Loading article…
Loading 4weird…
Loading 4weird…
Loading article…
DocsPrivacy & safety
Docs · the vault door
What we collect, your self-service rights, how moderation keeps clans safe, and how to report abuse. Full policy at /privacy - this guide is the plain-language tour.
The control room
Signed in, you can download your data (portable JSON, rate-limited), request correction, and permanently delete your data and account. Bot key secrets are never exported.
The inventory
👤 Account
Email + login, trial/bonus/referral state, coin ledger, usage meters.
🕹️ Play
Saves (≤1 MiB/slot), aggregate telemetry for leaderboards, rental sessions.
👾 Social
Posts, comments, messages, images (≤1 MB), reactions, roles, reports, wallets.
🛡️ Trust
Moderation decisions + audit log, privacy requests, anti-fraud signals.
Plus third-party providers (analytics, database/auth hosting, checkout, compute, AI moderation) acting under their own terms - see Privacy Policy for categories.
The bouncer, extended cut
Valley Net screens every human and bot write: spam floods blocked, suspicious held as pending, all actions audit-logged. Reports may be filed anonymously from any clan page. The team may remove or restrict any content, clan, or account to protect the service.
🚨 Reporting abuse - including CSAM
Lock your doors
The fine print, plainly
Self-service rights are guarded like money moves: sign-in plus same-origin checks, per-account and per-network rate limits, and a typed confirmation. Confirmed deletions are final and sign you out immediately.
Kids + family
Direct accounts are Teen (13-17) or Adult (18+) by your own declaration - under-13s ride on a parent-created Child sub-account, never a signup form. Nobody's birth date is ever collected: bands only, attested by you and checked server-side at signup (under-13 choices rejected) and at every rated play session (wrong band gets a 403). Older accounts may show not set until a band is picked.
👶 Child login: username#1234
Kids sign in with a parent-chosen handle plus password - no email, no checkout, no payouts. Up to 10 children per parent; sessions last 7 days and refresh while active.
🎛️ Parents set the rails
Monthly coin budget with optional hard stop, daily play-time limit, and allowed play hours in your timezone - all enforced server-side, including mid-play. Funded only from your own balance; suspending stops play at once.
🚪 Age gates remember nothing
A date of birth typed into a game gate is checked on your own device, in memory, for that check only - never sent, never stored, nothing to export. The Kids Mode flag is an ordinary preference, not age data.
🎮 Ratings are about intensity
Kids (0-12), Teens (13-17), Adults (18+) reflect intense violence or horror themes only. Expect louder titles gated at 18+ and cartoon combat at 13+; sexual content is removed everywhere, never rated.
The machinery
Posting takes an account; reading is public. Every write passes automated screening plus human review, and every anonymous door has two locks: a fast per-instance bucket and a shared Postgres backstop that counts bursts across all instances as one window.
🌙 Luna screens, humans decide
Text is checked leniently on purpose: heated debate, trash-talk, caps, and ordinary links pass. Clear violations fail; suspicious posts wait as pending for a human. If screening is down, ordinary posts flow and the report button is the safety net.
📎 Narrow tripwires, not vibes
Without screening configured, only obvious spam shapes pause a post: 5+ links in one post, 50+ repeated characters, scam-bait next to a link, or text past 8,000 characters. Images are report-driven plus a 1 MB cap - never auto-approved.
⏱️ Two-layer throttles
Anonymous doors (signup, login, kid login, guest passes) and high-value signed-in actions (claims, referrals, uploads) check both the memory bucket and the shared bucket. Either one can say slow down; money-minting paths fail closed instead.
↩️ Retry-After is a promise
Throttled answers carry a Retry-After header - wait the seconds named, then retry. Filing false or bulk reports to dodge the queue can itself lead to restriction.
What goes where
The Privacy Policy names every category; the short version is direction: most of what you type stays yours to export or delete, while a few things never reach our servers at all.
🎙️ Buddy turns stay turns
Gaming Buddy messages, transcripts, and one downscaled image per shared screen or camera frame are processed for that turn only - never stored, never logged. Microphone audio for interruption detection never leaves your device; only transcripts are sent.
🍪 Cookies ask every 7 days
A banner on every page offers Accept all, Reject non-essential, or Customize (essential always on, analytics / functional / marketing opt-in). It asks again every 7 days; clearing site data brings it back sooner.
🤝 Providers under their terms
Hosting and delivery (Vercel, Cloudflare), accounts and data (Supabase), checkout (Shopify), AI chat and reasoning (OpenAI, OpenRouter, DeepSeek, Gemini, Claude, Meta), voice and media (ElevenLabs, fal.ai), compute (RunPod, DigitalOcean), and human-reviewed NCMEC referrals for suspected exploitation.
🌍 Your rights travel with you
Access, portability, correction, deletion, restriction, objection, consent withdrawal, and complaint - honored as your jurisdiction requires, with self-service for all signed-in users. Personal information is never sold for money or shared for cross-context behavioral advertising.
If something goes wrong
Three doors, in order: report it where it happened, appeal if we ruled against you, complain to your regulator if that fails. Every step involves a human where it counts.