Privacy Policy

Account information

• Email sign-up: email address, password (stored as a hash by our authentication processor, Supabase)
• Google sign-in: your Google account email and basic profile info (name, profile photo URL)
• Profile: nickname, avatar, country, languages, interests, bio, preference answers

Service usage

• Event activity: hosting, participation, views, live viewing, and chat participation records
• Chat messages and their automatic translations
• Uploaded content: videos and photos (location, device, capture-time and other metadata is removed from photos on your device before upload, and from videos on our server before they are published)
• Matching: a synthesized profile text and embedding used for AI persona matching (direct identifiers such as contact details are excluded)

Payments and payouts

• Credit top-up, spend, gift, and donation history (ledger records)
• We do not store card details; payments are processed by Stripe
• For withdrawals: Stripe Connect account linkage (identity verification (KYC) is performed and held by Stripe)
• Payments and payout settlement are processed through a Stripe account held by GleeNet LLC (Washington, USA) — card statements show GLEENET LLC, and the platform name shown when a host links a payout account is also GleeNet LLC.

Automatically collected

• Access and device signals: hashed signals of your IP address, email, and device fingerprint at sign-up (sign-up signals do not store the raw IP address), browser information (raw User-Agent). The raw IP address is kept in our authentication processor's (Supabase) login-session records and in anti-abuse records such as rate limiting (session records are deleted on sign-out or account deletion; rate-limit records after the time window ends)
• Location: the Service does not collect or store GPS or other current-location coordinates from your device (joining an event does not require your location). Processing of IP addresses is described under "Access and device signals" above, and approximate location inferred from IP under "Website usage analytics" below. When you create an event, the venue you pick on the map (coordinates and address) is published as part of the event.
• Cookies: login session and language/theme preferences (necessary), and — only if you consent — website visit analytics (Google Analytics). We do not use cookies for advertising (see "9. Cookies and How to Refuse Them").
• Error logs (Sentry): technical logs for incident diagnosis
• Web push subscription: when you enable notifications in a browser, we store the subscription endpoint issued by that browser and its encryption keys (deleted when you turn notifications off or delete your account).
• Website usage analytics (website only, only if you consent to analytics cookies): for screens you can view without signing in (home, map, event details, videos, sign-in, sign-up, policies, etc.), the page address (with URL parameters other than campaign tags removed) and title, referring site, device and browser type, operating system, screen size, language, approximate location (country/city level), time of access, and the analytics cookie identifier. Visits to signed-in screens (chat, matches, credits, settings, etc.) and your name, email, or account ID are not sent. Google derives approximate location from your IP address and states that Google Analytics does not log or store IP addresses. The mobile app does not use analytics tools.

When you use the mobile app

• Push notification token: when you turn on notifications in the app, we store that device's push token and platform (Android/iOS). Turning notifications off or signing out requests deletion of that device's token (a temporary network error can delay it), and deleting your account deletes all of them. We keep at most 10 tokens per account; beyond that, the least recently used are deleted first.
• Device permissions (all optional): notifications (receiving push), location (looking up the address of the spot you pick on the map when you create an event — used only while you are using the app; your current-location coordinates are not stored on our servers, and there is no background location collection), photo library (uploading photos and videos — for photos, location (EXIF GPS) and other metadata are removed on the device before upload. For videos, metadata such as capture location, device, and capture time is removed on our server after upload and before the video is published; files from which it cannot be removed are not published, and uploads that are never completed are not published and are deleted by periodic cleanup once 24 hours have passed). The app currently does not request camera, microphone, or contacts permissions.

• Account management (sign-up, authentication, account protection) and providing the Service (map discovery, events, matching, translated chat, live streaming, VOD)
• AI persona matching and profile summaries; automatic chat translation
• Credit payments, gifts, donations, withdrawal settlement, and host console subscription billing
• Preventing abuse (multi-accounting, other misuse, payment fraud) and handling disputes
• Notifications (in-app, web push, app push, email — push can be turned on and off; non-transactional email can be opted out)
• Meeting legal obligations (e.g., retention of transaction records)
• Improving the service and measuring promotion effectiveness through website usage analytics (only if you consent to analytics cookies)

• Account data: anonymized without undue delay upon account deletion (nickname, profile, bio, and other identifying elements are removed).
• Transaction and settlement records: retained for statutory periods required by commerce laws (e.g., transaction records up to 5 years), then destroyed.
• Anti-abuse records: sign-up signals (hashed email, device fingerprint, and IP, plus browser information) may be retained after account deletion to prevent ban evasion.
• Chat and content: processed so the author is no longer identifiable after deletion (preserving conversation context for other participants).
• Push subscriptions and tokens (browser web-push subscriptions and app device tokens): turning notifications off deletes that subscription or token, and the app also requests deletion when you sign out (a network error can delay it); all of them are deleted when you delete your account.
• Website usage analytics (Google Analytics): retained for 14 months from collection, then deleted. If you withdraw consent, further collection stops and the analytics cookies on that device are deleted.

• You can view and edit your profile, and delete your account, from Settings (web: sign in → Settings; app: Settings › Delete account). You can delete your account from the web even if you have uninstalled or never installed the app; the steps and what is deleted or retained are described at worlduu.com/account-deletion.
• You can opt out of non-transactional email notifications (financial-record notices excepted).
• Requests for access, correction, deletion, or restriction can be sent to the contact below.

• Encryption in transit (TLS); database access controls (row-level security, least privilege)
• Hashed passwords; no card data stored (delegated to Stripe)
• Photo location metadata (EXIF GPS) removed before upload and video metadata (location, device, capture time) removed on our server before publication; sign-up signals (email, device fingerprint, IP) stored hashed
• Audit logging of operator actions

• Privacy officer: Minha Kim, Chief Executive Officer
• Contact: help@worlduu.com

• Necessary cookies: keeping you signed in, language/theme preferences, and remembering your cookie choice — required to provide the service and used without consent.
• Analytics cookies (Google Analytics): website visit analytics — used only if you choose "Accept" in the consent banner shown on your first visit to the website; your choice is kept for one year, after which we ask again. They are not used for advertising or personalized ads.
• Refusing or withdrawing: choose "Decline" in the consent banner, or change your choice anytime via "Cookie settings" at the bottom of the home page or on this policy page. Declining does not limit your use of the service.
• You can also block cookies in your browser settings, but blocking necessary cookies will prevent some features such as signing in.
• How Google processes data: https://policies.google.com/technologies/partner-sites