Privacy Policy

1. About This Policy

This Privacy Policy applies to X SPACE, WorthBuy websites, applications, games, and related digital services operated by WorthBuy Information Technology Pty Ltd ("WorthBuy", "we", "us", or "our").

2. Information We May Collect

Depending on how users interact with X SPACE and WorthBuy services, we may collect or process:

• Email address;
• Firebase user ID and account identifiers;
• Account registration and authentication information;
• Firebase installation IDs, device identifiers, or other app installation identifiers;
• IP address and general device information;
• Website pages visited, visit timestamps, browser information, referring page, approximate country derived from IP, anonymous visitor and session identifiers, campaign source, and an optional creator referral code included in a WorthBuy link;
• Operating system, app version, language, and device model;
• Cloud save data and in-game progress;
• Furniture inventory, placed objects, room configurations, and other game data;
• Avatar appearance and customisation selections; multiplayer account and room identifiers, display names, virtual positions, actions, and room chat messages;
• Blocking preferences and report records, including relevant account identifiers, reported messages, reasons, timestamps, and handling status;
• In-app purchase information and entitlement records;
• App diagnostics, crash information, and technical logs;
• Support requests and communications sent to WorthBuy;
• Usage and interaction information where analytics services are enabled.

Multiplayer positions describe locations within the virtual room, not your physical location. Other room participants can see information you share in that room. Please do not post sensitive personal information in chat.

Passwords are handled through Firebase Authentication. WorthBuy does not store users' plaintext passwords.

3. How We Use Information

We may use information for the following purposes:

• Creating and managing X SPACE accounts;
• Authenticating users and maintaining account sessions;
• Providing local and cloud save functionality;
• Synchronising game data across supported devices;
• Verifying purchases and granting purchased content;
• Delivering ASMR audio, furniture, downloadable content, and other game features;
• Maintaining security and preventing fraud or abuse;
• Synchronising avatars and shared-room interactions, providing chat, applying blocking preferences, and investigating safety reports;
• Diagnosing crashes, errors, and technical problems;
• Providing customer support;
• Improving game performance, reliability, features, and user experience;
• Measuring website traffic, understanding which pages are viewed, and evaluating creator outreach links;
• Complying with legal, regulatory, tax, accounting, and security obligations.

4. Third-Party Services

X SPACE uses third-party services that may process information on our behalf, including:

• Firebase Authentication;
• Cloud Firestore;
• Firebase Storage;
• Firebase Cloud Functions;
• Firebase Installations;
• Google Play services;
• Google Play Billing;
• Apple App Store and StoreKit for iOS purchases;
• Amazon Web Services (AWS) for hosting and infrastructure;
• YouTube for video features.

Depending on the feature used, these providers process information needed for authentication, hosting, purchase verification, or media delivery, including relevant technical connection information. Viewing YouTube content involves Google's processing under its own privacy policy.

These providers may process information according to their own privacy policies and contractual terms.

5. Device and Installation Identifiers

X SPACE and its service providers may process Firebase installation IDs, app instance identifiers, device identifiers, or other technical identifiers.

These identifiers may be used to:

• Operate Firebase and Google Play services;
• Maintain app functionality;
• Authenticate service requests;
• Protect accounts and prevent fraud;
• Diagnose technical issues;
• Associate installations with app service data where necessary.

6. In-App Purchases

Purchases made through the Android version of X SPACE are processed through Google Play Billing.

Purchases in the iOS app are processed by Apple through the App Store. The app sends the product identifier, product type, and Apple-signed transaction data to our Firebase-based verification service, together with the authenticated account context, to validate purchases and manage entitlements.

WorthBuy may receive and store information needed to verify purchases and grant access to purchased content, such as:

• Product ID;
• Product type and Apple-signed transaction data for iOS purchase verification;
• Purchase status;
• Purchase token or verification result;
• Entitlement status;
• Relevant account identifier.

WorthBuy does not directly receive or store complete payment card details processed by Google Play or Apple. We do not receive your Apple Account password through purchase verification.

7. Cloud Saves and Game Data

Registered users may use cloud save features.

Cloud data may include:

• Room layouts;
• Avatar appearance settings and associated identifiers;
• Placed furniture;
• Object identifiers;
• Position, rotation, and scale information;
• Inventory and game progression;
• Purchased-content entitlements;
• Other account-related game state.

Supported avatar settings are saved with your account for restoration and synchronisation. Multiplayer session data is also processed to synchronise the room; this does not mean that every movement or action is stored as a cloud save.

8. How We Share Information

WorthBuy does not sell users' personal information.

Information may be disclosed only:

• With other room participants: your display name, avatar appearance, virtual actions, and messages sent to the shared room;
• To service providers that operate services on WorthBuy's behalf;
• To payment and platform providers required to process purchases;
• When necessary to comply with law, legal process, or regulatory requirements;
• To protect users, WorthBuy, or others from fraud, abuse, security threats, or harm;
• As part of a business restructuring, merger, acquisition, or transfer, subject to applicable law.

Report information is used by personnel responsible for investigating abuse and handling safety concerns. Do not include unnecessary sensitive information in a report.

9. Data Security

WorthBuy uses reasonable technical and organisational safeguards designed to protect information.

Supported account, purchase-verification, and cloud service connections use HTTPS/TLS to protect data in transit.

No storage or transmission system is completely secure, and absolute security cannot be guaranteed.

10. Website Access Analytics

When a visitor opens a WorthBuy webpage, WorthBuy may record the page path, access time, IP address, approximate country inferred locally from the IP address, browser user-agent information, the initial referring page, campaign source, and an optional creator referral code contained in the initial link. WorthBuy also creates a random anonymous visitor identifier in local storage and a random session identifier in session storage. These identifiers do not contain a visitor's name or email address and are used to estimate unique visitors, sessions, and repeat visits. We use this limited information to measure website traffic, understand creator outreach, maintain security, and diagnose technical problems.

This first-party website access measurement does not use advertising cookies and is not used to build advertising profiles. Country lookup is performed by the WorthBuy server rather than by sending the visitor's IP address to an external geolocation API. Access records are normally retained for up to 90 days unless a longer period is reasonably required for security, legal, or abuse-prevention purposes. Visitors may clear the anonymous identifiers using their browser's site data controls.

11. Data Retention

We retain personal information only for as long as reasonably necessary to:

• Provide X SPACE and related services;
• Maintain user accounts;
• Preserve cloud saves and purchased-content entitlements;
• Meet legal, tax, accounting, security, and fraud-prevention obligations;
• Resolve disputes and enforce agreements.

Account profiles, avatar settings, and cloud saves are retained while needed to provide your account and are subject to account deletion. Chat, blocking, and report records are retained only while needed to provide the relevant feature, investigate incidents, prevent repeated abuse, or resolve disputes. Retention depends on the type of record, whether an investigation is open, and applicable legal requirements; these records are not intended to be kept indefinitely.

Where a limited security record is necessary after account deletion to prevent an old account token from recreating deleted data, it is restricted to that purpose. Purchase, legal, and security records are retained only where necessary for the purposes described above. Records no longer needed are deleted or anonymised.

When information is no longer required, it will be deleted, anonymised, or securely retained only where continued retention is legally permitted or required.

12. Account and Data Deletion

Users may request deletion of their X SPACE account and associated personal data.

Users can:

• Use the Delete Account option in the Account section inside X SPACE; or
• Submit an external deletion request through the X SPACE Account and Data Deletion page.

Deletion requests cover account-linked profile, cloud save, avatar, and other personal data, including applicable chat, blocking, and report data. Limited records may be retained where necessary for legal obligations, unresolved safety incidents, fraud prevention, or legal claims. We will explain relevant exceptions when handling your request. Deletion is not a promise that all copies disappear instantly from every system or from other users' devices.

Uninstalling the app does not delete your account. Deleting your X SPACE account does not automatically cancel an Apple or Google Play subscription; manage subscriptions through the store where you purchased them.

13. Children's Privacy

X SPACE is not intended to knowingly collect personal information from children in violation of applicable law.

If WorthBuy becomes aware that personal information has been collected from a child without required consent, reasonable steps will be taken to delete it.

14. International Data Processing

Information may be processed or stored in countries other than the user's country, including locations where WorthBuy's service providers operate.

Where required, WorthBuy will use appropriate safeguards for international data processing.

15. User Rights

Depending on the user's location, users may have rights to:

• Request access to personal information;
• Request correction of inaccurate information;
• Request deletion of personal information;
• Object to or restrict certain processing;
• Withdraw consent where processing relies on consent;
• Contact an applicable privacy regulator.

Requests can be sent to: julialiu@worthbuy.com.au

16. Changes to This Policy

WorthBuy may update this Privacy Policy when products, services, technologies, or legal requirements change.

The latest version and updated date will be published on this page.

Safety Reports and Blocking

Where multiplayer chat is available, use the in-app report and block controls for inappropriate messages or unwanted contact. Blocking is a user control, not a guarantee that all harmful content will be prevented. Harassment, threats, and sharing another person's private information without permission are not allowed.

For safety concerns or help with a report, email nickysong1029@gmail.com. Include the room, approximate time, relevant display name or message, and a brief explanation. Never send passwords or payment card details.

Safety reports are for review by the X SPACE team. This is not a continuously monitored emergency service, and submitting a report does not mean an automatic email notification or enforcement action has occurred. If you face immediate danger, contact local emergency services.