Privacy Policy
Last updated: 11 October 2026
Terms of UseRefund & purchases policy
- Who is responsible
- What we collect and why
- Legal bases
- Cookies and browser storage
- Who we share data with
- Where data is processed
- How long we keep data
- Your rights
- Children
- Security
- Changes
- Contact
1. Who is responsible
Bistro City (also known as Nhà Hàng Vui Nhộn) is operated by Hayden, an individual, who is responsible for how your personal data is used on this site, bistrocitygame.com, and in the game at play.bistrocitygame.com. Contact: [email protected].
In short: we collect only what is needed to run your account and the game. We show no advertising, use no analytics or tracking tools, do not sell your data and offer no login through social networks.
2. What we collect and why
| Data | What | Why |
|---|---|---|
| Account | Your email address, user name, optional display name, the language you signed up in, and a few dates (account created, email confirmed, password changed, last login). Your password is kept in a protected form that cannot be read back. | To create your account, log you in and keep it secure. |
| Codes and links we email | The short-lived codes and links we send you to confirm your email, reset your password or change your email address, kept in the same protected form, with their expiry time and the number of wrong tries. | To check that the email address is yours. |
| Login session | When you log in: your IP address, the type of browser and device, and when the session started and was last used. | To keep you logged in, show your active session on the account page, and spot misuse. |
| Abuse protection | Short-lived counts, by IP address, login name or email address, of things like failed logins. They are not saved to the database. | To prevent abuse such as password guessing and spam. |
| Game data | Your restaurant and its name, layout, items, ingredients, garden and staff; your level, coins and Sprouts; mail, gifts and messages you exchange with other players; your visits to and ratings of other restaurants; a history of game events; images saved by the game; and activity figures such as first and last visit, number of logins and time played. | To run the game, save your progress and show your restaurant to other players. |
| Friends | Friend requests (who asked whom, when, how, and the answer), your friends list and your personal invite link. | To let you add friends and play with them. |
| Purchases | Order references from us and from PayNow, the pack, price, currency, status and dates, and a record of every change to your Sprouts balance. We never receive your card number, bank details or billing address. | To deliver what you bought, show your purchase history, handle refunds and disputes, and prevent fraud. |
| Fair-play checks | Regular copies of your game state, figures about each save, the results of automatic checks for impossible progress, and a note of any action taken on the account. | To detect cheating and bug abuse, and to restore a restaurant if something goes wrong. |
| Support email | Your email address and what you write to us. | To answer you. |
| Technical logs | A short list of the server's most recent requests (time, page requested, result and your user name), without their content. Our hosting and network providers keep their own technical logs, which include IP addresses. | To find and fix errors and protect the service. |
We do not ask for your real name, date of birth, phone number, home address or location. Please do not put personal details in names or messages.
3. Legal bases (for readers in the EU and the UK)
- Contract: running your account and the game, saving your progress, friends, and delivering purchases.
- Legitimate interests: keeping the service secure, preventing abuse, detecting cheating and payment fraud, fixing errors and answering support requests.
- Legal obligation: keeping purchase records where the law requires it, and answering lawful requests from authorities.
- Consent: only where the law asks for it; you can withdraw it at any time.
4. Cookies and browser storage
We use one strictly necessary cookie to keep you logged in, and our hosting and security provider may set a strictly necessary security cookie. We also store a few small items in your browser (local storage) to remember the language you chose, your sound and graphics settings in the game, a pending friend invitation, whether the game has already been loaded once, and a few similar notes the pages need in order to work (for example that you are logged in, or the email address still waiting for its code). None of this is used for advertising or tracking, and there are no analytics or advertising cookies.
Clearing your browser data removes them; you will be logged out.
5. Who we share data with
We do not sell personal data and do not share it for advertising. We use these service providers, each only for the job described:
| Provider | What they receive | Why |
|---|---|---|
| Resend | Your email address and the content of the message (confirmation code, reset or email-change link). Our emails contain no tracking images or tracking links. | Sends our account emails from mail.bistrocitygame.com. |
| PayNow (paynow.gg) | From us: your user name (as the customer name), our internal account identifier and our purchase reference. From you, directly on PayNow's payment page: your payment details and whatever else PayNow asks for. PayNow sends us the order result (identifiers, pack, amount, currency, status), never your card data. | PayNow sells to you as merchant of record: it takes the payment and handles tax, receipts, refunds and disputes. It handles your payment data under its own Privacy Policy. |
| Cloudflare | All traffic between your browser and us passes through Cloudflare, including your IP address. Emails sent to our support address are forwarded by Cloudflare Email Routing to the operator's Gmail mailbox. | Domain names, content delivery, protection against attacks, and email routing. |
| Google (Gmail) | The emails you send to [email protected] and our replies. They are stored in the operator's Gmail mailbox. | The mailbox we read and answer support email in. |
| Vultr | Hosts the server and database that hold everything in section 2, and makes automatic backups of it. | Server hosting, in Singapore. |
Other players see what the game shows them: your user name, display name, restaurant and its name, level, and what you send them. We may also disclose data when the law requires it, or to protect players or the service against fraud and abuse. If the game is ever handed over to a new operator, your data would move with it under this policy, and we would tell you first.
6. Where data is processed
Our server and database are in Singapore. The providers listed above also process data in other countries, including the United States, under their standard data-processing terms. This means your data is handled outside your own country, where the level of legal protection may differ.
7. How long we keep data
- Account, game and friends data: for as long as the account exists. An account whose email address has not been confirmed may be deleted 30 days after sign-up. Accounts that have not been used for a long time are not deleted automatically at present.
- Codes and links we email: they expire within 15 minutes to 24 hours, and their records are deleted about a week later.
- Login sessions: until you log out, log in somewhere else or change your password, or until they expire (after 30 days at most).
- Fair-play copies of your game state: 90 days, unless one is linked to an action taken on an account. The other fair-play records are kept while the account exists.
- Purchase records and Sprouts history: kept after an account is closed, for the period required by tax and accounting law, and used for refunds, disputes and fraud prevention.
- Support emails: up to 2 years.
- Backups: the hosting provider's automatic backups are overwritten on a rolling basis; deleted data stays in a backup until that backup is overwritten.
Deleting your account. The account page cannot delete an account by itself yet. Write to [email protected] from the account's email address and we will do it within 30 days. We delete the account, your profile and your game data. We keep purchase and payment records, and the Sprouts history tied to them, for the period required by law, and security logs for a short period.
8. Your rights
Wherever you live, you can ask us to:
- tell you what data we hold about you and give you a copy;
- correct data that is wrong (you can change your display name, email address and password yourself on the account page);
- delete your account and data, or stop or limit a particular use of it;
- object to a use that we base on our legitimate interests;
- give you your data in a common electronic format;
- withdraw a consent you gave.
Write to [email protected] from your account's email address so that we know the request is yours. It costs nothing, and we answer within 30 days. Some data we may have to keep, for example purchase records; we will tell you when that is the case.
If you think we have handled your data wrongly, you can also complain to the data-protection authority where you live. We would be glad to hear from you first.
9. Children
The service is not meant for children under 13, and they may not create an account. Where the law of your country sets a higher age for agreeing to the use of personal data (up to 16 in some countries), a child below that age needs the consent of a parent or guardian. We do not ask for your age at sign-up. If you are a parent or guardian and believe your child has given us personal data, write to us and we will delete the account.
10. Security
- Your password is stored in a protected form that cannot be read back: we never see or store your actual password. Verification and reset codes are stored the same way, and they expire.
- All connections are encrypted (HTTPS).
- Our server is behind a firewall and can only be reached through our security provider.
- Repeated wrong passwords and codes are blocked for a while, and a new login ends the earlier session.
- Only the operator has administrative access, and can view and correct account and game data for support and moderation.
No system is perfectly secure. If a breach affects your data, we will tell you and the authorities as the law requires. Please use a password you do not use anywhere else.
11. Changes to this policy
When the game or the way we use data changes, we will update this page and its date. If a change is material, we will announce it at least 14 days before it takes effect, on the site or by email to your account's address. Changes that the law requires or that are needed for security may take effect sooner.
12. Contact
Hayden
[email protected]