Privacy Policy
1. Who we are
Agent World is run by the people who make it, on a server of our own in Viet Nam: the game server and its database both run there. Visitors reach it through Cloudflare (section 4). Write to support@theworldofagents.com for any privacy request.
2. What we collect and why
| Data | Why | Where it comes from |
|---|---|---|
| Google sign-in identity: Google's user id for you and your email address (if Google shares it and has verified it), the email trimmed and in lower case. No Google access token is stored: we use it once to confirm who you are and discard it | Sign-in; to recognise your account when you come back | Google, after you agree on its page |
| Device records: a random token (we keep only its hash), a browser name (for example "Chrome"), created and last-seen dates. A guest has the same kind of record | Keep you signed in; let you list and sign out devices | Your browser |
| Invite: that you redeemed an invite code, and when. A code itself is kept only as a hash, with its use count, its expiry and a short note the team wrote when making it (for example who it was for) | The closed beta: only invited players can start a world | You, when you enter a code |
| Game data: your world, characters, what they do, relationships, memories, your Chronicle books, progress milestones and rewards, settings such as language | Run the game and keep your world | You and the simulation |
| Text you write: character names, whispers, dialogue | Play; shown to the AI model that answers you after passing our content filter | You |
| Reports you send with the Report control: the line you reported (up to 400 characters), the reason, an optional note (up to 200 characters), the time and the world | Let a person review the line | You, and the game |
| Filter counts: how many messages our content filter blocked in a day, and strikes recorded for repeated blocks. No text is kept in them | Safety of the game | The server |
| Technical data: your IP address and your browser's identification (User-Agent) in the access logs of the web server; a record of each request's path (never its query string), time and result; server logs; rate-limit counters kept in memory, not with your account | Security, abuse prevention, fixing faults | Your connection |
| Accounting of AI use: for each AI call the time, the world, the kind of call, the model, the token counts, the delay, the outcome and the cost. No text | Run costs | The server |
Your browser's local storage holds your sign-in token, a random value that lets the browser finish a Google sign-in, and your settings. The Game sets no cookies. This website (theworldofagents.com) has no scripts, no cookies and no analytics; its access log holds the same technical data as above.
We do not sell your data and we do not use it for advertising. We do not send you email. We do not ask for a password, a phone number or a payment card.
3. Sign-in methods
- Google: you are sent to Google, agree there, and come back to the game with a one-time ticket. We ask for the minimum,
openid email. Google's own privacy policy applies on its pages. - Guest: no account and no email. Your world is tied to a random token kept in your browser; if you clear the browser's data without signing in, the world cannot be reached any more.
4. Who processes data for us
- Hosting: our own server in Viet Nam, which runs the game server and its database.
- Cloudflare: a Cloudflare tunnel and its network carry every request between your browser and our server (the game and this website). Cloudflare ends the encrypted connection at its edge, so it handles what passes through, including your IP address and the text you write. Messages to support@theworldofagents.com are forwarded by Cloudflare Email Routing to our mailbox; we read them to answer you.
- Google: the sign-in, on its own pages.
- AI model provider: the characters' answers are produced by the model
qwen3-30b-a3b-instruct-2507(Qwen), reached through OpenRouter. The request carries the prompt text and the model name, and we add no account or device identifier to it. The prompt holds the situation of the character who is speaking (the world, the people near them, memories) and what you have written into the game that they can see, such as your character's name, whispers and what your character says. The Game does not take AI keys from players; every AI call uses our key.
Cloudflare, Google and OpenRouter run their own systems, which may be in other countries than yours, and handle your data under their own terms and privacy policies.
5. How long we keep it
- Account and game data: until you delete the account. We do not delete inactive accounts by ourselves, and a guest world that has been started is kept until it is deleted.
- Empty guest records (a guest who never started a world): deleted after 30 days without a visit.
- Sign-in tickets: deleted a day after they expire.
- Devices: on a signed-in account, a device not used for 90 days stops working.
- Account-merge records (a record that a guest world and an account were joined, with no email in it): 90 days.
- Invites: deleted 30 days after the code expires.
- Reports: a report not reviewed after 45 days is closed; it is deleted 30 days after it was resolved or closed. The text and note of a dismissed report are blanked after 7 days.
- Strikes: count for 90 days.
- AI-use accounting: 90 days.
- Logs: the web server's access log, the game server's log and the logs of the other services are kept by Docker in at most 5 files of 10 MB per service; the oldest are overwritten when the files are full, so the bound is size, not time. They are also gone when a service is replaced by an update.
- Backups: the database is backed up every night and the copies are encrypted. We keep the last 7 daily copies and 4 weekly ones, and no copy is older than 35 days; a copy taken just before an update is kept 14 days. The copies stay on our server. Deleted data leaves the backups within that time.
6. Deleting your account
In Account → Delete account you type a confirmation word and the deletion happens immediately (there is no grace period). If your last sign-in is more than 10 minutes old, the Game first asks you to sign in again. Deletion removes: your sign-in methods, device records and unused sign-in tickets; your world, characters, archives and Chronicle books; your progress and rewards; the reports you sent and your filter counts. AI-use accounting is kept without any link to you (your id is removed) and expires within 90 days, and the log of what a reviewer did with reports is kept with your id removed. Signing in again later with the same Google account creates a new, empty account; nothing can be recovered. Before deleting you can export your Chronicle from the game. Copies of your data in backups leave them within 35 days (section 5).
7. Your data and your questions
You can delete your data yourself (section 6). To ask what we hold about you, to have something corrected, or anything else about your data, write to support@theworldofagents.com. The Game has no self-service export other than the Chronicle export (Chronicle → Share).
8. Children
You must be 16 or older to create an account. If you believe a child under 16 has an account, write to us and we will delete it.
9. Security
Device tokens, sign-in tickets and invite codes are random and stored only as hashes. Email addresses and sign-in tickets are kept out of our logs, and the Game sets no cookies. Connections to the Game and to this website use HTTPS. No system is perfectly secure; tell us at the address above if you find a problem.
10. Changes
When this text changes in substance we change privacy_version together with the Terms' terms_version. The next time you sign in, the Game asks you to accept the new texts and to confirm your age again; a session that is already open keeps working until then.