Last updated: 18 October 2026

3D User ("we", "us", "our") respects your privacy. This Privacy Policy explains what information we collect when you use 3duser.org, how we use it, who may receive it, how long it is kept, and the choices available to you.

3D User allows users to visit independently operated 3D worlds.

The 3D User website and account system are operated by us. Individual world servers are separate programs operated by their world owners, often on computers controlled by those owners.

When you enter a world, limited account information is provided to that world's server so it can identify you and determine what you are allowed to do.

When you enter a world, the world server receives:

• your account ID;
• your display name and username;
• your 3du number;
• your Site role, such as user, moderator or administrator;
• whether you are a Site administrator;
• whether you are permitted to operate worlds;
• whether you are a paid member or guest;
• whether you are permitted to build; and
• confirmation that you have access to 3D Worlds.

World servers are not provided with your:

• email address;
• password;
• profile photo;
• payment information; or
• history of visits to other worlds.

We do not send your IP address to world servers. However, because your browser communicates with a world's machine when you enter it, the operator of that machine may technically be able to observe network connection information in the same way that operators of other internet services can.

A world may store information required to operate the world and its features, including:

• Chat transcripts, retained for 30 days for moderation purposes.
• Recent chat, with the last 100 lines temporarily held in memory and visible to people entering the world. This disappears when the world server restarts.
• Entry and exit records, retained for 30 days.
• Building history, including objects created, moved or deleted, retained for 12 months.
• World import and export records, retained for 12 months.
• World settings, permission changes and moderation records, retained for the life of the world.
• Your chosen appearance, such as body, skin, outfit and face settings.
• Land and building permissions assigned to you.
• Your account ID, 3du number and display name, so the world owner can identify previous visitors when granting land or permissions.

World servers do not record a history of where you walk within a world. A position may be recorded when you create, move or delete an object because the object's location forms part of the building record.

A world owner may operate an optional AI assistant for their world.

Questions sent to a world assistant through the Support channel may be passed to the world owner's chosen AI provider together with relevant recent conversation and limited information about your location and nearby objects within that world.

The world assistant may also keep notes on the world owner's machine to provide continuity between conversations.

These assistants are operated by individual world owners using their own AI-provider accounts. 3D User does not receive or store the world owner's AI-provider credentials.

When you enable an independent Building Companion, 3D User stores your account and world IDs, the builder label, permitted actions and lots, creation and expiry times, revocation state and a hash of the access key. The raw key is shown once. Access expiry stops authorization; grant records are retained until account/world deletion or operator removal.

The selected world receives your account ID, role, current building and developer permissions, grant ID, label and scope. It keeps job plans, object/route/forest changes, receipts and undo information on its own machine, with up to 256 retained jobs and the latest 1,000 activity events. These records have no automatic time-based expiry; expired unused drafts are pruned when another plan is prepared. Cancelling access does not remove completed buildings or history.

The AI application you connect can receive the permitted terrain, object and asset data, nearby road/rail information and forest recipe, and can make local inspection images. That application and its chosen AI provider handle this information under their own policies. The independent connector does not create a world visit or collect player chat, private messages, avatars or player movements. Its connection file contains the access key and must be kept private.

Deleting your 3D User account removes information held by us as described below, but it cannot automatically remove information stored on independently operated world servers.

A world you previously visited may therefore retain information such as your account ID, display name, 3du number, appearance, land permissions and records that have not yet reached the end of their retention period.

If you want information held by a particular world removed, you should contact that world's owner. You may also contact us if you need assistance dealing with a world operator.

Every 3D User account receives a permanent identifier consisting of 3du followed by eight digits.

Your 3du number is public and may appear on your profile. It is used to identify you for features such as assigning land or permissions within a world.

A 3du number is an identifier only. It cannot be used as a password, login credential or method of bypassing account security.

A 3du number is never reassigned to another person.

If you create an account using an email address and password, we store your email address and a securely hashed version of your password. We do not store your password in plain text.

If you sign in using Google, we may receive your name, email address and profile picture from Google for authentication and account creation. Facebook sign-in is no longer offered; previously linked account information may remain with an existing account until it is removed or the account is deleted.

We store information you choose to add to your profile, such as:

• display name;
• username;
• biography;
• profile photo; and
• emoji avatar.

Profile photos are stored using Cloudflare R2 and are accessible through a public web address. They are not intended to be private files, so you should not upload a profile image that you do not want others to be able to see.

When you replace a profile photo, the previous file is deleted.

Depending on the features you use, we may store:

• forum threads and replies;
• news comments;
• direct messages;
• Support channel messages;
• chess games, moves and ratings;
• conversations with historical AI characters;
• content you build in 3D worlds;
• friendships and related social information; and
• information required to operate world access and permissions.

While you are inside a 3D world, we record which world you are currently using and when you entered it.

This is used to operate world access and enforce the one-world-at-a-time rule.

Your friends may be shown whether you are online or offline. They are not shown which world you are visiting.

When you visit the Site, we use a keyed cryptographic hash of your IP address to estimate the number of distinct visitors.

We do not store the IP address itself or associate this visitor-count hash with your account or Site activity.

The hash is deleted after 35 days.

We also use an essential session cookie to keep you signed in.

Payments for memberships and world services are processed by Stripe.

Your card details are entered on Stripe's systems and are not received or stored by 3D User.

We retain information required to manage your purchase or subscription, such as a Stripe customer reference and membership or service dates.

Email sent to our support address is retained so we can respond to you and maintain our correspondence.

Support email is private correspondence and is separate from the public Support channel available on the Site.

When content is reported or moderation action is taken, we may keep a record of the report or action for moderation, security and accountability purposes.

You can choose to save supported API-service connections for OpenAI, DeepSeek, Anthropic, Google, the xAI API, Mistral AI, Alibaba Cloud, Cohere and OpenRouter in your private 3D User account. OpenRouter offers supported models from several publishers; the model publisher and the API service can be different companies. We encrypt the saved API key, connection name, provider-specific connection settings, selected model, companion notes and private build-job details. Your account page shows a masked key and does not reveal the saved full key. API-service names, record IDs, account association, dates, test status, AI activity identifiers/status, build-job identifiers/status and privacy revisions are service metadata. Keys and private notes are kept on the trusted account service, separately from world files and ordinary world backups. World owners and ordinary administration features cannot browse them. Protecting the host and its separate encryption configuration remains our responsibility.

Testing a connection or refreshing available models contacts the selected API service using your key and any required workspace selection. These operations do not generate a conversation. API-service use has its own terms and billing. A gateway such as OpenRouter can route a requested generation to its model-hosting providers; the gateway and the selected host may receive the request and any memory you choose to include. Your account settings identify the API service separately from the model publisher. Removing a connection stops its future use here; revoking the key with its API service is a separate action. Removing a connection does not delete your saved memories.

Companion memory starts off. If you enable it, you can save selected short notes about builds, preferences, conversations, stories and running jokes, then inspect, correct or forget them. You may explicitly choose to keep a sensitive personal note. Do not save passwords, API keys or other people’s private conversations. Turning memory off stops its use and the creation of new notes; your existing notes remain available for you to inspect, correct and forget. Notes remain until you forget them or delete your account, within the limits displayed on the account page.

The optional building companion sends your request, bounded recent conversation, selected memories and a limited survey/catalogue for your selected owned lots to the chosen API service and any model host it uses. Surveys may include nearby public objects whose footprints cross those lots; private asset catalogues require the world owner’s appointment. Review a proposal before placing it. To inspect or apply an authorised task, the world receives your account identifier, short-lived task authority, selected lots, proposed world changes and job identifiers. It does not receive your provider key, private conversation or account memories. Discussion and proposals do not themselves place anything. Undo is available only when native checks still permit it. The companion keeps a short conversation in the open page’s memory, clears it when the page loses focus or the account changes, and does not save a full conversation to your account. Short memory suggestions or completed-build notes are saved only when you expressly choose. Encrypted build-job records contain task details, references, summaries and receipts for recovery; they do not contain full prompts, generated replies or provider keys. History is bounded to 128 records, with older completed records pruned as new jobs are created. AI operation of World Server Manager through this account companion is not enabled by this release. The API service and any selected model host apply their own privacy, retention and billing terms.

Account deletion removes active saved AI keys, notes and account build-job records. Encrypted historical copies can remain in account-service database backups for up to 30 days. Our current hosted schedule keeps daily snapshots for 6 days and weekly snapshots for 27 days. Separate world backups and their retention are chosen by each world owner. We do not place private account keys or notes in those world backups. World-side build records and placed objects belong to the world and can remain in its files and owner-selected backups; deleting account AI history or memories does not undo a build or remove those world records.

We maintain a separate signed privacy revision and deletion history so an older database restore does not silently reactivate removed keys or forgotten notes. It contains signed hashes, revisions and deletion markers, rather than your key or note text, and is retained to enforce those privacy decisions. A recovery conflict keeps affected AI data closed until current matching records are recovered or you explicitly discard the recovered AI connections and notes. An old backup of this history is not treated as proof that later deletions never happened.

Private companion memory is separate from world-owner-operated Support assistants and historical-character conversations. This feature does not automatically collect full conversations or grant an AI extra world, building, storage or Manager permissions. You can change your account password from your own profile; a successful change revokes existing sign-ins. Accounts created with an external sign-in service can add a password using an emailed setup link.

We use information collected through 3D User to:

• create, authenticate and secure accounts;
• keep users signed in;
• provide 3D worlds, chat, friends, forums, news and chess features;
• manage world access, building rights and world-server permissions;
• process memberships and world-service payments through Stripe;
• provide support;
• investigate reports and moderate the service;
• enforce our Terms of Service;
• protect users and the Site from misuse; and
• understand aggregate Site usage, such as approximate visitor numbers.

We do not use Site activity to create advertising profiles about individual users.

3D User is a social service. Information you choose to make public or use in public features may therefore be visible to other users.

This may include:

• your display name;
• username;
• 3du number;
• avatar;
• profile information;
• forum posts and replies;
• news comments;
• Support channel messages;
• public chess history;
• things you build in a world; and
• your display name while you are present in a world.

Your display name is not automatically your email address or legal name.

Direct messages are visible to you and the person you send them to. They are not publicly displayed.

Messages are stored in our database in readable form. Administrators may access them where reasonably necessary to investigate reports, illegal activity, serious harmful behaviour, security problems or similar issues.

Direct messages are not routinely read and are not used to train AI models.

The Support channel is a shared public support area, not a private support ticket.

Messages posted there may be read by other members and are retained indefinitely so previous solutions and discussions remain available.

If you post to Support while inside a world, the name of that world may be displayed with your message.

For private support, contact us by email instead.

We do not sell your personal information to advertisers or data brokers.

We use service providers where necessary to operate 3D User, including:

• Google — if you choose to use its sign-in service.
• Anthropic — to generate responses from our historical AI characters.
• Stripe — to process payments.
• Cloudflare — to store uploaded files, including profile images and world assets.
• Railway — to host the Site and its database.
• Migadu — to provide email services.

When you enter an independently operated 3D world, information described in Section 1 is also provided to that world's owner and server.

We may disclose information where required by law, including in response to a valid legal order.

3D User uses an essential session cookie to keep you signed in.

We do not use third-party advertising or tracking cookies.

Different information is retained for different periods depending on why it exists:

• Account and profile information — while your account remains active.
• World chat transcripts — 30 days.
• World entry and exit records — 30 days.
• World building and import/export history — 12 months.
• World visitor records and saved appearance — while that world exists.
• World settings, permission and moderation history — while that world exists.
• Private chess-game chat — until both players leave the match.
• Direct messages — until the relevant account is deleted.
• Support channel messages — indefinitely.
• Historical-character conversations and summaries — while your account remains active.
• Visitor-count hashes — 35 days.
• Support email — retained as part of our correspondence records.
• Payment records — for as long as required by applicable tax, accounting and consumer laws.
• Moderation records — may be retained after account deletion where required for moderation and accountability.

You can update your profile information through your account page.

You may request deletion of your account by contacting us.

Account deletion removes your:

• account and profile;
• profile photo;
• direct messages;
• friendships; and
• conversations with historical AI characters.

Any active subscription associated with the account will be cancelled as part of the deletion process.

Chess games you started are deleted when your account is deleted. If another person participated in the game, it will also disappear from their game history.

If you were the invited opponent in a game started by somebody else, the game may remain as part of that person's history, but your account will no longer be identified on it.

Public content such as forum threads, replies and news comments may remain after account deletion so conversations involving other users remain intact.

Such content will no longer be linked to an active account, although the display name and avatar recorded with the post at the time it was created may remain visible.

If you want identifying information removed from a particular public contribution, contact us and we will consider the request.

Account deletion does not automatically delete information held by independently operated world servers. See Section 1 for details.

3D User is not intended for anyone under 16 years of age.

If we become aware that we have collected personal information from a person under 16, we will delete it.

We use reasonable technical and organisational measures to protect information held by 3D User.

Passwords are not stored in plain text, payment-card information is handled by Stripe rather than stored by us, and we limit the information provided to independently operated world servers.

No internet service can guarantee absolute security.

We may update this Privacy Policy when our services or privacy practices change.

When we make a meaningful change, we will update this page and the "Last updated" date.

If you have questions about this Privacy Policy, your information, or an account-deletion request, contact:

support@3duser.org