INTERNATUM is a 3D social-world project operated by its development team. This policy covers our public website, waitlist submissions, and internal Alpha at dev.internatum.com. For privacy questions and requests, contact support@internatum.com.
Information we collect
- Account and Google sign-in: name, email, verification status, account identifier and profile-picture URL when provided. We request only openid, email and profile permissions. We do not receive your Google password or request Gmail messages, Drive files or Contacts.
- Authentication: session tokens and expiration times, provider account identifiers, and IP address and browser information when available. An INTERNATUM password is stored as a salted hash. Google access and refresh tokens, when supplied and retained, are protected credentials used for authentication and account linking. ID tokens verify identity and are not retained by the current account-storage flow.
- Passkeys: credential identifiers, public keys and authenticator metadata. Your device or passkey provider keeps the private key. We do not receive fingerprint images or Face ID biometric templates.
- Your character: character name, avatar choice and appearance colors, plus temporary position, direction, movement and connection status while participating in Sector 01.
- Waitlist and support: email and preference answers you submit, and information you send when contacting us. The public landing page may still offer a waitlist while the Alpha is tested separately.
How we use information
We use it to create and secure accounts, authenticate you, save characters, show participating testers in the world, deliver verification and recovery emails, respond to support, and investigate errors or abuse. Waitlist information helps us understand interest and communicate about project access and development.
We do not sell Google user data or use it for advertising, credit decisions or surveillance. We do not request extra Google permissions for features that do not exist.
Who can see it
Connected Alpha testers can see your character name, appearance and in-world movement. The world-presence API does not expose account emails, IP addresses, authentication tokens or Google account identifiers to other testers.
Our service providers include Vercel (hosting), Neon (database), Google (optional sign-in) and Resend (transactional email when configured). They process information needed to operate their services, potentially in countries other than yours. Authorized project operators may access data for maintenance, support or security. We may also disclose information when legally required or necessary to investigate abuse and protect the service.
Cookies and security
Authentication cookies and browser storage support sign-in, hosting access and interface preferences. Google sign-in and hosting access involve their own privacy practices. A Vercel review toolbar may appear for authorized reviewers. Disabling necessary cookies may prevent sign-in.
We use HTTPS, server-side database access, password hashing and access controls. Neon provides encryption in transit and at rest. The current Alpha additionally encrypts retained Google access and refresh tokens at the application layer. No system can guarantee absolute security.
Retention and your choices
We retain account and character data while needed to operate the account or internal test, until deletion is requested or test data is reset. Sessions normally expire after seven days. World presence stops being shown after a short connection timeout, although expired technical rows may remain until cleanup, re-entry or account deletion. Token or session expiry does not necessarily delete the database row immediately.
Waitlist data is retained while relevant to access and updates unless you request removal. Security records and backups may persist for operational or legal needs and are removed through maintenance and provider retention processes.
To request access, correction, account deletion, waitlist removal or deletion of Google-derived data, email support@internatum.com. We verify ownership before acting. Account deletion includes associated active character, session, passkey and linked-account records. You can revoke Google access through your Google Account; this alone does not delete your INTERNATUM account. This Alpha has no self-service account-deletion button.
Internal testing and updates
The Alpha is intended for authorized adult internal testers and is not directed to children. Test data and features may change or be reset. We update this policy when our practices change and provide additional notice or consent when required before using information for a new purpose.