Privacy Policy

This is a reference translation. The Japanese version is the official one, and it prevails if the two differ.

This page explains what information Vespo (the “Service”) holds, what it is used for, and where it is kept. Last updated: September 8, 2026

1. Who runs the Service

Operator: RORARIngo
Contact: roraringo000@gmail.com

2. Information we hold

The Service holds the following information.

Sign-in information

• If you sign in with Roblox: your Roblox user ID and display name
• If you sign in with Google: your Google account ID and display name
• If you sign in with GitHub: your GitHub account ID and display name
• If you sign in with email: that email address

We do not hold passwords. Sign-in happens on Roblox’s, Google’s or GitHub’s screen, or through a link sent to your email, and the Service only receives the result.

Even without signing in, if you send a message inside a Roblox experience that has the Service built in, your Roblox user ID, display name and the message are passed to us through that game’s developer, and a user (box) is created for you automatically. If you later sign in with Roblox, those chats appear.

Things you create

• Your profile (display name, bio, icon, links)
• Your statuses (how you feel, what you are doing) and their visibility settings
• Chat contents (text, photos, drawings, voice messages, stickers, GIFs, reactions, polls)
• Chat settings (name, icon, notifications on or off)
• Call history (when, who joined, how long, and the short note attached when calling). Audio and video from calls are not stored
• Friendships, people you have blocked, and notes you have written about people
• Reports you make (including a copy of the reported message)
• Invite links (who made them; they expire after 7 days)
• Records inside mini apps (which mini apps you have opened, saved data, scores, whether you are present, how many notifications you have received)

Icon images are served from a public URL (anyone with the link can see them). Photos, voice messages and stickers are private; each viewer gets a URL that is valid only for a short time.

If you register as a developer

• Your name and contact email address (we send a confirmation email)
• API keys (we do not store the key itself, only a value used to verify it)
• Number of calls, failures, response times and concurrent users (this does not include who said what)

What mini app authors receive

A mini app is a website made by someone other than the operator (the author). On the consent screen the first time you open one, you choose whether to share what that mini app asks for. Only the following can be shared.

• An ID unique to that mini app (a different value for each mini app, even for the same person; always shared)
• If you choose to: your name, icon, room key (a string that is the same for everyone in the same chat), whether you are in a call, who you are with, and your voice level

Information that is shared may be stored on the author’s server, which the Service does not manage. Our Terms require authors to use it only to run that mini app and to delete it when a user stops using the mini app. When you stop using a mini app, you can delete what the Service holds for it (Settings → Mini apps → Stop). Notifications from a mini app go only to people who have opened it, at most 3 per day (you can turn them off in Settings).

Payment information

• What you bought, the amount, the date and time, and the Stripe transaction number
• If you bought something as a gift: who you gave it to
• If you receive money as a developer: your Stripe account number and whether you are ready to receive payouts
• If you subscribe to Pro for developers: your Stripe customer number, and the subscription’s status and expiry

Card numbers are entered on Stripe’s screen and never reach the Service.Developers’ identity documents and bank account details are also held by Stripe.

Recorded automatically

• Device information needed to send notifications (push notification tokens, browser subscriptions)
• Which Roblox experience and server you are in. This is recorded regardless of your settings(the “show what I’m playing” setting controls whether it is shown to others, not whether it is recorded)
• Your Roblox friends list (to the extent it is public on Roblox)
• Your language setting. We record your device’s language when you sign in, and send notifications and email in that language (you can change it any time in the app’s Settings)
• Your notification history
• Server logs (time of requests, IP addresses and so on). Rather than something the Service collects, these are kept for a period by the services we use (Vercel, Supabase)

We do not use advertising data or any behavioural tracking.

3. What we use it for

• To show chats and deliver them to the other person
• To notify you of new messages and incoming calls
• To show friends, statuses and “now playing”
• To deal with abuse (reviewing reports, stopping use of the Service)
• To deliver what you bought and pay authors their share
• To fix bugs

We do not use it for any other purpose without your consent. We never sell it to third parties.

4. Services that receive your information

We use the following services to run the Service.

• Supabase (database and file storage; servers in Tokyo, Japan): almost all the information we hold
• Vercel (server hosting; our functions run in Tokyo, Japan): handling requests
• LiveKit (calls; a US company): audio and video during calls. Call contents are not stored
• Expo / Google Firebase (push notifications; US companies): where to send notifications, and the short text shown in them
• Roblox(a US company): sign-in verification, avatar images, catalog search, friends and “now playing”
• Google (a US company): verification when you sign in with Google
• GitHub (a US company): verification when you sign in with GitHub
• Resend (email delivery; a US company): the email address that sign-in links and notices are sent to
• Stripe (payments; a US company with a Japanese subsidiary): information needed for payment. Card numbers and identity documents are held only by Stripe
• GIPHY (GIF search; a US company): what you search for. This is sent directly from your device
• Game developers (Roblox experiences that use the chat API): they see only numbers such as call counts, failures and concurrent users, never who said what
• Mini app authors: the information you chose to share on the consent screen (see “What mini app authors receive” above)

The location in parentheses is where the company is based; server locations are as published by each company. Please use the Service with the understanding that information may be transferred outside Japan, including to the United States. It is handled under each company’s own terms and privacy policy.

5. How reported content is handled

When a report is made, we receive only the one reported message. We do not receive the conversation around it or the contents of other chats.

We use what we receive only to deal with abuse. We keep a copy taken at the time of the report so that a record remains even if the original message is unsent or the whole chat is deleted.

6. The operator’s ability to see data

Because the operator runs the servers, we are technically able to see the data we hold. We cannot promise it can never be seen.

In practice we look at content only when necessary, such as handling a report or investigating a bug. We do not read through people’s everyday conversations.

7. How we protect it

• All traffic is encrypted (HTTPS)
• The database is configured so it cannot be read or written without the server’s key. It cannot be looked into directly from outside
• The Service is built so that it never holds passwords in the first place (sign-in is through Roblox / Google / GitHub or an email link)
• It is built so that it never holds card numbers (payment happens on Stripe’s screen)
• The only people who can touch the data are the operator and, within the scope you consented to, mini app authors

8. How long we keep it

• Chat contents: for as long as your account exists
• Inside a Roblox experience, only the most recent part is kept because of storage limits (older messages are no longer visible in the game)
• If you stop being friends with someone or block them: the chat between just the two of you is deleted, messages and all
• If everyone leaves a chat: the chat and its contents are deleted
• Reports: for as long as needed to deal with them (kept even if the reported person leaves the Service)
• Invite links: expire after 7 days. Tickets used to open a mini app: deleted after 60 seconds
• Notification history, the history of where you were in Roblox, and developer metrics (in 5-minute steps): not automatically deleted at the moment

9. Seeing, correcting or deleting your information

If you want to know how your information is recorded or have a mistake corrected, contact roraringo000@gmail.com. You can edit your profile and statuses yourself in the app at any time.

You can delete your account yourself from “Settings” in the app. Deleting it removes your users (personas) and the chats between just you and one other person, messages and all. This cannot be undone.

However, what you wrote in group chats remains, because it is also part of other people’s chats (removing it would leave holes in their conversations).

The following also remain after deletion.

• Copies left inside Roblox experiences (data on the game’s side cannot be deleted from the Service)
• Purchase records and records of how money was split (kept for accounting). For records that were passed to a mini app’s author, ask the author to delete them
• Records of reports made about you (to prevent repeat abuse by leaving and re-registering)
• If you were registered as a developer: your registration, the mini apps you made, and your Stripe connection are not deleted automatically. Contact roraringo000@gmail.com

If deletion does not work, or for anything else, contact roraringo000@gmail.com.

10. Children

Because the Service is connected to Roblox, children may use it. If a child uses it, a parent or guardian should read this policy and agree to it before letting the child use the Service.

If a parent or guardian asks us to delete a child’s information, we will do so after verification. Minors need a parent or guardian’s consent to buy anything.

11. What is stored on your device

Your device (browser) stores your sign-in state, your appearance setting (light or dark), your language choice, and the list of text for the language you chose (fetched from the Service’s website). The web version added to your home screen keeps some files on the device so it opens faster. Cookies set inside a mini app belong to that mini app’s author. We do not use advertising cookies.

12. Changes to this policy

As features are added, the information we hold changes too. When it does, we update this page. For major changes we also announce it inside the app.

13. Contact

roraringo000@gmail.com