Privacy Policy

Last updated: June 30, 2026

This policy explains what information Vsimulator collects, why we collect it, how we use and protect it, and the rights you have over it. We keep data collection to the minimum needed to run a free robotics simulator, and we never sell your information.

Vsimulator (the “Service”, available at sim.robostem.org) is a free, browser-based VEX robotics competition simulator operated by ROBOSTEM FOUNDATION INC, a 501(c)(3) nonprofit organization registered in the United States (“RoboStem”, “we”, “us”, “our”). This policy applies to the Service and to the data we process when you use it. It is written to comply with the EU and UK General Data Protection Regulation (GDPR) and the U.S. Children’s Online Privacy Protection Act (COPPA).

1. Children & age requirements

Vsimulator is used by many students under 18, and protecting them is a priority. The Service is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13.

Accounts require a minimum age of 13. The only way to create an account is by logging in with Discord, and Discord’s own terms already require account holders to be at least 13 (or older where local law sets a higher age). We do not offer any other way to register.
Under 13: You may not create an account. You may use the offline single-player practice mode only with a parent or guardian’s permission and supervision. That mode does not require an account and does not collect personal information from you.
Ages 13–15 (or below the digital-consent age where you live, which is up to 16 in parts of the EU): a parent or guardian must review this policy and our Terms of Service and agree on your behalf before you create an account or play multiplayer.
No private messaging. Vsimulator has no in-app chat or direct messaging. Players can add each other as friends and see each other’s public Discord username, which they may use to connect on Discord. Anything that happens on Discord is governed by Discord’s own terms and privacy policy, not ours.

If you are a parent or guardian and believe a child under 13 has given us personal information, or you want to review or delete your child’s data, email contact@robostem.org and we will delete it promptly.

2. Information we collect

If you only browse or play offline single-player as a guest, you do not need an account and we do not collect personal account information from you. When you sign in and use account features, we collect the following:

Account (from Discord)	When you log in with Discord we receive your Discord user ID, Discord username, email address, and avatar image. We request only the `identify` and `email` scopes — nothing else from your Discord account.
Profile you set	An optional display handle and an optional custom avatar image URL that you choose within Vsimulator.
Gameplay data	Match and practice results: scores, win/loss/tie outcomes, the game mode played, timestamps, and room codes. These power your stats, the public leaderboard, and your activity history.
Social data	Your friend connections (the list of accounts you have added or who have added you).
Technical data	Your IP address is used transiently to apply security and rate limits to multiplayer connections; it is not stored in our database. Standard request information (such as browser type) is processed to deliver the Service.
Analytics	Aggregate, privacy-friendly usage metrics via Vercel Web Analytics (e.g. page views and performance). This does not use cross-site tracking cookies.

3. How we use information

To create and operate your account and let you log in.
To run multiplayer matches, track your scores and win/loss record, and show leaderboards.
To let you add friends and see their public username so you can connect on Discord.
To keep the Service secure and prevent abuse (e.g. rate-limiting connections by IP).
To understand and improve how the Service is used, through aggregate analytics.
To respond to your requests and, where needed, contact you about the Service.

We do not sell your personal information, and we do not use it for third-party advertising.

4. Legal bases for processing (GDPR)

If you are in the EU, UK, or another region with similar laws, we rely on these legal bases:

Performance of a contract — to provide accounts, gameplay, leaderboards, and friends features you ask for.
Legitimate interests — to secure the Service, prevent abuse, and understand usage through aggregate analytics, balanced against your rights.
Consent — where required, including a parent or guardian’s consent for users below the applicable digital-consent age. You can withdraw consent at any time.
Legal obligation — where we must process data to comply with the law.

We share data only with the service providers needed to run Vsimulator, and only as necessary:

Discord — for login (OAuth) and to retrieve your basic profile and email.
Vercel — hosting of the website and aggregate web analytics.
Turso (libSQL) — managed database that stores your account, gameplay, and friends data.
Cloud hosting (Amazon Web Services) — runs the multiplayer game server.

Some information is public by design: your display handle, avatar, and scores can appear on public leaderboards, and your Discord username is visible to people you are friends with. We may also disclose information if required by law or to protect the rights, safety, and security of our users or the Service.

6. Cookies & local storage

We do not use advertising or cross-site tracking cookies. The Service stores a small amount of data in your browser’s local storage to function — for example your login session token, your settings, and a queue of score submissions so results are not lost if your connection drops. Clearing your browser storage will sign you out and reset local settings.

7. How long we keep data

Account & profile data: kept while your account exists; deleted on request.
Gameplay history & friends: kept while your account exists so your stats and leaderboard standing remain accurate.
Login sessions: expire automatically after 30 days.
IP addresses: held only transiently in memory for security and not written to our database.

When you delete your account, we remove your account, profile, gameplay history, and friend connections entirely. Your scores are deleted along with your account and no longer appear on public leaderboards — we do not keep an anonymized copy.

8. Your rights

Depending on where you live, you may have the right to:

Access the personal data we hold about you and receive a copy.
Correct inaccurate data or update your profile.
Delete your account and associated personal data (“right to be forgotten”) — including removing your scores from public leaderboards.
Restrict or object to certain processing.
Request a portable copy of your data.
Withdraw consent where processing is based on consent.

To exercise any of these rights, email contact@robostem.org. We will respond within the time required by applicable law. If you are in the EU or UK, you also have the right to lodge a complaint with your local data protection supervisory authority.

9. International data transfers

Our service providers may process data in the United States and other countries. Where data is transferred out of the EU, UK, or other regions, we rely on the safeguards offered by those providers (such as standard contractual clauses) to protect it.

10. Security

We protect data with measures including encrypted connections (HTTPS/TLS), expiring session tokens, and access controls on our database. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security, but we work to protect your information and to address issues promptly.

If a data breach occurs that affects your personal data, we will investigate, take steps to limit any harm, and notify the relevant data protection authority and affected users where required by law — including within 72 hours of becoming aware, as required by the GDPR.

11. Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date above, and significant changes will be reflected on this page. Continuing to use the Service after changes take effect means you accept the updated policy.

12. Contact us

Questions about this policy, your data, or a child’s data? Contact:

ROBOSTEM FOUNDATION INC — a 501(c)(3) nonprofit registered in the United States
Email: contact@robostem.org
Community: discord.gg/robostem