Legal
Privacy & Data Policy
Last updated 29 September 2026
1. Summary
Sheen does not store photos or videos of you. Camera footage is processed on your phone and never uploaded.
- Never leaves your phone: camera video and frames used to capture or perform moves.
- We keep: your email and your account and game data. Pose data from your moves is scored the moment it arrives and then discarded (section 2).
- Sent to a third-party AI provider: your sigil drawings, for scoring only, plus the text you write in the game (section 3).
This policy is issued by Mealtune Sdn. Bhd., the data controller. Contact: hello@sheen.world.
2. Camera and motion data
When you record or perform a move, your phone's camera feed is analysed on your device. The video and individual frames are never uploaded to our servers, never stored by us, and never sent to any AI provider.
On your device, the app converts each capture into pose coordinates: a set of numbers marking the positions of body points (such as shoulders, elbows, hips, knees) over about 3 seconds. Only these coordinates are sent to our server. They contain no image, face or background.
Every skill and challenge move is authored in advance, with a reference standard recorded by our team. Your pose coordinates are compared against that reference at the moment you perform. The only thing we keep is the resulting score. The coordinates are then discarded. We do not build or store a profile of how you move.
We do not use pose data to identify you. We do not sell it or share it with AI providers.
In some jurisdictions, body-movement data may count as biometric or sensitive data even when it is processed only briefly. Where the law requires consent, we ask for it before your first capture. You can withdraw consent at any time by not using physical skills and challenges, or by deleting your account.
3. Sigil drawings and third-party AI
To learn or cast a spell, you upload a hand-drawn sigil. We send that image to our AI provider, which scores how closely it matches the spell's reference sigil. We do not keep the image after scoring; we keep only the resulting score.
Upload only the drawing. Do not include faces, people, photographs, your surroundings, handwriting with personal details, or any other personal information in the image. Crop or frame the upload so that only the sigil is visible. Uploads that appear to contain a person or a real photograph may be rejected.
The same provider also processes text you write in the game (character name and bio, actions, dialogue with characters, answers to in-game questions) to narrate the story and judge answers. Do not type personal or sensitive information into these fields.
4. What we store and why
| Data | Purpose | Kept |
|---|---|---|
| Email address, hashed password | Account login, security and service messages | Until you delete your account |
| Character data (name, bio) | Playing the game and narration | Until you delete your account |
| Pose coordinates | Scoring a move against the authored reference | Not stored; discarded after scoring |
| Move and sigil scores | Resolving the action in play | Until you delete your account |
| Game progress, party membership, in-game text, badges | Running quests, co-op play, saving progress | Until you delete your account |
| Technical logs (IP, device, errors) | Security and debugging | 180 days |
We do not store camera video, frames or sigil images. We do not sell personal data or use it for advertising.
5. Sharing, rights and security
Who receives data. Our AI provider (section 3), our hosting and infrastructure providers, and, only where legally required, authorities. Players in your party see your character, and a fact you gather is visible to you and your Team Lead. All processors act under contracts limiting use to providing Sheen. Where data is transferred outside Malaysia, we use the safeguards required by the PDPA.
Legal bases (under the PDPA, GDPR or similar laws). Contract, to run your account and the game; consent, for pose data where required; legitimate interests, for security and debugging.
Your rights. You can access, correct, export or delete your data, withdraw consent, and object to processing. Deleting your account removes your personal data within 30 days, except where we must keep it by law. Write to hello@sheen.world. You may also complain to your local data protection authority.
Security. Data is encrypted in transit and passwords are hashed. No system is fully secure; we will notify you and regulators of a breach as the law requires.
Children. Sheen is not intended for children under 13. We do not knowingly collect their data without verified parental consent and delete it when we learn of it.
Changes. We will notify you in the app or by email before material changes take effect.