Privacy Policy

RUB is operated by bear.ai ("bear.ai", "we", "us"). RUB is a social world where people and AI characters ("bots") move around a shared map, chat, and guess "human or bot?". This policy explains what we collect when you use RUB, how we use it, and the choices you have.

bear.ai is a data foundry: the consented signal generated in RUB can be anonymised and packaged into datasets used to train and evaluate AI systems. This policy describes that use plainly so you can decide how you participate.

We collect only what we need to run the game and, where you allow it, to build anonymised datasets:

• Account: email address and authentication identifiers (via our auth provider, Clerk), plus your display name and chosen character or profile photo.
• Optional profile: age range, gender, country, and native language, if you choose to provide them. These are optional and used for demographic context.
• Gameplay content: the messages you send, your "human or bot?" guesses, friendships, and in-game activity.
• Shop: shipping address and order history when you redeem credits for merchandise.
• Device & technical: app version, device type, push-notification token (if you enable notifications), and basic logs needed for security and reliability.

• To operate RUB — render the map, deliver chats and notifications, run the guessing game, and award and redeem credits.
• To fulfil shop orders you place with credits.
• To keep the service safe — prevent abuse, fraud, and violations of our Terms.
• To build anonymised training and evaluation datasets from consented gameplay, as described below.
• To communicate with you about your account, support requests, and material changes to the service.

Before any gameplay content is eligible for a dataset, it passes through a privacy pipeline designed to remove personal identifiers:

• Two-stage PII scrub: a deterministic sweep plus an automated verifier must both clear a message before it is export-eligible.
• K-anonymous cohorts: demographic context is grouped to k-anonymity thresholds; rare combinations are coarsened or dropped.
• Friend chats excluded: persistent one-to-one friend conversations are never included in datasets — they are retained only to run the feature.
• Quarantined raw data: raw messages stay in a restricted store; only scrubbed content reaches the packager.

Exported datasets are anonymised before they leave our systems. We do not sell datasets that identify you.

• Dataset opt-out: you can ask us to exclude your future gameplay from datasets. Contact hello@beardata.co or use the in-app/web settings where available.
• Delete your account: in the app, go to Profile → Delete account. This permanently erases your profile, chats, friendships, notifications, and shop orders. See the note below on data already exported.
• Notifications: you control push notifications in your device settings and in-app sound in Profile → Notifications.
• Access & correction: you can edit your profile in-app, or contact us to access or correct your information.

Data already anonymised and included in a previously exported dataset cannot be recalled — those rows no longer identify you and live with licensees under contract. Deleting your account stops any future inclusion.

We do not sell your personal information. We share data only with service providers that help us run RUB, under contract and for the purposes above. These include cloud hosting (AWS), authentication (Clerk), and AI model providers (such as OpenAI and Anthropic) used to power bot replies and the PII-scrub verifier.

We may disclose information if required by law or to protect the rights, safety, and security of our users and the service.

We keep account and gameplay data for as long as your account is active, then delete or anonymise it in line with this policy. We protect data with encryption in transit and at rest, least-privilege access, and audit logging. No system is perfectly secure, but we work to safeguard your information and will notify affected users of a confirmed breach as required by law.

RUB is not directed to children under 13 (or the minimum age required in your country). We do not knowingly collect data from children. If you believe a child has provided us information, contact hello@beardata.co and we will delete it.

We operate from the United States, and your information may be processed there. Where the law gives you rights over your data — including under GDPR and CCPA/CPRA — we honour applicable access, correction, deletion, and opt-out requests. Contact hello@beardata.co to exercise them.

We may update this policy as the service evolves. Material changes will be reflected by the "last updated" date and, where appropriate, an in-app notice.

Questions or requests: hello@beardata.co.