Vila

Privacy Policy

Last updated October 28, 2026

Vila is a pixel-art virtual office: the team walks around a map, sits at their desks and talks by voice with whoever is nearby. This page explains what data Vila uses, why, who can see it, and how to ask us to access, correct or delete it. The Portuguese version is the reference text.

1. Who is responsible

Vila is developed and operated by Marcos Junior, the controller of the personal data processed by the service under Brazil's General Data Protection Law (Lei nº 13.709/2018, "LGPD"). For anything about this policy, email contato@getvila.app.

This policy covers Vila on the web, the Vila app for Mac and this website (getvila.app).

2. What data Vila uses

Account

• Name and email address, to create your account and show your team who you are.
• Your Google account identifier and its domain (for example, your company's domain), when you sign in with Google. The domain is used to check whether you may join the organization.
• Password, only if you join through an invite with a password. We store only a hashed version, never the password itself.
• Your role in the organization (member or administrator) and your team.

What you do and show in Vila

• Profile: your character's look, your status (emoji and text), your birthday day and month if you choose to add it, and your preferences.
• Desk: the desk assigned to you, the items you decorated it with, and the notes left on it (text, author and time), with their reactions and replies.
• Presence: where your character is on the map, whether you are available, focused or in a meeting, and when you were last online. Your map position is used in real time and is not stored as a history.
• Farm game: what you plant, harvest, buy and sell in the game, and your coins.
• Sessions: a hashed access key and the browser or app you signed in from, to keep you signed in.

Voice, video, screen and chat

• Voice, video and shared screens are relayed in real time by the media server we operate, only to people near you or in the same room. We do not record calls, video or screens.
• Chat messages in rooms and in the auditorium are kept only in the server's memory, so people who join can see the latest messages. They are not saved to the database and disappear when the room closes.

Integrations (optional)

• GitHub and Linear: when your organization's administrator enables an integration and you connect your account, Vila receives your username on that tool and a few work events: a merged pull request, a review, a completed issue, CI going back to green, with their title and link. These events become rewards in the farm game. To sync, we store the integration's access token.
• Spotify (Mac app): off by default. If you turn it on in Settings, the app reads, on your own Mac, the song playing in Spotify and shows the track and artist name to your team while it plays. Vila does not access your Spotify account and never asks you to sign in to it.

Mac app

The Mac app checks for updates in Vila's public installer repository on GitHub. It does not send usage or crash reports.

3. Sign in with Google

When you choose to sign in with Google, Vila requests only the openid, email and profile scopes. With them we receive your name, your email address, whether it is verified, your Google account identifier and your account's domain, if any.

• We use this data only to sign you in, create your account with your name and email, and check that you belong to the organization you are trying to access.
• Vila does not access your Gmail, Google Drive, Calendar, contacts or any other data in your Google account, and does not store your Google profile photo.
• We do not sell Google user data, do not use it for advertising, and do not transfer it to third parties except as needed to run the service or as required by law.

You can remove Vila's access to your Google account at any time at myaccount.google.com/permissions.

4. How we use it

• To run Vila: sign you in, show you on the map, connect your voice with people nearby, and keep your desk and your game. Legal basis: performance of the service you or your organization signed up for (LGPD art. 7, V).
• For integrations and Spotify, which you or your administrator choose to enable. Legal basis: your consent, which you can withdraw at any time by turning the integration off (art. 7, I).
• To keep the service secure and stable: prevent abuse, investigate failures and make backups. Legal basis: our legitimate interest (art. 7, IX).

We do not use your data for advertising, do not sell personal data and do not build marketing profiles.

5. Who sees what

Vila is your organization's workspace. People in the same organization see your name, your character, your status, where you are on the map, the music you chose to show and the notes left on your desk. People nearby hear your voice while your microphone is on. Organization administrators manage invites, teams and integrations, and can remove accounts.

6. Who we share it with

• Infrastructure providers that host Vila's servers and database, only to operate the service. Servers may be located outside Brazil; in that case the transfer follows the LGPD rules for international transfers.
• GitHub and Linear, only when the integration is on, to bring in work events.
• Authorities, when required by law.

Other than that, we do not share your personal data with anyone.

7. How long we keep it

• Account and profile: as long as your account exists. When an administrator removes your account, it leaves Vila; if you ask, we also permanently delete its data.
• Titles of GitHub and Linear events: 30 days.
• Sessions: expire 30 days after last use, or when you sign out.
• Chat: not stored in the database.
• Backups: one per day, kept for 14 days and then deleted.

8. Security

All communication with Vila is encrypted (HTTPS and secure connections for voice and video). Passwords and session keys are stored hashed, server access is restricted and backups are protected. No system is perfect; if an incident may put you at risk, we will notify you and Brazil's National Data Protection Authority (ANPD), as the law requires.

9. Cookies

Vila uses only the cookie needed to keep you signed in. We do not use advertising or analytics cookies. This website (getvila.app) uses no cookies or analytics tools; it is hosted on GitHub Pages, which may log technical access data such as IP addresses to operate and protect its service.

10. Your rights

Under the LGPD you may ask at any time for:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary data or data processed unlawfully;
• portability of your data;
• deletion of data processed with your consent, and information about who it was shared with;
• withdrawal of consent, for example by turning off Spotify or an integration.

To make a request, email contato@getvila.app. We answer within 15 days. If your access to Vila comes from your company, you can also talk to your organization's administrator. If you feel we did not resolve it, you can file a complaint with the ANPD.

Vila is meant for professional use and is not intended for anyone under 18.

11. Changes to this policy

If this policy changes, the date at the top of the page changes too. If the change is significant, we will let you know before it takes effect.

12. Contact

Marcos Junior, responsible for Vila: contato@getvila.app.