InVR — Privacy Policy & Terms

This policy explains what personal data we process when you play InVR or visit invr.be, why we process it, and the rights you have under the EU General Data Protection Regulation (GDPR / RGPD).

Who is responsible

InVR ("InVR", "we", "us") is a virtual-reality game currently operated by a private individual based in Belgium. No company has been incorporated yet, so for all data-protection matters the controller can be reached at [email protected]. For anything else, use [email protected].

What we collect

Account data

When you first launch InVR the game creates an account for you automatically. We do not ask for your name, email address or a password. We store: a randomly-generated account identifier, a randomly-generated login token (which lives on your device so you stay signed in), the username you choose (a default like "sphere-1234" is assigned otherwise), your chosen avatar colour, your comfort settings (stick-turn mode and speed), your in-game token balance, and the date your account was created. If you request an account migration, we also store a temporary migration token linked to your account, which expires after 7 days or once it has been used.

Gameplay data

The cosmetics you own and have equipped, your friend relationships (friend requests and accepted friends), and your in-game currency transactions (tokens earned and cosmetics bought).

Session & technical data

Each time you connect we record: connection and disconnection timestamps, session length, the device type your client reports (e.g. "Quest 2", "Mac"), the distribution channel (e.g. "web", "meta-store"), your country (derived at the network layer through Cloudflare — we do not store your IP address), which of our game servers you were connected to, and how the session ended (you left, an error occurred, or you were removed by a moderator).

Moderation & safety data

If you report or mute another player we log who reported/muted whom, the reason and the time. Username changes and bans (with their reason) are also logged so we can keep the game safe and fair.

Voice chat

InVR has live voice chat. Your microphone audio is compressed and relayed in real time to the other players in your lobby. We do not record or store voice audio.

Technical diagnostics

While you play, the game reports transient technical health data — frame rate, frame timing, network latency, packet-delivery and voice-transmission statistics (never voice content), and on headsets the device's thermal state and battery level — so we can tell server problems apart from device or connection problems. This data lives only in server memory for a few hours and is never stored or shared.

Gameplay session recording (bug replay)

To reproduce and fix gameplay bugs, the game server can keep a rolling recording of the current session: your headset and controller movement, button presses, and your avatar's in-world position, together with your username and avatar appearance. This recording only runs while a developer is actively investigating that game server — nothing is captured the rest of the time. While it runs, only roughly the last 10 to 30 minutes exist at any time — older data is continuously overwritten — and the buffer of a player who leaves is discarded within minutes. It contains no voice audio, no chat, and nothing from outside the game. A developer may export this buffer to investigate a bug; exported recordings are used only for debugging, are not shared with anyone else, and are deleted when the investigation is done.

What we do not collect

No email address, real name, password or payment information.
No stored IP addresses — only a country code.
No server-side logging of your head/hand movement or position.
No text-chat logs (there is no text chat), and no advertising or cross-site tracking.

Why we process it

To provide the game — running your account, saving your progress, matchmaking, voice chat and friends. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
To keep the game safe and fair — moderation, reports, bans and anti-abuse. Legal basis: our legitimate interests (Art. 6(1)(f) GDPR).
To understand and improve the game through aggregate statistics. Legal basis: our legitimate interests (Art. 6(1)(f) GDPR).

Analytics

We use only our own, self-hosted statistics. We do not use Google Analytics or any third-party advertising or tracking service. The player-activity charts on invr.be show aggregate figures (players online, daily active players, and similar) and never identify an individual player.

Cookies & local storage

The website invr.be does not set any cookies, and the fonts it uses are served from our own servers rather than a third-party font CDN. It uses only temporary session storage for technical purposes (such as retrying a failed load). The game stores your login credentials locally on your device or headset so you stay signed in; that data stays on your device and is only sent to our servers to authenticate you.

Who your data is shared with

Other players — your username, avatar colour, equipped cosmetics, live voice and in-game presence are visible to players you play with. All gameplay and voice traffic is relayed through our game server, so other players never connect to you directly and cannot see your IP address — they only ever receive a temporary, randomly generated identifier that changes every time you join a server, never your account identifier. Players you are friends with (or who have a pending friend request with you) additionally see your stable friend-list identifier, online status and, while you play, which lobby you are in.
Sentry — we use Sentry to capture technical errors and crashes in the web client so we can fix bugs; this may include technical error details. Sentry is configured to store our data in its EU region.
ForwardEmail — we email ourselves operational and moderation alerts (for example when a player is reported) through ForwardEmail, our transactional email provider; such an alert can include the usernames and the reason involved in a report.
Hetzner — our hosting provider; our game servers and database run on Hetzner infrastructure within the EU (see "Hosting & data location" below).
Cloudflare — sits in front of our servers as a network and CDN layer and provides the country code described above. Cloudflare processes limited connection metadata (mainly IP addresses) on its edge servers in the EU and the United States; see "Hosting & data location" below. Further information on how Cloudflare processes personal data is available at cloudflare.com/trust-hub/gdpr.
Meta & Discord — InVR is distributed through the Meta (Quest) store and we run a Discord community. If you use those, their own privacy policies apply; we have no account-linking integration with them.

We never sell your data. We only share it with the service providers listed above, or where the law requires it.

Hosting & data location

Game servers and player data are hosted within the EU on infrastructure provided by Hetzner Online GmbH (data centres in Germany and Finland), which is certified to ISO/IEC 27001:2022 for information security. Our error-tracking data (Sentry) is also stored in the EU. Cloudflare, our network and CDN layer, processes limited connection metadata (mainly IP addresses) in the EU and the United States; for any transfer to the United States it relies on the EU-U.S. Data Privacy Framework and the EU Standard Contractual Clauses as appropriate safeguards.

How long we keep it

Account and gameplay data is kept while your account exists. Session and activity logs are kept to operate and improve the game and for safety. You can ask us to delete your account and the personal data attached to it.

Your rights

Under the GDPR you have the right to access, rectify, erase ("right to be forgotten"), restrict and object to the processing of your data, and the right to data portability. Because accounts are anonymous, to exercise these rights you will need to give us your in-game account identifier so we can locate your data. Contact [email protected]. You also have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données, www.dataprotectionauthority.be).

Children

InVR is not intended for children under 13. We do not knowingly collect data from children under 13. If you believe a child under 13 has an account, contact [email protected] and we will remove it.

Changes

We may update this policy. The "last updated" date above will change and any material changes will be announced in the game or on our Discord.

These terms govern your use of the InVR game and the invr.be website. By playing or using them, you agree to these terms.

1. Acceptance

By playing InVR or using invr.be you agree to these Terms. If you do not agree, please do not use the game or the website.

2. Who we are

InVR is a virtual-reality game currently operated by a private individual based in Belgium. You can reach us at [email protected].

3. Eligibility & age

You must be at least 13 years old to play InVR. By playing, you confirm that you meet this requirement. InVR includes live voice chat with other players.

4. Your account

Accounts are created automatically and anonymously. You are responsible for the device that holds your login credentials — anyone with access to that device can use your account. If we issue you a migration token to move your account to another device, treat it like a password: it is one-time use, expires after 7 days, and anyone who redeems it gains full access to your account. Once it is redeemed the account moves to the new device and the original device is signed out — it will start a fresh account the next time it connects. InVR is in early access / beta: it may be unstable, change significantly, or have its data reset.

5. Acceptable behaviour

You agree not to:

harass, threaten or abuse other players;
use hate speech or discriminatory language;
cheat, exploit bugs, or use unauthorised third-party software;
impersonate other people or disrupt the service;
choose offensive usernames (a profanity filter applies).

We may mute, kick, suspend or permanently ban accounts that break these rules, with or without notice. Voice chat is live between players and is not moderated in real time — please treat others with respect.

6. Prohibited technical use

Beyond the conduct rules above, you also agree not to:

reverse-engineer, decompile or modify the game, except where the law expressly allows it;
use bots, scrapers or other automated means to access the game, website or our APIs;
collect or harvest other players' data from the service;
create multiple accounts to evade a ban, or sell, share or trade accounts;
introduce malware, or attempt to gain unauthorised access to, overload or disrupt our servers or infrastructure (including denial-of-service attacks).

7. Health & safety

InVR is a virtual-reality game. Please read this before playing. Stop and rest if you feel unwell, and consult a doctor if symptoms persist.

Seizures. A small number of people may experience seizures or blackouts triggered by flashing lights or patterns, even with no prior history. If you or anyone in your family has had such symptoms, consult a doctor before playing. Stop immediately if you experience convulsions, twitching, altered vision, disorientation or loss of awareness.
Motion sickness. VR may cause dizziness or nausea. If it does, stop playing and rest; do not drive or operate machinery until you feel better.
Strain. Take a 10–15 minute break every 30 minutes. Stop if your hands, eyes or body feel sore or tired.
Your surroundings. Play in a clear space free of furniture, walls and other people. Stay aware of your surroundings and keep the volume low enough to hear what is happening around you. Do not play when impaired by tiredness, alcohol, drugs or illness.

You use InVR at your own risk. To the extent permitted by law, we are not responsible for injury or damage resulting from ignoring these precautions.

8. Interacting with other players

InVR is multiplayer and includes live voice chat. We do not screen or vet other players, and we are not responsible for their conduct. You interact with other players at your own risk — take sensible precautions, do not share personal information, and be especially cautious if you ever arrange to meet someone offline. Use the in-game mute and report tools if someone behaves inappropriately.

9. Virtual currency & cosmetics

InVR includes a virtual in-game currency ("tokens") and cosmetic items. Tokens and cosmetics have no real-world monetary value, cannot be bought with or exchanged for real money, and cannot be transferred between accounts. (Moving your entire account to another device with a migration token is not a transfer between accounts — it stays the same account.) Some cosmetics are not for sale and cannot be bought with tokens — they are only granted by us at our discretion. We may adjust, reset or remove currency and cosmetics at any time, especially during early access.

10. User content

Any content you set, such as your username, must comply with these Terms. We may change or remove content that violates them.

11. Feedback

If you send us feedback, bug reports or suggestions (for example via Discord), you allow us to use them freely to improve InVR, without any obligation or payment to you. You do not have to send feedback, but if you do, please don't include confidential information.

12. Intellectual property

InVR, including its name, logo, game content and this website, belongs to the operator. You may not copy, redistribute or create derivative works from it without permission, except as allowed by law. InVR is built on third-party open-source software, which remains under its own licences.

13. Availability & no warranty

The game and website are provided "as is" and "as available". To the extent permitted by law, we make no warranties that they will be uninterrupted, error-free or secure, or that data will not be lost — particularly during early access. This does not affect statutory warranties that cannot be excluded under Belgian law.

14. Limitation of liability

To the maximum extent permitted by law, the operator is not liable for any indirect or consequential damages arising from your use of InVR. Nothing in these Terms limits liability for death or personal injury caused by our negligence, for fraud, or any other liability that cannot be limited under Belgian law, including your mandatory statutory consumer rights.

15. Termination

We may suspend or terminate your access at any time if you breach these Terms. You may stop using InVR at any time and request that your account be deleted (see the Privacy Policy).

16. Changes

We may update these Terms. Continued use of InVR after a change means you accept the updated Terms.

17. Governing law

These Terms are governed by Belgian law, and any disputes fall under the competent courts of Belgium — without prejudice to any mandatory consumer-protection rights you have in your country of residence.

18. Severability & waiver

If any part of these Terms is found invalid or unenforceable, the rest remain in force. If we do not enforce a right or provision, that is not a waiver of it.

19. Entire agreement

These Terms and the Privacy Policy are the entire agreement between you and the operator regarding InVR, and replace any earlier understandings on the subject.

20. Contact

General enquiries: [email protected]. Privacy and data matters: [email protected].

InVR is built with open-source software, and we're grateful to the people who make it.

Built with

The complete list of third-party components bundled in InVR, together with the full text of each licence, is generated directly from our dependency list.

View the full open-source licence notices →

Privacy & Terms