Niby

Game rules

It's just a game. Supposedly. But there is always a real person on the other side.

• Have fun. Absurdity welcome. Nobody here is judging how well you play an alien or an offended satnav.
• The scene is just an excuse. Mostly to break the ice, so nobody has to come up with a first message. You're adults: after that, do whatever you like — talk about anything, become friends or go your separate ways.
• A role is an invitation, not an obligation. You can step out of character (🎭) and talk normally at any time.
• A role is no excuse. No harassment, insults, threats or hate speech. "That's just how my character is" doesn't count. Spicier or darker stuff is fine only when both people want it, and either of you can back out at any moment.
• Respect boundaries. If someone changes the subject or stops replying, that's an answer too.
• Take your time with personal details. Don't share your surname, address, phone number or workplace straight away. And never share other people's details or photos.
• Photos in the chat can be sent from Act II. Photos you receive stay blurred until you tap "Show", and either of you can delete any photo in the conversation, which removes it for both. Never send anyone unsolicited intimate photos.
• Photos. Up to 5 on your profile. The other person only sees them in Act II. No nudity, violence or photos of other people without their consent. Memes welcome. Moderators remove photos that break the rules.
• “Maybe something longer?” If you tick it, you can fill in a dating section (area, a few sentences) and add up to 5 “something longer” photos. The section and the “something longer” photos are only visible to friends who also ticked it. If you tick it, you're slightly more likely to be matched with others looking for something longer. Unticking hides both. Same rules as for other photos: no nudity.
• Adults only. Niby is only for people aged 18 or over.
• Something feels off? You can mute or remove a pair, or block a person, and they won't find out. If someone breaks the rules, report them (their profile → "Report"). We read every report.
• This is a test version. Things may break. The survey after each pair helps us a lot: one minute, we promise.

Safety

Niby doesn't verify identities. Age is self-declared, and photos and bios may not be genuine. Use common sense, even when the conversation is going great.

• Never send money. To anyone, for any reason: no transfers, no payment codes, no top-ups, no card details. A sudden illness, a blocked account, a "sure-fire investment" or a ticket to come and visit you are classic scam stories.
• Be careful with intimate photos. Once sent, a photo can be saved and used for blackmail. If someone threatens to publish it and demands money: don't pay, don't delete the conversation, report them on Niby and to the police.
• Don't rush off Niby. Pushing for your phone number or to move to another messenger right at the start is a common warning sign.
• Links and files from strangers: open with care. Niby will never ask for your password in a message.
• Meeting in person: the first time, meet in a public place and get there and back on your own. Tell someone you trust who you're meeting and where. Keep an eye on your drink. You can leave at any moment, no explanation needed.
• Something's wrong? End the conversation, block and report. If you're in danger, call 112. In Poland you can also report online fraud to CERT Polska: incydent.cert.pl.

Terms (test version)

1. Who runs Niby

Niby is run by [TO BE COMPLETED: name or organisation], contact: [TO BE COMPLETED: e-mail]. Niby is in a closed test phase and is free of charge.

2. Who can use it

Only adults (18+) who have accepted these terms and the privacy policy. One person, one account.

3. How it works

We draw pairs. You can have up to 3 active conversations; friends do not count towards that limit. You can receive up to 5 new introductions per day, resetting at midnight Polish time. Leaving or becoming friends does not refund a daily introduction. Each pair gets a scene with separate roles (Act I), followed by an out-of-character conversation (Act II). Moving on requires at least 3 messages from each person in the current act and both independent choices. A room expires after either person sends no message for 24 hours, or at most 24 hours after both end Act II, unless both add each other as friends. Friends never expire. Two private leave choices close the room earlier; neither person sees the other’s unilateral choice. Blocking and reporting are always available. After reviewing a report, the organiser can close the reported room and restore a daily introduction.

4. Code of conduct

The game rules above apply. In particular, the following are prohibited: harassment, threats, illegal content, sexual content sent without consent, impersonating other people, spam and advertising, and use of Niby by minors.

5. Moderation

Reports are sent to the moderators together with the latest messages from the conversation. Accounts that break the rules may be banned. When that happens, that person's pairs are closed.

5a. Meeting outside Niby

Niby doesn't verify users' identities and isn't responsible for their behaviour outside the app. Read the safety tips before you arrange to meet anyone.

6. Test version

The service is provided "as is", may contain bugs and may be unavailable. When the test ends we may shut it down; data will be deleted in line with the privacy policy.

7. Deleting your account

You can delete your account at any time in the settings.

Privacy policy (GDPR)

Data controller

[TO BE COMPLETED: name or organisation, address], contact for data matters: [TO BE COMPLETED: e-mail].

What data we collect and why

• Account: username and password (we only store a secure hash of it). Purpose: logging in. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Profile: nickname, avatar, age, bio, topic limits and game language. Purpose: matching pairs and scenes. Legal basis: performance of a contract.
• Your gender and who you want to meet: these can indirectly reveal sexual orientation, which is special category data (Art. 9 GDPR). We process them only to match pairs, and only on the basis of your explicit consent (Art. 9(2)(a) GDPR). You can always choose "None of your business, curiosity killed the cat" and not state a gender.
• Photos: up to 5 on your profile. When you upload them we remove their metadata (e.g. location and phone model). They can be seen by you, the person you're in Act II with, your friends on Niby and the moderators. We keep them until you delete them (or the moderators do) or until you delete your account. A photo can reveal more than it seems, so choose consciously. Legal basis: performance of a contract.
• Interests, profile answers and awards: the person you're paired with sees your interests and answers from Act II (before that, only how many interests you share), awards straight away, and friends see everything. Legal basis: performance of a contract. Note: your bio, custom interests and answers are free text that strangers will read, so don't put information about your health, religion, political views or sex life there, or anything that identifies you.
• Minigames, reactions and presence: game results and reactions are stored in the conversation. Which conversation you currently have open (the green dot next to your name) is kept only in the server's memory for about a minute. Legal basis: performance of a contract.
• Scene suggestions: the content of your suggestion and your nickname. An accepted scene may show other players "Scene idea by [your nickname]". Legal basis: performance of a contract (you send suggestions voluntarily).
• Push notifications: if you turn them on, we store your device's address with your browser's notification service. Notifications pass through your browser vendor's servers (Google for Chrome and Android, Apple for Safari and iPhone, Mozilla for Firefox). Their content is encrypted, but the vendor can see that a notification was sent. On a locked screen a notification may show part of a message. You can turn them off in your profile or in your browser settings. Legal basis: your consent (Art. 6(1)(a) GDPR).
• Browser storage: we store your login token and settings (language, sounds, roles you've read) there. We don't use advertising or tracking cookies.
• What you're looking for, chat languages and the dating section: we never show anyone what you tick (“quick fun” / “something longer”); like chat languages, it's only used for matching. The dating section (area, ideal date, who you're looking for, green flag, “definitely not”) and the “something longer” photos are visible only to friends who are also looking for something longer. Everything is optional and you can change or delete it at any time; we keep it until you change it or delete your account. Don't share your address, surname or phone number. Legal basis: performance of a contract.
• Photos in the chat: only the two people in the pair can see them (and the moderators when it's reported). We remove their metadata. Either of you can delete them, and then we delete the file. When the pair expires we delete its chat photos; if the conversation was reported, photos from the latest messages are kept until the report is handled, and no longer than the end of the test. Legal basis: performance of a contract.
• Messages: the content of conversations in pairs. Purpose: running the chat and, after a pair expires, handling reports. Legal basis: performance of a contract and our legitimate interest in keeping users safe (Art. 6(1)(f) GDPR).
• Reports, blocks and surveys: purpose: moderation and improving Niby. Legal basis: legitimate interest.
• Technical data: IP address and timestamps (among other things, to protect against abuse). Legal basis: legitimate interest.
• Statistics: we count events (e.g. "the pair reached Act II") with a random account identifier and without the content of messages.

How long we keep it

• Conversations in pairs: until the pair expires. After that a copy is kept for another 30 days, only for handling possible reports, and is then deleted automatically.
• Conversations between friends: until one of the people deletes their account.
• Account and profile: until you delete your account. When the test ends, we will delete all data within [TO BE COMPLETED: e.g. 30] days at the latest.
• Reports: until they have been handled, and no longer than the end of the test.
• Photos: until you, the moderators or your account deletion remove them.
• Scene suggestions: unaccepted ones are deleted with your account. An accepted scene stays in the game, and the credit with your nickname stays until the end of the test (you can ask us to remove it).
• Notification subscriptions: until you turn notifications off, log out or delete your account.
• Surveys and statistics: until the end of the test. Once your account is deleted, they can no longer be linked to you.

Who we share data with

Data is stored by our hosting provider Railway Corporation (USA), on servers in Amsterdam (the Netherlands, EU). Railway processes it on our behalf under a data processing agreement; as it is a US company, any access from outside the European Economic Area is covered by standard contractual clauses [CHECK in Railway's DPA]. Push notifications pass through browser vendors (see above). When you open the page, your browser downloads fonts from Google Fonts (Google receives your IP address when this happens). We do not sell data and do not use it for advertising.

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict its processing, to data portability and to object. You can withdraw your consent to the processing of your gender and preferences at any time, most simply by deleting your account or by contacting us. Withdrawing consent does not affect the lawfulness of processing carried out before it was withdrawn. You can withdraw consent to push notifications by turning them off in your profile. To get a copy of your data, write to the contact address above. You also have the right to lodge a complaint with a supervisory authority; in Poland, this is the President of the Personal Data Protection Office (UODO).

Security

Passwords are stored only as hashes (scrypt). The connection to the server is encrypted (HTTPS). Only the administrator has access to the moderation panel. Messages and photos are not end-to-end encrypted: the administrator has technical access to them and uses it only when handling reports and moderating.