Privacy Policy

Effective date: 29 September 2026

MyBackrooms.com and Hollow.world (the "Sites") and the MyBackrooms mobile app are operated by Ziweq ("we," "our," or "us"). The two Sites are two brands of the same service: they share one account system and one database, so this policy covers both. This policy explains what personal data we collect, why we collect it, how long we keep it, who processes it on our behalf, and the choices you have. We collect only what the service needs to function — there is no advertising, no analytics SDK, and no cross-app tracking.

What we collect

• Account data — your email address, your public nickname, and, if you sign in with Google or Apple, the stable account identifier those providers share with us. If you use Apple's "Hide My Email", we only ever see the private relay address. Passwords (for email sign-up) are stored only as salted hashes. One account works on both Sites: you can sign in to either with the same credentials, and move from one to the other with a single click.
• Content you create — the worlds you build (called "Backrooms" on MyBackrooms: levels, rooms, textures, images, 3D models, characters, stories, page text), your profile photo, your votes, your play runs and leaderboard entries. Worlds you publish, your profile photo and your nickname are visible to other users, on the Site where the world is published. Profile photos are cropped and re-encoded without the original image metadata, then checked by Azure AI Content Safety before publication.
• Purchase records — if you buy Diamonds, we store the transaction reference from the payment provider (Stripe on the web, Apple's App Store in the iOS app) and your Diamond balance and spending history. We never see or store your card number — payment details go directly to the payment provider.
• Technical data — server logs including IP addresses, used for security, rate limiting, and abuse prevention.

Why we collect it

Solely to provide the service: signing you in, saving and publishing your creations, crediting and spending Diamonds, moderating public content (uploaded images and public text are screened automatically), answering messages you send us, and keeping the platform secure. We do not sell personal data, we do not use it for advertising, and we do not track you across other apps or websites.

How long we keep it

Your data is kept for as long as your account exists. Security logs are short-lived and rotate automatically. Purchase records are retained as required by accounting law.

Deleting your data

You can delete your account yourself at any time from Account settings → Personal data → Delete (in the app and on the web). Deletion is complete and covers both Sites: your worlds, uploaded assets, reserved names, and account record are erased — not just deactivated. You can also export a copy of your personal data from the same page, or contact us for help with access, correction, or deletion requests.

Who processes data for us

• Microsoft Azure — hosting, database, and file storage (data encrypted in transit and at rest), and automated content moderation of uploads (Azure AI Content Safety).
• Google and Apple — optional sign-in providers, if you choose them.
• Stripe — card payments on the web; Apple — in-app purchases on iOS.
• Twilio SendGrid — transactional email (confirmation and password-reset messages), sent in the name of the Site where you use your account.
• Cloudflare Turnstile — bot protection on forms.

Children

The Sites are not directed at children under 13, and we do not knowingly collect personal data from them. Hollow World's content is suitable for all ages, and playing requires no account; creating an account is subject to the age requirements of the Terms of Use. If you believe a child has created an account, contact us and we will delete it.

Cookies

We use essential cookies that the site cannot work without: they keep you signed in and protect requests against forgery. These are always active and do not require consent.

With your consent, we also load embedded media — some rooms play videos through YouTube's privacy-enhanced player, which may set cookies when a video plays. We currently set no advertising or analytics cookies. If advertising (such as Google AdSense) is introduced in the future, nothing will load without asking for your consent first.

When you first visit, a consent banner lets you accept or refuse each category — refusing is as easy as accepting. You can change your mind at any time via the Cookie settings link in the footer (or this link).

Your rights

Under the GDPR you have the right to access, correct, export, and erase your personal data, and to object to or restrict its processing. The in-app tools above cover the common cases; for anything else, reach us through the contact form. You also have the right to lodge a complaint with your data-protection authority (in France, the CNIL).

Changes

If this policy changes materially, we will update the effective date above and highlight the change on the Sites.