Privacy Policy

zabloo (“we”, “us”, or “our”) operates the website zabloo.com and its subdomains — including ui.zabloo.com, which serves zabloo/ui and its documentation — and the platform at app.zabloo.com. This Privacy Policy explains what information we collect, how we use it, and what rights you have over it.

1. Information We Collect

Browsing zabloo.com and its subdomains

Visiting this website sets no cookies and loads no third-party script until you accept the banner. If — and only if — you accept it, we use Google Analytics to collect usage statistics: the pages you visit, the referring site, your approximate location (country or region; your IP address is not stored), your browser and device type, and a random identifier stored in a cookie. Nothing reaches Google until you accept, and you can withdraw at any time. The Cookie Policy lists exactly what is set and for how long. Your answer applies to zabloo.com and all of its subdomains: we ask once, and we do not ask again on another address.

Server logs

Whatever you answer, the web server that hands you these pages keeps its own access log: one line per request, which is how a broken page gets noticed and how abuse gets spotted. Each line records the date and time, the hostname you asked for, the path, the response status and size, the page you arrived from, your browser’s user agent string, and a shortened form of your IP address — the last part is removed before the line is written (the final octet of an IPv4 address, the final 80 bits of an IPv6 one), so what is kept identifies a network rather than a person.

There is nothing to accept or decline here, and no third party involved: our own server writes it, from the request your browser already sent it. The legal basis is our legitimate interest in operating and protecting the site (Art. 6(1)(f) GDPR).

These lines live only in the running server’s log stream. They are never archived, backed up, or sent to any analytics service or other third party, and they are discarded whenever the site is redeployed — which happens on every change to it, so in practice they last days rather than months.

Account information

When you create a zabloo account on app.zabloo.com, we collect:

• Email address — used to create and secure your account, and to send you important service communications.
• Username / display name — the name you choose to appear on the platform.

User-generated content

Anything you build or publish on zabloo — worlds, scripts, assets, and associated metadata — is stored on our servers so it can be shared and played by others.

2. How We Use Your Information

Purpose	Legal basis
Creating and managing your account	Contract
Sending transactional emails (password reset, notifications)	Contract
Hosting and displaying your published worlds	Contract
Responding to support or legal requests	Legal obligation / Legitimate interest
Measuring how zabloo.com and its subdomains are used (Google Analytics)	Consent
Operating, debugging and protecting this website (server access logs)	Legitimate interest

We do not sell your personal data to anyone, ever.

3. Cookies

zabloo.com uses optional analytics cookies (Google Analytics), and only after you accept them in the consent banner. Declining, or choosing nothing, means no analytics script is loaded at all. You can change your choice at any time from Cookie settings in the footer of any page, on any of our subdomains. Storage on app.zabloo.com is limited to what is strictly necessary to keep you signed in. The Cookie Policy has the full list.

4. Third-Party Services

If you accept analytics cookies, usage data is processed by Google LLC (Google Ireland Limited for visitors in the EEA) as our processor for Google Analytics. Google may process it in the United States; Google LLC is certified under the EU-U.S. Data Privacy Framework. We share your personal data with no advertising or marketing services. Everything else lives on infrastructure we operate, and we only disclose it where the law requires us to.

We do not use your data for advertising or share it with data brokers.

5. Data Retention

• Analytics data is kept for a maximum of 14 months, then deleted by Google.
• Server access logs, which hold no full IP address, are kept only in the running server’s log stream and are discarded on every redeployment.
• Account data is kept for as long as your account exists.
• If you delete your account, your personal data is removed within 30 days.
• User-generated content is deleted along with your account unless you have explicitly shared it and other users have saved copies.

6. Your Rights

Depending on where you live, you may have rights including:

• Access — request a copy of the data we hold about you.
• Correction — ask us to fix inaccurate data.
• Deletion — ask us to delete your account and associated data.
• Portability — receive your data in a machine-readable format.
• Objection — object to certain types of processing.

EU/EEA residents have these rights under the GDPR. California residents have similar rights under the CCPA.

To exercise any of these rights, email us at zamo@zabloo.com.

7. Children

zabloo is intended for users aged 13 and older. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has created an account, please contact us at zamo@zabloo.com and we will delete it promptly.

8. Security

We take reasonable technical and organisational measures to protect your data — including encrypted connections (HTTPS), hashed passwords, and access controls. No system is 100% secure, and we cannot guarantee absolute security.

9. Changes to This Policy

We may update this policy as the platform evolves. When we do, we’ll update the “Last updated” date at the top. For significant changes, we’ll notify you by email or via an in-app notice.

10. Contact

Questions? Reach us at zamo@zabloo.com.