Privacy Policy

1. Information we collect

Account information (from Google Sign-In). Sign-in is Google-only. When you sign in we receive, via Google OAuth, a limited set of profile data:

• your Google account identifier (sub),
• your email address,
• your display name, and
• your public profile picture URL (avatar).

We do not receive your Google password, and we do not request access to Gmail, Drive, Calendar or any other Google service. We only request the openid, email and profile scopes.

Content you publish. Items you create or upload (characters, outfits, wallpapers), along with their metadata (name, description, tags, version), comments you post, and likes you give.

Usage data. Basic, non-identifying activity such as item view counts, like and download counts, and standard server logs (IP address, user agent, timestamps) used for security and rate-limiting.

Session cookie. After sign-in we set a single httpOnly, signed session cookie so you stay logged in. It contains no third-party tracking.

2. How we use your information

• To create and secure your account and keep you signed in.
• To display your username, avatar and published items to others.
• To operate, maintain and improve the Service.
• To prevent abuse, spam and unauthorized access.

We do not sell your personal data, and we do not use it for advertising.

3. Third parties

Google. Sign-in is handled by Google. Your use of Google Sign-In is also governed by Google's own Privacy Policy (https://policies.google.com/privacy).

Cloudflare. The Service is hosted on Cloudflare Workers, with data stored in Cloudflare D1 (database), R2 (file storage) and KV (sessions). Cloudflare processes data on our behalf under its own terms.

4. Data retention

Account data is kept while your account exists. Published items remain available until you remove them or they are removed for violating our Terms. Server logs are kept only as long as needed for security and operations.

5. Your rights

You may request access to, correction of, or deletion of your personal data, and you may delete your published content at any time. To make a request, contact us at hello@cube.ai.id. Deleting your account removes your profile data; items you published may remain but will be de-identified where technically possible.

6. Security

Sessions are signed and stored in an encrypted, httpOnly cookie. We take reasonable measures to protect your data, but no method of transmission or storage is 100% secure.

7. Children

Cube Store is not directed to children under 13 (or the minimum age in your jurisdiction), and we do not knowingly collect their data.

8. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the "Last updated" date above.

9. Contact

Questions about this policy? Email hello@cube.ai.id.