Privacy Policy

Effective date: 14 July 2026

MyBackrooms.com (the "Site") and the MyBackrooms mobile app are operated by Ziweq ("we," "our," or "us"). This policy explains what personal data we collect, why we collect it, how long we keep it, who processes it on our behalf, and the choices you have. We collect only what the service needs to function — there is no advertising, no analytics SDK, and no cross-app tracking.

What we collect

• Account data — your email address, your public nickname, and, if you sign in with Google or Apple, the stable account identifier those providers share with us. If you use Apple's "Hide My Email", we only ever see the private relay address. Passwords (for email sign-up) are stored only as salted hashes.
• Content you create — the Backrooms you build (floors, rooms, textures, images, 3D models, page text), your votes, your play runs and leaderboard entries. Backrooms you publish, and the nickname on them, are visible to other users.
• Purchase records — if you buy Diamonds, we store the transaction reference from the payment provider (Stripe on the web, Apple's App Store in the iOS app) and your Diamond balance and spending history. We never see or store your card number — payment details go directly to the payment provider.
• Technical data — server logs including IP addresses, used for security, rate limiting, and abuse prevention.

Why we collect it

Solely to provide the service: signing you in, saving and publishing your creations, crediting and spending Diamonds, moderating public content (uploaded images and public text are screened automatically), answering messages you send us, and keeping the platform secure. We do not sell personal data, we do not use it for advertising, and we do not track you across other apps or websites.

How long we keep it

Your data is kept for as long as your account exists. Security logs are short-lived and rotate automatically. Purchase records are retained as required by accounting law.

Deleting your data

You can delete your account yourself at any time from Account settings → Personal data → Delete (in the app and on the web). Deletion is complete: your Backrooms, uploaded assets, reserved names, and account record are erased — not just deactivated. You can also export a copy of your personal data from the same page, or contact us for help with access, correction, or deletion requests.

Who processes data for us

• Microsoft Azure — hosting, database, and file storage (data encrypted in transit and at rest), and automated content moderation of uploads (Azure AI Content Safety).
• Google and Apple — optional sign-in providers, if you choose them.
• Stripe — card payments on the web; Apple — in-app purchases on iOS.
• Twilio SendGrid — transactional email (confirmation and password-reset messages).
• Cloudflare Turnstile — bot protection on forms.

Children

MyBackrooms is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has created an account, contact us and we will delete it.

Cookies

We use essential cookies that the site cannot work without: they keep you signed in and protect requests against forgery. These are always active and do not require consent.

With your consent, we also load embedded media — some rooms play videos through YouTube's privacy-enhanced player, which may set cookies when a video plays. We currently set no advertising or analytics cookies. If advertising (such as Google AdSense) is introduced in the future, nothing will load without asking for your consent first.

When you first visit, a consent banner lets you accept or refuse each category — refusing is as easy as accepting. You can change your mind at any time via the Cookie settings link in the footer (or this link).

Your rights

Under the GDPR you have the right to access, correct, export, and erase your personal data, and to object to or restrict its processing. The in-app tools above cover the common cases; for anything else, reach us through the contact form. You also have the right to lodge a complaint with your data-protection authority (in France, the CNIL).

Changes

If this policy changes materially, we will update the effective date above and highlight the change on the Site.