Privacy notice
Village People is a game where everyone watches the neighbours. This page says exactly what we see of you, who else does, and how long we keep it.
Last updated 16 October 2026.
Who we are
Village People is run by Noxenvah Games, an Ovalay Studios company (“we”). We decide how your information is used in the game and we are responsible for it. Write to us at support@villagepeople.xyz about anything on this page.
The short version
- We ask for your email and a display name. Nothing else about you: no phone number, home address or birthday.
- Your display name, compound and rank are public in the game, and anyone you give your address link to can see them.
- Private messages go to the person you write to. Village chat is visible to residents of your village. When a player reports someone, moderators can read their recent private conversation and the reported player’s recent village chat messages.
- Messages are deleted after 90 days.
- We don’t sell your information or show you adverts, and there are no advertising trackers.
- You can ask to see, correct or delete what we hold about you: write to support@villagepeople.xyz.
What we collect
What you give us
- Email address, to sign you in and send the notices you can switch off.
- Display name, which you choose. Other players see it, so it doesn’t have to be your real name.
- Password, if you set one. We keep only a scrambled (hashed) version and can’t read it.
- Invitation code, if a player invited you, so the two of you stay connected.
- What you write: messages of up to 280 characters, and reports with an optional note.
What playing creates
- Your compound, purse, buildings, farms, rank and standing, the moves you make, and the moves made against you.
- Who your padis are, who you keep malice with, and padi asks.
- Lines in the village activity that name who did what.
- Game events we record to balance the game, such as which compounds you open and how far you get through the welcome tour.
- If you buy rush credits: which pack, how many credits, and Stripe’s reference numbers. We never see or store your card.
What your device sends
- IP address and browser details, kept with each sign-in session and in the limits that stop password guessing. Our sign-in provider also works out your approximate location (city and country) from your IP address.
- Error reports when something breaks. For a sample of visits, a replay of the screen with all text and typing masked, so we can see what went wrong.
- Page visits, counted without cookies.
- Optional notifications: if you enable them, we keep your browser’s delivery address and encryption keys, notification preferences and time zone. While the village is visible, we record a recent-visit time to avoid sending alerts you already see.
- Where you’re walking in the village while you play, shared live with the other players there. This is not stored.
Who can see what
| Who | What they see |
|---|---|
| Anyone you give your address link to | Your display name, village, street address, and your compound and its level. Link previews show the same. |
| Players in your village, and players linked to you by an invitation | Your display name, compound, level, rank and how you're doing (building, quiet or under pressure), village activity that names you, and where you're walking while you're both online. |
| The player you write to | Your messages to them. If they keep malice with you, what you send is held back from them, and only you see it. |
| Residents of your village | Your village chat messages. Players keeping malice with you do not see them. |
| Moderators | When one player reports another: the report, its note, a copy of the last 30 private messages between the two, including any held back, and up to 30 recent messages by the reported player in the reporter’s village chat. Previously reported village messages are retained with an open report. Moderators also see who has been paused, and why. |
| Us | What we need to run the game, keep players safe and fix problems. |
Other players never see your email address.
Comeback emails use your last game visit to send one reminder after two weeks away. We keep a delivery record to avoid repeating it during the same absence. You can turn these reminders off in your profile or with the unsubscribe link in each email.
Why we use it
| What for | Our reason |
|---|---|
| Running your account and the game, and delivering your messages | To provide the game you signed up for. |
| Signing you in safely, stopping password guessing and abuse, and handling reports | Our legitimate interest in keeping players and accounts safe. |
| Finding and fixing bugs, and seeing how the game is played so we can balance it | Our legitimate interest in a game that works. |
| Emailing you when a neighbour moves against you | Our legitimate interest in keeping you in the game. Every one of these emails has a link to stop them. |
| Selling rush credits and keeping payment records | To provide what you bought, and because tax and accounting law requires the records. |
We don’t use your information for advertising, and we don’t sell it. One thing happens automatically: if three different players report you within a day, the game limits your messages to your padis until a moderator reviews the reports. If you think that was wrong, write to support@villagepeople.xyz.
Who else handles it
These companies process information for us, to provide their service to us:
| Company | What it does for us |
|---|---|
| Vercel | Hosts the game, and counts page visits without cookies. |
| Supabase | Hosts our database. |
| Railway | Runs the live service that shows players where everyone is walking. |
| Better Auth | Runs our sign-in security dashboard. It receives your email, display name, IP address, approximate location and browser details when you sign up, sign in or sign out. |
| Resend | Sends our emails: sign-in links, notices of moves against you, comeback reminders, and alerts to moderators about reports. Those alerts carry names and reasons, never messages. |
| Your browser’s push provider (Apple, Google, Mozilla or Microsoft) | Delivers notifications you enable. Notification contents are encrypted in transit through the provider and never include private message text. |
| Stripe | Takes payment for rush credits. Stripe handles your card; we never see it. |
| Sentry | Receives error reports and the masked screen replays. |
These companies are based outside Nigeria, mostly in the United States and Europe, so your information is transferred to and stored in those places. We share information with authorities only when the law requires it.
How long we keep it
| What | Kept for |
|---|---|
| Messages | 90 days |
| Messages held back because someone kept malice with the sender | 30 days |
| Padi asks, answered or not | 90 days |
| Reports, with the messages they keep | Until a moderator reviews them, then one year |
| Sign-in sessions, with their IP address and browser details | A session lasts a week from your last visit; we keep it 30 days after it ends |
| Limits on sign-in attempts, keyed by IP address | A day after your last attempt |
| Sign-in links | They work for five minutes; we delete them a day later |
| Notification subscriptions | Until you turn them off or log out, the provider reports them expired, or our scheduled cleanup finds an expired sign-in or 90 days without use |
| Notification delivery records | Up to seven days after an alert expires, removed by scheduled cleanup. Preferences stay with your account. |
| Your account, compound, game history, padis, malice and game events | As long as you have an account. If you're away for 6 months, your home in the village is released, but your account stays so you can come back. |
| Payment records | As long as tax and accounting law requires |
| Error reports and replays | A limited time, under Sentry's retention settings |
On your device
- The cookie
better-auth.session_tokenkeeps you signed in for a week after your last visit. The game can’t work without it, so we don’t ask before setting it. - A notification device cookie,
vp-push-device, helps manage notifications on this browser and expires after a year. Your browser also remembers if you dismiss the notification offer. You can turn notifications off in your profile. - Your browser also remembers your sound setting and how far you got in the welcome tour.
- If your visit is chosen for an error replay, Sentry keeps an identifier for it in your browser until you close the tab.
- There are no advertising or cross-site tracking cookies.
Your rights
Under Nigeria’s Data Protection Act 2023, and the UK GDPR or GDPR if you live in the United Kingdom or the European Union, you can:
- see what we hold about you, and have a copy;
- have it corrected;
- have it deleted;
- object to how we use it, or ask us to restrict it;
- take it elsewhere in a common format;
- complain to the Nigeria Data Protection Commission, or to the data protection authority where you live.
To do any of these, email support@villagepeople.xyz from the address on your account. We’ll answer within a month. Deleting your account deletes your messages, padis, compound and game history, or makes them anonymous where another player’s record depends on them, such as a move made against them. Payment records and reports about you are kept for the times above.
You can also act now: stop move emails with the link at the bottom of any of them, keep malice with anyone, and choose a display name that isn’t your real name.
Age
Village People is for people aged 18 and over. If you’re younger, please don’t play. If we learn that a player is under 18, we’ll close their account and delete their information.
Keeping it safe
Everything travels encrypted (HTTPS). Passwords are stored only as scrambled hashes. Only our servers can reach the database, and our moderation tools run only on our own machines. No system is perfectly secure: if a breach puts you at risk, we’ll tell you, and the regulator, as the law requires.
Changes
When we change how we use your information, we’ll update this page and the date at the top. If a change matters to you, we’ll say so in the game before it takes effect.
Questions about any of this: support@villagepeople.xyz.