Obunu · Privacy
Privacy statement
What we keep about you, why and for how long, who else sees it, and how to have it removed. No ads, no tracking cookies, and nothing is sold.
Last updated: 21 October 2026
Who
Obunu's passport (passport.obunu.com, the Obunu app's sign-in, the console's sign-in) and obunu.com are run by Future Dynamic, Segment 3, Box C2257, 6921 RC Duiven, the Netherlands, which is the controller of your personal data. More about us: the contact page. Questions, or anything you want seen, changed or removed: privacy@obunu.com.
Your world isn't ours. A world you host yourself runs on its owner's own computer. What happens inside it (who says what, what is on its walls, what it records) is between you and that world's owner; they are responsible for it, not us. This statement is about what we keep.
What we keep, and why
The legal ground for each is from the GDPR, article 6(1).
- Your passportYour mail address (to sign you in with a code or a link), your handle, the name you show and your look. If you sign in with Google or Facebook: the name, mail address and picture they send. Nothing else from those accounts, and nothing is posted there.
- FriendsFriend requests, who accepted, the roles you give or get in worlds; knocks (who knocked where, and the answer).
- Your worldsTheir name, address, colour, whether they are open, how many people are inside, and who may find them.
- Visas and visitsWhich worlds you were let into and when (the last time, per world), so a world can ask who is inside it now (only that world, about the last 12 hours). Where you are, shown only to friends who may find that world; you can turn that off.
- The storeWhat you took (when, and whether it was a gift or bought), your credits and every change to them, your saved looks. Only you see these; worlds see only the look you wear.
- PaymentsWhat you bought, when, for how much, Stripe's reference for the payment, and whether it was refunded. Never your card: Stripe holds that.
- DreamsA closed world's files and where things stood, and notes left in it (who, where, when, the text).
- Things you carryPer world, what your pouch holds there (each thing's name, shape, colour and, when it has one, its model).
- Worlds we host for youIf your pass includes a hosted world: its files, its state and its nightly backups, on a machine of its own.
- The betaWhich wave invited you, and when you joined.
- The waitlist, on obunu.comYour mail address, which button on the page you used, when you asked, when we mailed you and how often, and when you confirmed.
- Help reports from the console (Something's wrong?)What you wrote, the console's recent log (without tokens, personal paths or voice credentials: the console takes them out, and the passport once more), the console's version and system, and your mail address only if you typed one to hear back.
What we don't keep: your voice (it goes from browser to browser, or through the relay, encrypted end to end between the browsers: the relay can't hear it), what you do inside a world, the contents of worlds you host yourself (except a dream you or the owner leave), and your password (there is none).
The waitlist
Until Obunu opens, obunu.com has a waitlist. We send you one mail with a link to confirm (an address isn't on the list until then), and a mail when you are invited. Nothing else, and nobody else gets the address. To leave it, use the link in the mail or on the page you confirmed on, or write to privacy@obunu.com; the address is gone at once.
Counting, without cookies
Neither obunu.com nor the passport sets tracking cookies, keeps an id in your browser, or ties one visit to the next.
- obunu.com counts that a page was seen (and the page you came from), which parts were scrolled to, which button was pressed and what was tried on it, with the kind of browser, system and screen. Each visit gets a new random number. Nothing is sent when your browser asks not to be tracked (Do Not Track, Global Privacy Control).
- The passport counts a few things, each with a new random number and nothing about you (no address, no passport id, no name): that a passport was made (and which obunu.com button led there), that someone joined the waitlist or confirmed it, that a help report came in (with the console's version and system), and that a wave of invitations was opened, sent or joined.
- The counts go to PostHog, in the EU (Frankfurt), without a person profile. The passport's counts come from the passport, so PostHog never sees your address with them. obunu.com's come from your browser, so PostHog sees the IP address it connects from, like any site you load.
Why: our interest in knowing what brings people in and whether an invitation works, with as little about you as we can (6(1)(f)).
Keeping the passport safe
- Rate limits. To stop someone flooding the passport, it counts calls per IP address and per passport. A count is kept under a code made from the address with a secret only the passport knows, so the address itself isn't stored; a count is forgotten after a day (6(1)(f)).
- Health checks. Every five minutes the passport checks its own parts and keeps the results for 90 days. No person is in them. obunu.com/status shows them.
- Backups. Every night the passport's database is copied, encrypted with a key only we hold, and kept for 30 days. The copy holds your passport and sign-in identity (mail address, which provider), not your sign-in sessions or one-time codes.
- Logs. The services the passport runs on keep short logs of requests (when, from which IP address and browser) to keep them safe, for a few days.
Who else sees what
- The worlds you walk into. Run by whoever hosts them, not by us. When you go in, the host gets a visa (valid a minute) with your passport id, your name, your look, your role there, where you came from, and the things you carry. While you are inside, a world with a globe can ask the passport for your atlas (which worlds you can find, which friends are where).
- Your friends see your name, handle and look, the worlds you let them into, and where you are (unless you turn that off). Friends of your friends may see a world of yours on their Home if you allow it, and knock.
- The people who walk a dream see the world's files; its owner sees the notes left in it, with the name and handle of whoever left them. A dream is served from an address of its own, which never sees your sign-in and sets one cookie for that dream's files (no tracking), which ends after two hours.
- The few people who run Obunu can see the waitlist's numbers, the waves, and what each world's relay and dream cost. They see waitlist addresses only masked (r•••@example.com).
And the services we use, each only to run its part, under an agreement with us as our processors:
- SupabaseThe database and sign-in.
- VercelThe passport's pages and functions, obunu.com, and the file store for dreams.
- ResendMails: sign-in codes, the waitlist, invitations and our own alerts.
- StripePayments: Stripe processes your payment and holds your card details; we get only what you bought and Stripe's reference for it.
- CloudflareWorld addresses (a tunnel per world: it carries the world's traffic and stores none of it), the voice relay (it carries encrypted voice when two homes can't reach each other), and the backups of worlds we host.
- Fly.ioThe machines that run worlds we host for you.
- PostHogThe counts above, with nothing about you.
- GitHubThe encrypted nightly backup of the passport's database.
- Google, MetaOnly if you sign in with their button.
Where a service handles data outside the EU, it does so under the safeguards the GDPR asks for (the EU-US Data Privacy Framework or the EU's standard contractual clauses). Nothing is sold, and there are no ads.
Removing it, and your rights
- To remove your passport: mail privacy@obunu.com from the address you sign in with (or say which Google or Facebook account you used). Within 30 days your passport goes, with your look, friends, worlds, roles, notes and what you carry; the nightly backups that still hold it go within the 30 days after that. Payment records stay as long as tax law requires.
- You may see what we keep about you, have it corrected or removed, take it with you, object to the counting, or withdraw a consent (the waitlist: its link takes you off at once). Ask at privacy@obunu.com.
- Not happy with our answer? You can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.
- Children: Obunu is for people of 16 and older (the terms, section 4).