Privacy Policy

Effective: January 1, 2026

1. What we collect

When you sign up and use Voxa, we keep:

• Account basics — username, a hashed password (we never see your actual password), and the birth year you entered at sign-up.
• Profile info you choose to add — display name, bio, avatar colors, avatar items you upload or buy.
• Worlds and assets you create — published worlds, uploaded shirts / hair / decals / videos / sounds, gamepasses, scripts.
• Activity inside Voxa — friends list, favorites, achievement progress, world-play history, VoxUs balance + transactions, comments and votes you leave.
• Messages — chat in worlds (auto-deleted after 60 seconds), comments on worlds, DMs between friends. These pass through an AI moderator (currently Groq + Llama 3.3) before posting.
• Voice chat audio — only while you hold push-to-talk; it goes peer-to-peer to nearby players and is not recorded on our servers.
• Technical info — your IP address briefly for security / abuse prevention, and basic device info your browser sends.

2. What we don't collect

• We never ask for your real name, school, phone number, or street address.
• We don't collect facial images or biometric data.
• We don't run third-party advertising trackers.
• We don't read messages outside the moderation pass described above.

3. Why we collect what we collect

Each piece has a specific purpose. We don't collect it "just in case":

• Username + password — to let you sign in.
• Birth year — to apply age-appropriate default settings (under-13s get DMs and open voice chat turned off by default).
• Worlds / assets / friends — to make the game work.
• Messages — so other players can see them, and so our moderator can block harmful content before it spreads.
• IP address — to stop spam, ban abusers, and protect accounts from being broken into.

4. Who else sees your data

We use a small number of services to run Voxa. They only see what they need to do their job:

• Firebase (Google) — stores accounts, worlds, social graph, and serves the website. Their privacy policy applies to the data they handle on our behalf.
• Backblaze B2 — hosts uploaded assets (shirts, decals, videos, world files, thumbnails).
• Groq — runs the AI moderator. Your chat / comment text is sent to Groq for a yes/no safety check; Groq states it does not train on this content.
• Stripe — handles VoxUs purchases. We never see your card number; Stripe does, and is regulated for payment security.

We don't sell, rent, or trade your data to anyone for advertising or any other purpose.

5. Users under 13 (COPPA)

Voxa applies extra protections for players under 13. They automatically get:

• Direct messages with strangers off by default.
• Open voice chat off by default.
• Friend requests from non-friends blocked by default.
• Stricter moderation thresholds on chat and comments.

If your child is under 13 and you'd like to review, change, or delete their data, email us at the address below — we'll respond quickly.

6. How long we keep things

• Account + worlds + uploads — kept as long as your account exists.
• Chat messages — automatically deleted from our servers 60 seconds after sending.
• Comments + votes — kept on the world until you delete them or your account is removed.
• Voice audio — never stored on our servers; it goes peer-to-peer between players in the moment.
• IP logs — kept up to 30 days for abuse review, then deleted.

7. Your rights

You can, at any time:

• See your data — most of it is visible in your account already. Email us if you want a full export.
• Edit or fix your data — change your profile in Settings.
• Delete your account — request deletion via Settings or email. We'll remove your account, worlds, uploads, and history within 30 days.
• Object to or restrict processing — let us know what you want stopped and we'll do our best.

8. Security

Passwords are hashed by Firebase Authentication. All traffic between you and Voxa is encrypted with HTTPS. Database access is restricted by per-user security rules so other players can't read your private data. If we ever suffer a data breach that affects you, we'll notify you by email and post a notice on the site within a reasonable time after we become aware of it.

9. Cookies + local storage

We store your sign-in token in your browser's local storage so you don't have to log in every time. We don't use third-party advertising or tracking cookies. Closing the site or signing out wipes the token.

10. Changes to this policy

If we change anything important, we'll post a notice on the site and email any address you've given us. The "Effective" date at the top of this page reflects the most recent update.

11. Contact

Questions, complaints, or requests about your data — reach out and we'll respond:

• Email: hello@voxagames.net