Privacy Policy
We collect the minimum needed to run the couch. Here's the honest list.
Effective date: [EFFECTIVE DATE] · Last updated: [EFFECTIVE DATE]
1. What we collect
- Account details — username and email address when you register. Your password is handled by our authentication provider (Supabase Auth) and is never visible to us.
- Profile — your public Virtual Couch identity: username and friend code (e.g. VC-NAME-1234).
- Friends — the friend codes you add, so presence and invites work.
- Session metadata — minimal, aggregate connection diagnostics only (route type, quality grade, average RTT/jitter/loss), and only where there's a genuine product or diagnostic reason.
- Support messages — anything you send us when you contact us.
2. What we deliberately do not collect
- Game files. There is no upload endpoint. Game files you select are processed locally in your browser and never reach our infrastructure.
- Game filenames. Games are identified by a cryptographic hash of their bytes, computed in your browser — not by filename.
- Surveillance telemetry. No permanent per-second connection logs, no IP archives, no ICE-candidate dumps, no device fingerprinting.
3. Where your data lives
Account, profile, and friends data is stored with Supabase (our authentication and database provider). Processing by Supabase may involve international data transfers outside South Africa; Supabase's own security and privacy practices apply to that processing.
4. What stays on your device
Virtual Couch uses localStorage and IndexedDB in your browser for things that belong to you and your machine: your identity cache (so the couch remembers you offline), save data cache, controller mappings, and session memory. This data never leaves your device unless a feature explicitly syncs it — and we'll say so when one does.
5. Cookies
We use no advertising or tracking cookies. Authentication tokens required to keep you signed in are stored by the authentication client in your browser's storage.
6. Retention & deletion
We keep account data while your account exists. You can request deletion of your account and associated personal data at any time via our contact address — we'll confirm once it's done. Session diagnostics, where retained at all, are kept only as long as they serve a diagnostic purpose.
7. Your rights (POPIA)
Virtual Couch is operated from South Africa and the Protection of Personal Information Act (POPIA) applies. You have the right to request access to your personal information, correction of inaccurate information, and deletion of information we no longer need. Contact us at our contact address to exercise any of these.
8. Children
Virtual Couch is not directed at children under 13, and we do not knowingly collect their personal information.
9. Changes
If this policy changes, the updated version will be posted on this page with a new effective date. Material changes will be flagged on the site.
10. Contact
Questions, access requests, deletion requests: our contact address or the contact page.