Privacy Policy — Vista Vibes Lounge App

Last updated: September 28, 2026

Vista Vibes Lounge ("we") is a rooftop lounge located at BRAIRA Hotel, Dammam, Saudi Arabia. This policy explains how our mobile and web app handles your data.

Data we collect

• Account data (entered by you): first and family name, email address, phone number, and date of birth (to verify you are 18 or older).
• Reservation data: table booking details (date, time, table, party size, occasion, pre-orders, notes).
• Loyalty points: your points balance and redemptions.
• Reviews: the rating and comment you write, with your first name.
• The Estimation game (if you play): your game profile, the games you played and your results, as described in the game section below.
• Technical device identifier: an anonymous in-app identifier that links your account to your device and protects your data.
• Notification token: if you allow notifications, we store your device's push token (Firebase Cloud Messaging) to tell you your booking's status. You can turn notifications off in your device settings at any time.
• Usage statistics: anonymous in-app events (for example: sign-up completed, booking sent) through Google Analytics for Firebase, so we can see where guests get stuck. They never include your name, number or email.
• Crash reports: when the app crashes, technical data (device model, OS and app version, the error trace) is sent through Firebase Crashlytics so we can fix it.

What we do NOT collect

• We do not collect your location.
• We do not access your contacts, photos, camera or microphone.
• We show no ads and use no advertising trackers.
• We never sell your data or share it with third parties for marketing.

How we use your data

• Managing your account, confirming your reservations and telling you their status (by text message, by notification if you allow it, and in the app).
• Verifying your phone number with a code sent by text message.
• Emailing you sign-in codes and the email confirmation link.
• Calculating loyalty points and rewards.
• Running the Estimation game: seating you at tables, dealing the cards, scoring, the monthly leaderboard and the winner's points, and handling reports of abuse.
• Ensuring app users are adults (18+).
• Improving the app and fixing crashes (anonymous statistics and crash reports).

The Estimation game

Estimation is a card game in the app. Playing with other people is for the lounge's registered guests with a verified phone number; practice against the computer is open to anyone with the app, even without an account. Nothing is sold in it (no coins, no purchases), and there is no free-text chat: messages and reactions are preset phrases and pictures only.

• Your game profile: a nickname you pick from a preset list, with a number; a preset picture and frame; your settings (showing your first name, appearing on the leaderboard); and your acceptance of the fair-play rules.
• Your first name: shown to the other players at a private table (one joined with a code), as long as "Show my first name at private tables" is on (it is on by default and you can turn it off). In quick match and on the leaderboard only your nickname is shown.
• Game data: the games you took part in, the cards dealt to you, your moves and scores, each round's log (to verify results and settle reports), and your stars and wins.
• The monthly leaderboard: every app user can see the top 20 players (nickname, picture, stars, wins and games). You can hide yourself from it.
• Practice as a guest (no account): if you practice against the computer without an account, we keep a record tied only to your device's anonymous identifier: a nickname and number drawn at random from a preset list, the picture and frame you pick, and your practice games (the cards, moves and scores). The record holds no name, email or phone number, never appears on the leaderboard and earns no points. It is deleted automatically 30 days after you last used it (opening the game, changing the picture or starting a practice game); practice games are deleted like every game, 30 days after they end.
• Connection status: while you play, the app sends a signal every few seconds so the server knows you are still connected.
• Blocks and reports: the players you blocked, and the reports you send or that are sent about you (the reason, the game and the round, and your first name if the table could see it when you were reported). A report reaches the lounge's moderator by email with the nicknames, and that first name if it was shown, never an email address or phone number; it is reviewed within 24 hours, and a player who breaks the rules can be banned from the game.
• A ban after account deletion: if a player who is banned from the game deletes the account, we keep a code derived from their verified phone number with a keyed one-way hash (the number cannot be recovered from it), with only the ban's end date, so that the ban cannot be escaped by signing up again with the same number. No name, email or phone number is stored with it, and it is deleted automatically when the ban ends; a permanent ban is kept for as long as it lasts.
• The winner's points: added to your loyalty card and recorded in the points ledger like every other points transaction.

How long game data is kept: tables that never started, 3 hours; games, their cards and round logs, 30 days after the game ends (or after it started, if it was never finished); connection status, about 24 hours; leaderboard rows, about 12 months after the month ends; reports, 180 days; daily game limits, 3 days; your game profile, until you delete your account; a guest's practice record, 30 days after its last use; the phone code of a banned player who deleted the account, until the ban ends. Automatic deletion can run up to about a day after these periods. Game data is never used for advertising or to track you.

Who processes your data for us

• Google Firebase: data storage (Firestore) and the app's servers in the Dammam region (me-central2). Google Firebase also delivers notifications and handles anonymous usage statistics and crash reports, which are processed on Google's global servers.
• Msegat: our text-message provider in Saudi Arabia, which sends verification codes and booking-status messages to your number.
• Resend (United States): our email delivery provider. It sends your sign-in codes and email confirmation links to your address, and it also delivers each new booking alert and each guest-cancellation alert (your name, phone number and booking details) to our reservations desk's mailbox, and Estimation game reports to our moderator's mailbox (the nicknames and the reason, and the reported player's first name if the table could see it; never an email address or phone number). Resend is a US company, so these emails are processed outside Saudi Arabia, in the United States.

Where data is stored

Data is stored securely in Google Firebase (Firestore) in the Dammam region, with strict access rules: no user can read another user's data, and administrative access is limited to lounge management.

Transfers outside Saudi Arabia: some data leaves the Kingdom: emails through Resend in the United States, and anonymous usage statistics, crash reports and notification tokens through Google (Firebase) and Apple, on servers that may be outside Saudi Arabia. We pass Resend only what the email itself needs (the address and the message, and for booking alerts your name, number and booking details), and it uses them only to deliver the email. Your account, bookings and points stay stored in the Dammam region.

How long we keep it

• Account data and loyalty points: for as long as your account exists.
• Verification codes and email confirmation links: deleted automatically within a few days of being sent.
• Website booking session: if you book on vistavibes.net with your app account, we keep a sign-in session for that browser (your phone number, email and your account's device identifier) for 30 days from when it opens or until you sign out; it is then deleted automatically, and at once when you delete your account.
• Booking history: kept as the lounge's operating record; when you delete your account we remove your name, number, email and notes from it.
• Usage statistics and crash reports: for the default retention periods of Google Analytics and Firebase Crashlytics.
• Estimation game data: as described in the game section.

Deleting your account

In the app: Profile → Delete Account. We then delete your account data, loyalty card, reviews, undecided redemption requests, verification codes and website booking sessions, cancel your upcoming bookings, and remove your name, number and email from your past bookings and completed redemptions. We also delete your Estimation game data: your game profile, your leaderboard rows, your connection status, and the guest practice records and practice games of your devices. Your name is removed from finished games; in a game still in play the computer takes over your seat as "Deleted player"; and reports keep only their reason, with nothing that identifies you. If you are banned from the game when you delete your account, the code of your number is kept until the ban ends, as described in the game section. You can also ask us through the account deletion page.

Your rights

You may request access to, correction of, or permanent deletion of your account data at any time by contacting us below. We will respond within a reasonable period.

Children

The app is intended for adults aged 18 and above. We do not knowingly collect data from anyone younger.

Contact

Email: wecare@vistavibes.net
Phone: +966 55 184 9990
Address: BRAIRA Hotel, Prince Muhammad Ibn Fahad Rd, Dammam, Saudi Arabia