Privacy Policy – Buildaster VR

1. Data controller

The controller of data directly related to the game and website is Kacper Chwaszcz, NIP 7272902424, hereinafter referred to as the “Operator”.

Privacy and rights requests: privacy@builder-vr.com. General contact: contact@builder-vr.com.

2. Scope and roles

The Operator is responsible for data whose purposes and methods of processing are determined in connection with the game and website. Meta Platforms Technologies and the identified service providers may act as separate controllers or processors under their own terms.

The game does not create a Buildaster account with a separate login or password and does not use the friends list, messaging, microphone, advertising ID or Meta password. Using Community creates an internal passwordless player record linked to a pseudonym of the Meta identifier.

3. Data processed by the game

Gameplay and settings data: selected language, mode, difficulty, session settings, seed and blueprint code, virtual item placement, score, budget, time and progress. This data operates the current session; the language selection is saved locally on the device.

VR tracking data: the current position and orientation of the headset and controllers are processed in device memory to enable controls and interaction. The current version uses controller mode and does not store raw tracking-camera images or a map of the physical environment.

Local files: the game can save a generated plan image and a building-preview screenshot to the device. These files are not automatically sent to the Operator and remain in the application space until the user deletes the data or uninstalls the game.

4. Co-op website data

Plan code: an entered code is compared with a public static list of plans. A plan code placed in a URL may appear in browser history, cache and technical request logs, but the Operator does not assign it to an account or name.

Local storage: the site saves the preferred language and one cached plan preview in the browser. The Operator does not use its own advertising cookies, marketing profiling or cross-site tracking.

Technical data: IP address, date and time, requested address, HTTP headers, browser or device type, approximate location derived from IP and error information may be processed automatically by Cloudflare and CDN infrastructure to deliver, protect and diagnose the service.

5. Meta Quest and platform data

The game uses Meta Horizon OS and Meta XR SDK. Meta may process account, device, activity, performance, crash and core SDK technical data under Meta’s Privacy Policy and platform policies. Meta may provide the Operator with aggregated store, installation, usage, performance or crash statistics.

The Operator does not receive a Meta account password or raw images from tracking cameras. Data collected independently by Meta should be deleted or corrected through Meta account settings and Meta support channels.

5A. Meta Horizon USER_ID and account verification

Buildaster requests the Meta Horizon Platform feature USER_ID for optional authenticated Community features. When Community is opened, the game obtains the numeric Meta Horizon User ID and a Meta User Proof from the Meta Platform SDK and sends both over HTTPS to the Buildaster backend solely to verify that the request belongs to the current Meta user.

The raw Meta Horizon User ID and Meta User Proof are not stored in Buildaster databases or object storage and are not written to application logs. After verification, the backend derives a pseudonymous HMAC-SHA-256 identifier and creates a separate random internal player UUID, allowing Buildaster to recognize the same Community user without retaining the raw Meta User ID.

The internal player UUID associates Community publications and ownership, likes and reports, publication limits and capacity operations, event actions and reward claims, Community points and anti-abuse or rate-limit state. This processing is used only to provide, secure and moderate Community, maintain content ownership, prevent duplicate operations and enforce service limits.

Buildaster does not request USER_PROFILE for this authentication flow. Community does not require or store the Meta display name, Meta avatar, friends list, email address, Meta password or advertising identifier. Public Community publications are anonymous.

After verification, the game receives a signed Community session token valid for about 15 minutes. It contains only the internal player UUID and expiration time and is used to authorize Community requests.

5B. Community UGC, stored data and moderation

Community stores data needed for the feature under the internal player UUID: publication records and ownership, publication status and dates, likes and reports, publication-capacity operations, event actions and reward claims, Community points and short-term anti-abuse or rate-limit state. The Operator does not sell this data or use it for advertising.

Publications are anonymous. The original work and its thumbnail are stored in private Cloudflare object storage. They may be read by their owner, an authorized moderator or, after approval and while public, users of the Community gallery.

Community databases and publication storage are configured for the EU jurisdiction where supported. Cloudflare and Meta operate global infrastructure, so technical processing may also occur outside the EEA.

An author can hide or permanently delete an individual Community publication in the game. Permanent deletion removes the publication record, original and thumbnail files, and dependent publication likes and reports.

Account-linked Community data is retained only as long as needed to provide and secure the feature, process moderation and reports, prevent abuse or duplicate operations, and comply with legal obligations. Automated retention rules remove older rejected content, event data and audit records according to configured retention periods.

6. Purposes and legal bases

Performance of a contract or user-requested service: launching the game, enabling VR controls, generating plans, scoring, saving settings, displaying Co-op plans and providing Community features (Article 6(1)(b) GDPR).

Legitimate interests and legal obligations: security, abuse prevention, diagnostics, protection of legal claims and service maintenance (Article 6(1)(f) GDPR), and compliance with legal obligations (Article 6(1)(c) GDPR). Where a feature requires consent, the basis is Article 6(1)(a) GDPR and consent may be withdrawn without affecting earlier lawful processing.

7. Recipients and service providers

Technical data may be received by Cloudflare for hosting, storage, security and delivery; jsDelivr and its infrastructure operators for delivery of 3D viewer libraries; and Meta for the device platform, store, SDK and account confirmation.

Data may also be disclosed to authorized authorities, advisers or technical providers where required by law or necessary to protect the service and legal claims. The Operator does not sell personal data or provide it to advertisers.

8. Transfers outside the EEA

The Operator aims to keep Community data stored and processed mainly in the European Union, and Community databases and files are configured for the EU region. Cloudflare and Meta provide global services, so some technical data or operations may also be processed in the United States or other countries outside the EEA.

See the Cloudflare Privacy Policy and Meta Privacy Policy. Where required by law, transfers outside the EEA use appropriate legal safeguards.

9. Retention

Locally saved data and files remain on the device until the user deletes them, clears application data or uninstalls the game. The site language preference remains in local storage until site data is cleared. A plan code may remain in browser history until the history is cleared.

The Operator does not create a database of plan codes entered by users. Community data is retained under the criteria described above. Technical and security logs are kept for the period configured with the provider, or longer only where needed to investigate an incident, comply with law or defend claims.

10. User rights

Within the limits provided by law, a user may request access, rectification, deletion, restriction and portability of data, object to processing based on legitimate interests and withdraw consent.

Requests may be sent to privacy@builder-vr.com. A user may also complain to the President of the Polish Personal Data Protection Office or the competent supervisory authority in the country of residence, work or alleged infringement.

11. Data deletion

A user can permanently delete an individual Community publication from the Community interface. The Workshop/Community interface also provides an account-level deletion request for the authenticated Community account. The request requires explicit confirmation and produces a request code so deletion can be completed for the correct internal player record.

When an account deletion request is completed, Buildaster deletes stored publication originals and thumbnails and then removes the internal player record and account-linked Community data, including publication records, likes, reports made by the user, rewards and points, event votes and claims, publication-capacity records and anti-abuse state associated with that internal player UUID.

After completion, the request is detached from the deleted player identifier. Buildaster may retain only a minimal non-user-linked deletion receipt and security or audit record for the configured audit-retention period, currently up to 365 days, or longer only where required by law, a security investigation or defense of legal claims.

Any user may also request account-level deletion free of charge by emailing privacy@builder-vr.com with the subject “Buildaster VR Data Deletion Request”. We may ask for reasonable verification that the requester controls the relevant Buildaster or Meta account. Never send a Meta password.

Local game data can be removed by clearing Buildaster application data or uninstalling the application. Meta account information and other platform data controlled independently by Meta must be deleted through Meta account settings or support channels.

12. Children and minors

Buildaster VR is not designed to knowingly collect personally identifiable information from children. Use by minors should follow the game’s age rating, Meta account type and parental-supervision settings.

A parent or guardian who believes that the Operator received a child’s information unlawfully may contact privacy@builder-vr.com. The game does not use profiling or automated decision-making that has legal consequences for a user.

13. Security

The Operator uses proportionate safeguards including encrypted connections, pseudonymized identifiers, short-lived sessions, access controls, content-owner checks and moderation before publication.

No transmission or storage method can be guaranteed completely secure. Suspected breaches or vulnerabilities may be reported to privacy@builder-vr.com without sending passwords, access keys or unnecessary data.

14. Changes and contact

This policy may be updated as features, providers, laws or Meta requirements change. The current version will remain public at the same address with its update date, and prior versions effective while platform features were used will be archived.

Privacy questions: privacy@builder-vr.com.