How we use information
We use the information above to:
- provide the Services — create and secure your account, sign you in, verify your email address, send you the verification and password-reset codes you request, and remember your settings;
- keep the Services safe — detect and limit abusive traffic, prevent duplicate or fraudulent accounts, screen usernames and display names for offensive content, enforce the Terms of Service, and keep an audit trail of changes to your account;
- run and improve the Services — find and fix errors, measure performance, and understand which features are used and how, so we can decide what to build and change;
- communicate with you — answer your messages and send you service notices, such as changes to our terms and policies;
- comply with the law — respond to lawful requests and protect our legal rights.
We send only the emails the Services need to work today: sign-up confirmation, email-change confirmation and password-reset codes. We do not send marketing emails, and we will ask for your permission before we ever start.
We do not use personal information for targeted advertising, and we make no decisions about you by purely automated means that have legal or similarly significant effects.
5. Legal bases
If you are in the European Economic Area, the United Kingdom, Switzerland or another country whose law asks us to name a legal basis, these are the ones we rely on:
| Purpose | Legal basis |
|---|---|
| Creating and operating your account, sending verification and reset codes, keeping your sessions | Performance of a contract — the Terms of Service |
| Rate limiting, duplicate-account checks, screening usernames and display names, audit logs, revoking sessions | Legitimate interests in keeping the Services secure and free of abuse |
| Error reports and technical logs | Legitimate interests in keeping the Services working |
| Performance traces from our servers | Legitimate interests in keeping the Services working |
| Analytics, and the performance traces the website and the app send with them | Consent, given through the cookie banner on the website and the first-launch prompt in the app, and withdrawable at any time (see Your rights) |
| Answering your messages and sending service notices | Legitimate interests, or performance of a contract where the notice concerns your account |
| Responding to lawful requests, keeping records the law requires | Legal obligation |
Where we rely on legitimate interests we have weighed them against your rights, and you can object at any time — see Your rights.
6. Who we share information with
We do not sell personal information, and we do not share it with anyone for their own advertising or marketing. Information is shared only in the situations below.
Service providers
These companies process information on our behalf, under their data-processing terms, only to provide the service named. Each receives what that service needs and nothing more: the moderation service, for example, receives the proposed username or display name and no account identifier, email address or IP address with it. All of them are based in the United States and store information there; Vercel's and Cloudflare's networks are global.
| Provider | Purpose |
|---|---|
| Vercel | Hosting for the website and the app's server |
| Neon (a Databricks company) | Our main database |
| Upstash | The cache for active sessions, pending verification codes and rate-limit counters |
| Cloudflare | DNS for our domains |
| Resend | Delivery of the verification and password-reset emails |
| PostHog | Product analytics and feature flags |
| Sentry | Error reporting, technical logs and performance traces |
| OpenAI | Screening usernames and display names for offensive content |
| Expo | Building the mobile app and delivering its updates; the app sends Expo its version, platform and a random installation identifier when it checks for one |
The app stores are not our providers: what Apple or Google collect when you install or update the app is governed by their policies.
Other users
Your username and display name are shown to other users wherever the Services show who you are. Nothing else about your account is visible to other users.
Legal reasons
We may disclose information if we believe in good faith that the law requires it — for example in response to a court order or a lawful request from a public authority — or that it is necessary to protect the rights, property or safety of us, our users or others, or to detect and prevent fraud or abuse.
Business transfers
If Sparrow Soul or the Services are sold, merged or reorganised, personal information may be transferred to the successor, who will be bound by this policy unless and until they tell you otherwise.
7. International transfers
Our providers store and process information in the United States, whatever country you use the Services from. Data-protection law there may differ from the law in yours. Where the law of your country requires safeguards for such a transfer, we rely on the safeguards our providers offer for it — including the European Commission's and the United Kingdom's standard contractual clauses, and, for providers certified under it, the EU-US Data Privacy Framework — and on our providers' own commitments to protect the information they hold for us.
8. How long we keep information
| Information | Kept for |
|---|---|
| Your account, and the audit log of sign-ins and changes to it | Until you delete the account, or we close it under the Terms of Service |
| Sessions, including the IP address and user agent they were opened from | A session can be used for up to 30 days and is refreshed while you keep using it. Its record is removed when you sign out, when we revoke it, when it is next presented after expiring, or when the account is deleted — so the record of a session from a device that never returns lasts until the account does |
| Verification codes (stored hashed) | Valid for 15 minutes, after which they cannot be used; the record goes when the code is used, when it is replaced, when it expires, or when the account is deleted |
| Rate-limiting records | Counted over windows of seconds to a minute. The counter for an email address covers a one-minute window; once that window has passed, the record is removed the next time anyone requests a verification code, and it is removed when the account is deleted |
| Server logs | A short window at our hosting provider — at most a day |
| Error reports, technical logs and performance traces | 30 days |
| Analytics events, without the IP address or any location | Up to seven years. On the website you can ask us to delete the events tied to your browser; we need the visitor identifier from its analytics cookie to find them. The app does not yet show its identifier, so its events cannot be singled out |
| Our staff's own action log — what staff did to which account, including any email address, username or display name they set | Kept as a record of staff activity; not deleted with the account |
| Messages you send us | As long as we need them to reply and to keep a record of the exchange |
We may also keep a record needed to enforce the Terms of Service or to meet a legal obligation for as long as that need lasts.
When you delete your account — from virtunatia.com/account, in the app, or by asking us — the account record, its sessions and credentials, the audit log attached to the account and the rate-limit counter for your email address are deleted at once, and any pending verification code stops working within 15 minutes at the latest. Our staff's action log is kept as described above; server logs and error reports expire on their own schedule. Analytics events are not linked to your account and are not affected by deleting it.
9. Security
We protect personal information with measures appropriate to what we hold. Connections to the Services are encrypted, passwords and verification codes are stored only in hashed form, and sign-in is rate limited. Access to account data is restricted to the staff who need it to run the Services.
No system is perfectly secure, and we cannot guarantee that unauthorised parties will never defeat our measures. If we learn of a breach affecting your personal information, we will tell you and the relevant authorities as the law requires.
10. Children
The Services are not intended for anyone under 16 — the Terms of Service set the age rule — and we do not knowingly collect personal information from anyone under that age. If you believe someone under 16 has created an account, write to contact@virtunatia.com and we will delete it.
11. Your rights
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to restrict or object to how we process it, to withdraw a consent you have given (which does not affect what was done before you withdrew it), and to complain to a supervisory authority.
You can change your email address, username, display name and password, and delete your account, at virtunatia.com/account or in the app. For anything else — a copy of your information, an objection, or deleting the analytics events tied to your browser — write to contact@virtunatia.com. We verify a request against the email address on your account, or against the visitor identifier in your analytics cookie for a request about analytics; an authorised agent acting for you must show your written permission. We answer within the time the law allows and never treat you differently for asking. You can withdraw your analytics consent at any time: on the website, reset your choice on your account page or in the Cookie Policy; in the app, turn analytics off on the account screen. Either takes effect at once and removes the analytics identifier from your browser or device.
If you are in the EEA, the United Kingdom or Switzerland, you can also complain to your data-protection authority — we would appreciate the chance to address your concern first.
12. Residents of the United States
If you live in a US state with a consumer-privacy law, you have the rights listed in section 11, exercised the same way, and the right to opt out of the sale or sharing of your personal information and of profiling. We do not sell personal information and do not share it for targeted advertising, and have not done so in the past twelve months. The categories we collect are those in section 3 — identifiers, and internet and app activity — collected from you and your device, used as section 4 describes, and disclosed only to the providers in section 6. We do not collect sensitive personal information as those laws define it. You may use an authorised agent as section 11 describes, and you may appeal a refused request by replying to our answer.
13. Do Not Track and Global Privacy Control
Our website does not read or respond to browser "Do Not Track" signals or the Global Privacy Control header; the cookie banner, and the choice you can reset afterwards, are the control for analytics.
14. Changes to this policy
We will update this policy when the Services change in a way that affects your information — for example when a new feature is added or a provider changes. The date at the top is the date of the current version. For material changes we will post a notice on the website or email the address on your account before the change takes effect.
15. Contact
Questions, requests and complaints about this policy: contact@virtunatia.com.