Privacy policy

This policy is for parents and guardians. Mibuu is a game for kids aged 6 to 12, and we treat every player as a child. We built it to collect as little as we can: no names, no email addresses, no photos, no birthdays, no location, no ads and no chat. This page says what the game keeps, where it keeps it, who can see it and how you can have it deleted.

Who we are

Mibuu is made by Rovugui Studio, the trade name of Carlos Brotas, in Portugal. We decide what data the game uses and why, so under European and UK law we are the "controller" of that data.

You can reach us at hello@mibuu.com. We answer every message about a child's data.

The short version

• Your kid never types anything that leaves the phone. The only thing they can type is a secret name for their Mibuu, and it stays on the phone.
• On our server, your kid is a random id and a made-up Nickname built from preset words, such as "Bouncy Comet". It is never their real name.
• Friends are only kids your kid met in person and scanned a code with. There is no chat, no search and no list of strangers.
• While Mibuu is in testing, the game sends anonymous play events, such as "a math round finished with 8 right", under a separate random tester id. They never say your kid's school grade or country.
• In the Parent Area, the Online and privacy card lets you remove a Friend, turn every online feature off and delete everything our server keeps for your kid.
• The server deletes old data by itself every night, on the schedule in "How long we keep data".
• No ads, no advertising ids, no third-party analytics, no data sold or shared for marketing.

What stays on the phone

Most of the game lives only on your kid's phone, in the app's own private folder. We never see it. Uninstalling the app deletes all of it.

• The Child Profile. Your kid's Mibuu and its Needs, the Collection of past Mibuus, the Room and Garden, Stars, outfits, game scores, Quiet Hours and the Notification setting.
• The secret name. The one place your kid types text. It is up to 16 characters. It is never sent to our server, never in a play event, never shown to Friends and never printed on a show-off card.
• Math progress. Which questions your kid got right and wrong, for the Progress page in the Parent Area.
• The school grade. You set it in the Parent Area. If you use "Suggest from birthday", the game works out the grade from the birth month and year you pick and keeps only the grade. The birthday is not saved anywhere.
• The Parent PIN and the phone lock switch. The game stores only a scrambled form of the PIN (a salted SHA-256 hash) and never sends it anywhere. If you let the gate use Face ID, a fingerprint or the phone's passcode, the phone checks it and tells the game only yes or no. Your face, fingerprint and passcode never reach the game.
• Show-off cards. Pictures of your kid's Mibuu with its Mibuu Name. They stay in the game's album until a parent shares one.
• Camera pictures. The camera is used only to scan a Friend's code. The phone reads the code from the picture and throws the picture away. No picture is saved or sent. Only the code it read goes to our server.
• The daily Notification. If you switch it on, the phone schedules it by itself. There is no push service and no push token.
• The store's age answer. When you buy something in the Parent Area, the game asks Google Play or the App Store whether the account belongs to a minor with a parent's consent. It uses the answer for that one purchase and then drops it. It is never saved or sent to us.

We do not run a cloud backup of the game. If the phone is lost or the app is uninstalled, the Child Profile is gone. On Android the game turns system backup off, so its files are not in the phone's backup. On iPhone, your iCloud or computer backup may include the game's files, depending on your phone's settings.

What goes to our server, and why

The game uses a server for the parts that involve another kid: Friends, Pairing, Friend visits and Friends' scores. Here is everything it keeps.

None of this includes anything your kid typed. The server accepts only preset words and ids from the game's own lists, and it turns away anything else.

You can turn all of this off. The Online and privacy card in the Parent Area has one switch for online features: Friends, Friend visits, Friends' scores, Pairing, sharing show-off cards and the play events below. With it off, the game sends nothing to our server and your kid keeps playing with everything on the phone. The same card lets you remove a Friend, which ends the friendship on both sides along with the reactions between the two kids.

The game connects to our server the first time it opens, to make the account id and Nickname. You can turn online features off at any time after that, and delete what was sent.

Anonymous play events

While Mibuu is in testing, the game also records play events so we can see how it plays and fix it. A play event is an event name, a few numbers or ids from a fixed list, and the time on the phone. Examples: a session ended, a Need was met, an Activity finished with its score, a math answer was right or wrong, a Mibuu hatched, a Friend was added, the Parent Area's Shop page was opened, a purchase, restore or refund happened (without saying what), and the school grade or country setting changed (without saying to what).

Each event carries a random tester id. The server hands it out but keeps no record of which account got it, and the phone sends events without signing in. So play events are not linked to your kid's account, Nickname or Friends. The server refuses any event that holds free text.

Events never carry your kid's school grade or the country the game follows for school math. The phone leaves both out, and the server refuses an event that has them.

We collect play events only during testing and switch them off when testing ends. The server deletes each play event 45 days after it arrives. Turning online features off stops new play events at once and drops any still waiting on the phone.

What our host sees

Our server runs on Supabase. Like any web host, Supabase receives each phone's IP address with every request. Each request also names the game engine, its version and the phone's operating system, such as "Android". Supabase keeps these in request logs for 1 day on our plan. We can't delete single entries from those logs.

Supabase's sign-in service also stores the IP address and that engine and system name with each account session, and keeps a login history with the IP address of each sign-in. Sessions are deleted with the account. Our server deletes the login history after 30 days, and tries to delete it at once when you use "Delete server data". We do not use IP addresses for the game, for analytics or to find out who anyone is.

Why we may use this data

European and UK law asks us to name a legal reason for each use. We rely on:

• Our legitimate interest in running the game you chose for the account id, Nickname, Mibuu, Room snapshot, Friends, Pairings, scores and reactions. These exist only so the online features work, and you can switch them off or delete them at any time.
• Our legitimate interest in keeping the game safe for the short-lived abuse records and the host's logs.
• Our legitimate interest in fixing and improving the game for the anonymous play events during testing.
• Legal obligation when the law requires us to keep or hand over data.

We weighed each of these against your kid's interests. That is why we keep so little, keep it so briefly and put the off switch and the delete button in your hands.

What we never collect

• Real names, email addresses, phone numbers, postal addresses
• Birthdays or ages
• Photos, video or voice recordings
• Precise or approximate location
• Contacts, browsing history, advertising ids or device ids
• Payment details. Purchases happen in Google Play or the App Store, and we never see a receipt or an order number.

Sharing

We do not sell or rent data, and we do not share it for advertising. There are no ads in Mibuu and no third-party analytics or advertising code.

The only other companies involved are:

• Supabase, which hosts our server and database for us as our processor. Our contract is with Supabase Pte. Ltd. in Singapore, under Supabase's data processing addendum. It processes the data only on our instructions. Our database is in Supabase's eu-west-1 region, in Ireland.
• Apple and Google, which handle downloads, purchases, Family Sharing or Family Link, and the age check before a purchase. On Android the game includes Google's Play Billing and Play Age Signals libraries, and on iPhone it uses Apple's StoreKit and Declared Age Range. These talk to the store, not to us. Apple and Google act under their own privacy policies.

A parent can send a show-off card out of the game, after passing the Parent gate. The Share button sits in the game's album, and the gate opens before anything leaves. The card goes to whichever app you choose, such as a messaging app, with a link to the game in the App Store or Google Play. It shows the Mibuu in its outfit, its Mibuu Name, its school badge and any crown, the date and time, and the place in the game where it was taken, such as "In a Friend's Room". It never shows the Nickname, the secret name, a Friend code or the phone's location. Once you send it, the app you sent it to handles it.

We may disclose data if the law requires it, such as a valid court order.

Children's privacy

Mibuu is made for children, so we follow the rules for children's apps in the places it is offered.

• United States (COPPA). We do not ask children for names, contact details, photos, voice or location. The game uses two persistent ids, the account id and the tester id, to run the game, keep Friends and Pairings working, stop abuse and understand how the game plays.
• European Union and United Kingdom (GDPR, UK GDPR). We keep data to the minimum the game needs, and we do not profile children or use their data for marketing.
• United Kingdom (Age Appropriate Design Code). Settings start at the most private: no location, no profiling, no ads, no public profile. Friends are only kids met in person. There are no streaks, no "you dropped" messages, and the daily Notification is off until a parent turns it on. A parent can turn every online feature off in the Parent Area.
• Brazil (LGPD and ECA Digital, Lei 15.211/2025). We process children's data only in the child's best interest, as LGPD article 14 asks, and we collect only what the game needs. The game reads the app store's age signal before any purchase, and sells nothing to children.

All purchases, the share button, the school grade, Notifications and the Online and privacy card sit behind the Parent gate. It opens with the phone's own lock (Face ID, Touch ID, fingerprint or passcode) if you turn that on, or with a 4-digit PIN you set. With neither, it asks a written challenge: type some digits of a nine-digit number, counted from the right.

Your rights and how to use them

You can ask us to:

• tell you what we hold about your kid,
• give you a copy of it,
• correct it,
• delete it,
• stop using it, or object to how we use it.

The quickest way to delete is in the game. In the Parent Area, open the Online and privacy card on the Family page and tap "Delete server data", then "Delete". The server deletes, at once and for good, your kid's account id, Nickname, Mibuu, Room snapshot, Friends on both sides, daily scores and Road Hop runs, reactions your kid left or got, Nickname changes, Friend codes, Pair taps, the account's sign-in sessions, and the play events sent under this phone's current tester id. It also asks our host to delete the account's login history; anything left goes in the nightly cleanup within 30 days. A Pairing your kid made stays only for the other kid, without your kid's account on it, because their Egg came from it. The phone then signs out of the server, forgets what it knew about your kid's Friends and turns online features off. Your kid's Mibuu, Collection and everything else in the game stay on the phone. If you turn online features on again later, the game starts a new account with a new Nickname and no Friends. It needs the phone to be online. If it isn't, nothing is deleted and the card says so.

To ask by email, write to hello@mibuu.com with your kid's current Nickname, which you can see on the Online and privacy card in the Parent Area, such as "Bouncy Comet 7". The Nickname is unique, so it is enough for us to find the account. Do not send us your kid's real name. We answer within one month.

When we delete an account on request, the server deletes the same rows as the button does. Your kid's Friends stop seeing them. The game on the phone notices the next time it goes online and starts a fresh account, with a new Nickname and no Friends. The Child Profile on the phone stays until you uninstall the app.

Play events are not linked to the account, so we cannot find one kid's play events from the Nickname. Only the phone knows its tester id, which is why the button in the game deletes them and an email request can't. Either way, every play event is deleted 45 days after it arrived.

Uninstalling the app deletes everything on the phone, but not the server account. To delete the server account too, use "Delete server data" before you uninstall, or email us before or after. An account whose phone hasn't connected for 24 months is deleted anyway.

You can also complain to a data protection authority, such as the CNPD in Portugal, the AEPD in Spain, the ICO in the UK or the ANPD in Brazil. In the US, you can contact the Federal Trade Commission.

How long we keep data

The server runs this cleanup by itself every night.

Security

• Every connection between the game and the server uses HTTPS.
• Every server table has row-level security. A phone can read only its own rows and its Friends' rows. It cannot write to any table directly, only through server functions that check every value.
• Friend codes are random, single use, last 10 minutes and are stored only in scrambled form. Failed tries are rate-limited.
• The Parent PIN is stored only as a salted hash, on the phone.
• Show-off cards leave the game only through the phone's own share sheet, after the Parent gate.

No system is perfectly secure. If a breach affects your kid's data, we will tell the authorities as the law requires. Because we hold no contact details for you, we will post the notice on this website, on the Mibuu help page.

International transfers

Our database is hosted by Supabase in Ireland, in the European Union. Supabase and the companies it uses, such as Amazon Web Services, may reach the data from outside the EU, for example to give support or keep the service running. Supabase is based in Singapore and works with companies in the United States. For these transfers we rely on the European Commission's Standard Contractual Clauses and the UK's International Data Transfer Addendum, both part of Supabase's data processing addendum.

Changes to this policy

If we change what the game collects, we will update this page and the date at the top before the change reaches the game. For a change that collects more about children, we will ask for a parent's consent first where the law requires it, and through the app stores' own consent flow where they offer one.

Contact

Rovugui Studio (Carlos Brotas)
Portugal
hello@mibuu.com