Vibeworld Privacy Policy
Last updated: July 10, 2026
The honest summary: Vibeworld is a game made of real coding sessions. When you opt a session in, parts of it become visible to every other player — that is the product, not a side effect. We use that data to run the game and for nothing else. We don't sell it, we don't profile you with it, we don't train AI models on it. Sessions are private by default; nothing leaves your machine until you say so.
1. What we collect, and when
Nothing is transmitted unless you explicitly opt a Claude Code session in with /world on. For opted-in sessions only, the game client (the "harness" running on your machine) transmits:
- Your handle — the public name you chose.
- Your prompts, after local redaction (see §3).
- Approval/notification messages shown by Claude Code.
- Tool names only (e.g. "Bash") — never tool arguments, commands, file paths, file contents, or diffs.
- Short snippets of Claude's replies — only if you additionally
enable
shareReplies; first paragraph, 200 characters, redacted, and never anything containing a code block. - Coarse region — a country code or timezone name (e.g. "Europe/Istanbul"), used to place you in a district. Never GPS, never precise location, never your IP stored.
- Gameplay state — position on the fictional map, level, chat messages you type in-game.
2. Who can see it
Other players. Everything above is broadcast into the shared world — prompts and chats to players near you, your presence to anyone who walks by. Treat anything you share as public.
3. Redaction (best effort, not a guarantee)
Before anything leaves your machine, the harness scrubs: API keys and tokens (AWS, GitHub, Slack, OpenAI-style, JWTs, bearer tokens), private keys, long hex/base64 strings, email addresses, and phone numbers. Prompts that mention street addresses, SSNs, or passport numbers are dropped entirely. Redaction is a seatbelt, not a guarantee — the real control is that you choose which sessions go public. Don't type secrets into public sessions.
4. What we do NOT do
- No selling or sharing data with third parties for their purposes.
- No advertising, no tracking pixels, no analytics beyond server logs.
- No training of AI models on your data.
- No collection from sessions you did not opt in. Off is off.
5. Retention
The world is largely ephemeral: prompts and chats live as in-game speech bubbles and expire in seconds; presence data lives in server memory and is garbage-collected minutes after you leave. Persistent records are limited to: your handle and its authentication key, your level/progress, and (for Residents and Founders) your account entitlement; for invited Guests, an email-bound pass and its expiry. Standard web-server logs rotate briefly.
6. Payments
Founder purchases are processed by Stripe. Your card details go to Stripe, never to us; Stripe's own privacy policy applies to them. We keep only the checkout session reference needed to issue and re-issue your license.
7. Your choices
- /world off — stop sharing a session instantly.
- Delete
~/.claude-world/— removes the harness config and all opt-in flags from your machine. - Uninstall the hooks from
~/.claude/settings.json— total removal. - Contact us to delete your handle, progress, and license records.
8. Children
Vibeworld is not directed at children under 13, and we do not knowingly collect their data.
9. Changes
If this policy changes, the date above changes, and material changes will be announced in the world and on the landing page before they take effect.