REWINDPrivacy Policy
This policy explains how REWIND collects and uses information when you visit rwd.2bd.net, create an account, use the browser studio, publish a place, or submit catalog assets. It is written for REWIND’s current prototype features. It must be updated before new features such as chat, payments, advertising, analytics, or multiplayer are added.
1. Who is responsible for your information?
Controller/operator: Soheil Zourak, operating the REWIND project. No separate company has been identified in the project records. The operator determines why and how account and creator data are used.
Privacy contact: [Add a monitored privacy contact email address]
Postal contact: [Add the operator’s service address or other legally required contact details]
Do not send passwords, identity documents, or another person’s private information in a privacy request.
2. Information REWIND handles
| Category | Examples in this build | Why it is used |
|---|---|---|
| Account and sign-in data | Username, optional email address, password verifier (a salted PBKDF2 hash; REWIND does not store the plain-text password), account role. | Create the account, authenticate you, prevent account duplication, provide account features, and secure the service. |
| Age and supervision data | Date of birth supplied at signup; a child/supervisor account link, request status, approval decision, and the supervisor’s authority attestation. | Apply the 13+ minimum, require an approved 15+ supervisor link for designated experiences for users under 15, and keep a record of that decision. |
| Session data | A random session cookie in your browser; a cryptographic hash of that token and its expiry in the database. Sessions expire after 30 days. | Keep you signed in and protect authenticated requests. |
| Creator content | Place names, descriptions, genre, scene/layout JSON, Luau source, avatar settings, asset names/descriptions and uploaded files. | Save, render, publish, moderate, and operate creator features. |
| Moderation and support | Asset status and reviewer, account role changes, submitted support correspondence, and technical errors logged by the API host. | Review content, enforce the rules, resolve requests, and diagnose failures. |
| Basic request information | Your browser necessarily sends network and request information to the site/API and their hosting providers. Provider logs may include IP address, timestamps, user agent, and requested paths. | Deliver the site, prevent abuse, maintain availability, and investigate errors. |
Email is optional in the current signup form. REWIND does not currently ask for a real name, phone number, payment details, contacts, precise location, or government identity document. Do not place personal or confidential information in a public username, place, script, image, audio, or other upload.
3. Purposes and legal bases
- Account, sign-in, saving places, avatar settings, and requested uploads: to provide the features you request and administer the account. Where applicable, the basis is performance of the service relationship; for a minor, the validity of that relationship remains subject to applicable law and parental authority.
- Age screening and supervision links: to apply REWIND’s eligibility and safety rules, protect children, and restrict designated experiences. For processing that relies on consent, users under 15 in France must have the child’s and the person holding parental authority’s joint consent where French law requires it.
- Security, abuse prevention, moderation, and reliability: legitimate interests in operating a safe, reliable platform, balanced against users’ rights; legal obligations where applicable.
- Optional future uses: REWIND has no behavioral advertising, analytics product, or promotional email feature in this build. If those are introduced, this notice and any required consent choices will be updated first.
4. Children, minimum age, and supervised experiences
REWIND accounts are limited to people aged 13 or older. Signup asks for a date of birth and rejects dates indicating an age under 13. The date is self-declared; this implementation does not independently verify identity or age.
Users aged 13 or 14 must request a link to an existing REWIND account belonging to someone aged 15 or older. That account holder must approve the request and attest that they are the child’s parent/legal guardian or are authorized by that person. Until approval, the child cannot see designated supervised experiences in the published-place feed. Creators can mark a place as requiring supervision.
A 15+ account is a platform rule, not proof that its holder is an adult or has legal parental authority. The account link does not replace any consent required by law, and REWIND currently does not check identity documents or independently verify the asserted family relationship. Users must provide truthful age information. A parent or guardian should help a child understand this notice and the Terms.
For France, a child who is at least 15 may consent independently to certain online-service processing that is based on consent. Below 15, consent for those consent-based processing purposes must be given jointly by the child and the person holding parental authority. Age 15 does not create general legal adulthood or automatically establish capacity to enter every contract. The applicable rules depend on the processing and jurisdiction.
5. When content is public
When you publish a place, its discovery information (such as its name, description, genre, creator username, and approved icon) is intended to be visible to other visitors. Uploaded catalog assets are held for moderation; an approved asset may be displayed through the configured storage bucket. Do not publish content unless you have the rights and permissions needed to make it public. The present API saves scene/script data to the database, but the public site does not currently provide a full runtime for published places.
6. Cookies and local browser storage
The current account system uses one essential cookie named rewind_session. It is HttpOnly, used for sign-in, and set to expire after 30 days. In production it is marked Secure and configured for cross-site requests needed by the separate static site and API. The current build does not intentionally set advertising or analytics cookies. The browser may separately cache ordinary site files.
7. Service providers and recipients
Information is made available only to people and providers who need it for the purposes above:
- GitHub Pages/GitHub: serves the static website and its public files.
- Render: runs the REWIND API and may process operational request/error logs.
- Neon: hosts the PostgreSQL database containing account, session, creator, and supervision records.
- Configured S3-compatible object storage: stores uploaded icons, thumbnails, audio, decals, and models. The actual provider and region depend on the credentials configured by the operator.
- Authorities or other parties: only where a valid legal obligation, lawful request, or necessary protection of users and rights requires disclosure.
The operator must confirm provider names, data-processing terms, storage regions, and international-transfer safeguards in the actual hosting dashboards. REWIND does not sell personal information.
8. Storage, retention, and deletion
- Account records and saved content are kept while the account remains active and are deleted or de-identified after a verified deletion request, subject to records that must be retained by law or to resolve security/legal issues.
- Session records expire after 30 days; logging out invalidates the current session.
- Age and supervision records are retained while needed to enforce the age/supervision choice, then removed with the account or when the link is ended. A rejected request is not intended to be kept indefinitely.
- Uploaded files may remain in the bucket until the associated asset/account is removed and storage cleanup completes. Public copies, caches, or material copied by other users may take longer to disappear.
- Render, Neon, GitHub, and storage-provider backups/logs follow their own documented retention schedules.
This prototype does not yet expose a self-service delete-account control. To request access, correction, deletion, or removal of a supervision link, contact the privacy address above. The operator should publish a working address and set a practical response period before public launch.
9. Your privacy rights
Depending on where you live and the applicable law, you may have rights to access, correct, erase, restrict, object to, or port certain personal data; withdraw consent for future consent-based processing; complain to your supervisory authority; and ask questions about automated decisions. REWIND does not make solely automated decisions with legal or similarly significant effects in this build. Send a request to the contact above and identify the account username; the operator may ask for proportionate proof that you control the account. Do not email an ID document unless the operator explains why it is necessary and provides a secure method.
In France, you may also contact the CNIL. A parent or legal guardian may contact REWIND about a child’s account, subject to proportionate verification of their authority and the child’s rights and interests.
10. Security
REWIND uses password hashing, HTTP-only session cookies, role checks, parameterized database queries, upload signing, and a moderation state for catalog assets. No internet service can promise perfect security. Use a unique password, keep it private, and report suspected account compromise promptly. The operator should maintain backups, access controls, patch dependencies, incident procedures, and provider agreements as the platform grows.
11. International use and transfers
The project is hosted by providers whose regions are selected in service configuration. REWIND cannot accurately state current data residency until the operator checks the active Render, Neon, and bucket regions. Where information is transferred outside the EEA or another protected region, the operator must identify the transfer and use an applicable legal mechanism and safeguards.
12. Changes and contact
Material changes will be reflected by a new version and effective date. Where law requires it, REWIND will ask for renewed consent or notify users before the change takes effect. For privacy requests, complaints, or questions, use [publish a monitored privacy email and postal contact].