Nereu Privacy Policy

This Privacy Policy explains how [legal name and address to be confirmed] ("Nereu," "we," "us," or "our") handles personal information when you use Nereu. It applies to the website, accounts, the editor, published games, Bibi, and support interactions that link to this policy.

The identity and address of the data controller, the privacy contact, and any required representative remain to be confirmed before this policy takes effect.

1. The information we handle

Account and profile information

We store your email address, verification state, password hash and its security parameters, display name, username if you choose one, avatar, public profile identifier, account and activity timestamps, plan or entitlement information, game count, and last-used game. We do not store your password in readable form.

At signup or invite redemption, we record the Internet Protocol (IP) address and a shortened browser user-agent string. Sessions also record an IP address, user-agent string, creation time, activity time, and expiration time. Login, signup, verification, password-reset, and abuse-prevention attempts may record an IP address, identifier, outcome, and time.

If you join a waitlist, we store your email address, status, timestamps, newsletter choice if offered, invitation information, and limited request metadata used to prevent abuse.

Games and activity

We store the games and levels you make, including their name, description, settings, entities, rules, thumbnail, visibility, version history, ownership, collaborator information, and technical metadata. If you choose public visibility, your public profile identifier, display name, avatar, and public games can be seen by anyone. An unlisted game can be seen and forwarded by anyone with its link.

We also record which days you were active in Nereu and whether you saved a game on each of those days, to measure whether Nereu is worth coming back to. For each such day the record holds your account identifier, the date (in UTC), the time of your first and last activity that day, and whether you saved. It does not hold what you made, which games you opened, your IP address, or your device. We read it only as counts across many makers, and it is kept in our own database: no third-party analytics service and no extra cookie is involved.

Bibi conversations

To answer you, Bibi processes your message, recent conversation history, relevant game context, available tools, and tool results. This material is sent to Anthropic's commercial API.

Nereu also writes a product-improvement turn log. It can contain your account and game identifiers; up to 4,000 characters each of your message and Bibi's reply; tool names and limited arguments; limited tool-result messages; outcome and error information; model and token use; latency; locale; editor build; message source; history length; level-context size; entity count; selection count; and how many tools were withheld. It does not keep the full level context or the identities of selected assets in that log. Text and tool data are clipped to limits defined in editor/server/bibi-turn-log.js.

The full context may still be present in your game data or conversation state needed to operate the product. The 90-day turn log is a separate diagnostic record.

Asset search

Nereu processes words you enter in asset search. Production currently uses lexical search. In environments where Voyage AI semantic search is enabled, the search text can be sent to Voyage AI to create an embedding. Asset names and descriptions are also embedded for search. Voyage is not used for Bibi messages in the current design.

Payment information

Nereu does not currently offer paid subscriptions. If paid plans launch, Stripe will collect payment details and send Nereu customer, subscription, plan, payment status, and billing-portal identifiers. Nereu should not receive or store full payment-card numbers. Checkout must link to the policy in effect at that time.

Technical and support information

We and our hosting providers process request metadata, security events, build identifiers, device and browser information, crash or performance information, and server logs. If you contact us, we process the message and information you choose to include.

The reviewed product does not contain advertising trackers or third-party ad cookies. It uses browser storage and session credentials for sign-in, product state, preferences, and security. Deployment must be checked again before this statement is published.

2. Why we use information

We use information to:

• create, authenticate, secure, and support accounts;
• save, run, publish, share, and, when enabled, remix games according to a maker's choices;
• answer Bibi requests and execute the changes a maker requests;
• operate asset search and recommend relevant supplied assets;
• measure reliability, diagnose failed turns, improve prompts, tools, and product design, prevent abuse, and enforce fair-use limits;
• measure, as counts across makers, how many come back to Nereu after their first day, from the record of which days each account was active;
• send verification, password-reset, security, service, and requested newsletter messages;
• administer a future subscription and meet accounting obligations;
• comply with law, protect rights and safety, and resolve disputes; and
• understand aggregate product use without selling personal information or serving targeted ads.

Depending on where you live, these purposes may rely on performance of a contract, Nereu's legitimate interests, consent, or a legal obligation. Counsel must assign and document the correct legal basis for each purpose and jurisdiction before this policy takes effect. Where consent is required, you may withdraw it without affecting earlier lawful processing.

3. Bibi, model use, and training

Nereu does not use ordinary makers' games, prompts, replies, or turn logs to train its own models. A training contribution requires a separate, explicit, versioned agreement from an eligible contributor. Saying yes to these Terms or using Bibi is not that agreement.

Anthropic processes Bibi inputs and outputs to provide the commercial API. Anthropic states that commercial API inputs and outputs are not used to train its models by default. Anthropic also states that standard API inputs and outputs are normally deleted from its systems within 30 days, subject to its agreements and exceptions for law or policy enforcement. Anthropic's current terms, not this summary, control its handling:

• Commercial terms and policy collection
• Is my data used for model training?
• How long do you store my organization's data?

Do not put sensitive personal information in a Bibi message. Nereu should configure provider settings and contracts to preserve no-training treatment and the shortest practical retention.

4. When information is shared

This draft assumes that Nereu will not sell personal information or share it for cross-context behavioral advertising. Arturo and counsel must confirm that business rule before publication. Subject to that confirmation, we share personal information only as described here:

• Other people. A public profile or public game is visible to anyone. An unlisted game is visible to anyone with its link. Remixing creates a separate copy for the maker who chooses "Make your own."
• Service providers. Providers process information for Nereu under their contracts and security terms, as listed below.
• Legal and safety reasons. We may disclose information when we reasonably believe law requires it or it is necessary to protect a person, investigate fraud or abuse, secure Nereu, or establish or defend legal claims.
• Business changes. Information may transfer as part of a merger, financing, acquisition, reorganization, or sale of the service, subject to applicable law and notice requirements.

5. Service providers

The current and planned provider map is:

Before publication, Nereu must confirm each provider's legal entity, processing location, data-processing terms, subprocessors, transfer mechanism, and security settings. This table must change when actual deployment changes.

6. Retention

Nereu keeps information only as long as reasonably needed for the purposes above, subject to these current system periods:

Account, profile, waitlist, game, and level data do not currently have an automatic deletion period. They remain while the account or operational record is needed, until a valid deletion request is completed, or as law requires. Provider backups and security logs may take longer to cycle out.

The 90-day Bibi turn-log period is the current code behavior, not a final legal ruling. Nereu should keep it only if the product need and legal review support that duration.

If paid plans launch, billing and transaction records may need a longer tax, accounting, fraud-prevention, or chargeback period. That period must be stated before launch.

7. Your choices and rights

You can choose a game's visibility and can change or delete a game through the available product controls. Public-profile edits and session logout controls are also available. Public visibility is not currently offered in the normal editor sharing control; the product currently offers private and unlisted sharing.

The current product does not provide self-service account deletion or a complete account-data export. Until those tools ship, Nereu must provide a working request path at arturo@nereu.co. Through that path, you may ask to access, correct, export, or delete personal information, object to or restrict processing, or withdraw consent, where your law provides that right. We may need to verify the request and may retain limited information when the law permits or requires it.

An approved deletion procedure should unpublish games promptly, offer a short opportunity to obtain eligible data, delete or de-identify account-linked records, revoke sessions and tokens, and complete the request within a stated period. The treatment of public games and independently created remix copies must be settled before this policy takes effect.

You may also have a right to complain to the privacy or data-protection authority where you live. The policy must name the appropriate Colombian authority and any representative once the controller and launch jurisdictions are confirmed.

8. People under 14

Nereu is for people age 14 and older. We do not knowingly provide accounts to children under 14. If we learn that an account holder is under 14, we will suspend the account and delete the person's information as reasonably practicable, unless we must retain limited information for safety or law. A parent or guardian may contact arturo@nereu.co.

Age 14 does not end every rule for minors. Some countries require parental authorization or special safeguards for people under 18. Nereu does not currently offer a parental-consent flow. Counsel must confirm the launch rules under COPPA, GDPR Article 8 and national age choices, Colombia's Law 1581 and related rules, and other applicable law.

9. Security and international transfers

Nereu uses measures such as password hashing, expiring session tokens, least-privilege provider credentials, rate limits, access controls, and encrypted network connections. No system can promise perfect security.

Providers may process information outside your country. Before this policy takes effect, Nereu must identify the controller's home country, hosting and processor locations, and any contractual clauses, certifications, adequacy decisions, or other transfer safeguards that apply.

10. Changes and language

Each published policy will show a version identifier and effective date. We will give appropriate notice of material changes. A privacy notice normally describes processing rather than asking for blanket consent; where a new use requires consent, Nereu will ask separately.

This policy is published in English only. The English text is the legal text. Nereu's product chrome around it appears in English, Spanish, Ukrainian, and Brazilian Portuguese; those labels are not the policy. If Nereu later provides a translation, it will be for convenience, and the English text will still control unless local law requires otherwise. The controlling-language approach still requires legal approval.

11. Contact

Privacy requests and questions: arturo@nereu.co. [Legal name and postal address to be confirmed.]