Privacy Policy

Last updated: November 5, 2026

This policy explains what Vicarious Virtual Ventures, a sole proprietorship ("VRAdvertisements", "we", "us") collects, why, and what you can do about it. It covers two groups of people: account holders (advertisers and world creators who sign up on this site) and players whose VR client loads one of our posters, enters a trigger zone, or uses a tracked object in a world on one of the most popular VR social platforms players use.

1. Players in social VR worlds

You choose whether your client contacts us

Our posters, trigger zones and tracked objects only reach our servers if you have turned on untrusted URLs in your platform's settings. If that setting is off, the platform blocks the request and we receive nothing from your client: the poster stays on the image built into the world. Our world tools never route requests through other services to get around that setting.

Blocking us in your DNS

Blocking api.vradvertisements.com in your DNS (a hosts file, Pi-hole or your router) turns off all tracking by our supported Unity packages in VR worlds, in websites with 3D worlds and in other video games, without changing any other setting. Posters keep the image built into the world.

Most computers can block a domain with one command in a tool such as PowerShell or Bash, and blocking api.vradvertisements.com stops all communication between your device and our tools.

Standalone headsets and phones usually can't run commands like these, so block the domain on your router or with a filtering DNS service instead.

What we receive and keep

  • Your IP address. Every web request carries it. We use it to stop abuse and fraud, such as scripted requests, and to tell separate players apart in our counts. We don't store the address itself. We store a keyed hash of it that changes every day. That hash is pseudonymous, not anonymous: we hold the key, so we treat it as personal data.
  • Client details your VR client sends with each request, such as its user agent, which tells us whether it is a PC or Quest client.
  • What happened and when: which poster loaded, that a player stayed near and facing it, that a player clicked it to open a VRChat group's page, which trigger zone was entered, which tracked object was used, and the time we received it.
  • Your platform display name. Worlds built with our tools send it once per visit, a few seconds per character. We store it linked to the daily IP hash.
  • Text a world chooses to send. Some worlds use our data feature to send other short text values. We store what the world sends, linked to the daily IP hash.

We don't receive your platform account ID, email, real name, voice, or location in the world beyond the zone and object events above. We don't use any of this to build profiles of individual players or to target ads at individuals, and we don't sell it.

How it is used

  • To decide which ad or artwork a poster shows and to keep the service running.
  • To detect and block abuse and fraud.
  • To give world creators and advertisers aggregate reports, such as how many players saw a poster or entered a zone on a given day. Reports never show IP addresses, hashes or display names.
  • To send world creators the data they asked their world to collect through our data feature.

2. Account holders

  • Account details: email, password (stored only as a salted hash), and optional phone number for two-factor sign-in.
  • Business and profile details: company or creator name, billing email, world names and descriptions, and the ads and artwork you upload.
  • Payments: advertiser card payments and creator payouts are handled by Stripe. We never see full card numbers or bank details. Stripe collects identity and bank information from creators for payouts under its own terms and privacy policy, and shares payout status with us.
  • Error logs: when something fails, we log technical details of the request to fix the fault.

3. Legal bases

Where laws such as the GDPR, UK GDPR or PIPEDA apply, we rely on:

  • Contract: to run your account, bookings, payments and payouts.
  • Legitimate interests: to prevent fraud and abuse, secure the service, and produce aggregate reports. We keep player data to the minimum these need.
  • Legal obligation: to keep payment and tax records.
  • Consent: where a law requires it, for example for optional emails.

4. Cookies

This website uses only cookies needed to run it. We don't use advertising or analytics cookies.

  • Sign-in cookies that keep you logged in, including short-lived ones for two-factor sign-in.
  • A security cookie that protects forms from cross-site request forgery.
  • A cookie that lets staff view the site during maintenance.
  • If you sign in with Bluesky, a cookie that holds that sign-in session.

Posters in VR worlds don't use cookies.

5. Who we share data with

  • Service providers that process data for us: Microsoft Azure (hosting and database), Stripe (payments and payouts), our email provider, and Twilio (text messages, only if you turn on SMS sign-in codes).
  • World creators receive aggregate reports for their own worlds, plus the data their world sends through our data feature.
  • Advertisers receive aggregate reports about where their ads ran.
  • Authorities when the law requires it, or to protect people or the service from fraud or harm.

We don't sell personal data, and we don't share it with data brokers or other ad networks.

6. Where data is stored

Data is stored with Microsoft Azure in [Azure region, country]. Stripe and our other providers may process data in other countries, including the United States, under their own safeguards such as standard contractual clauses.

7. How long we keep it

  • Individual poster events: 7 years. After that, only hourly and daily totals remain, with no IP hashes.
  • Individual trigger zone and tracked object events: kept with no time limit, so world creators keep their full history. Each keeps its daily IP hash, client details and time.
  • Display names: 7 years.
  • Text sent through the data feature: 7 years, unless the world creator deletes it sooner.
  • Error logs: until an administrator deletes them. They have no fixed time limit.
  • Account data: while your account is open, then deleted within 90 days of closing, except what we must keep.
  • Payment, payout and tax records: as long as the law requires, usually 7 years.

8. Your rights

Depending on where you live, you can ask to access, correct, delete or export your personal data, object to or restrict how we use it, and withdraw consent. You can also complain to your data protection authority, such as the Office of the Privacy Commissioner of Canada, your EU or UK supervisory authority, or your state attorney general.

Players: we can't link a daily IP hash back to you, so we usually can't find event records about a particular person. To have records of your platform display name deleted, tell us the display name and roughly when, and we'll find and delete them. To stop your client contacting us at all, leave untrusted URLs turned off in your platform's settings, or block our domain in your DNS as described in section 1.

9. Children

Accounts on this site are for adults (18+). The most popular VR social platforms allow players from age 13, so younger players may load our posters. We don't try to identify players or their ages, we don't build profiles, and our ad policy declines categories unsuitable for teenagers.

10. Security

Data is encrypted in transit, IP addresses are hashed before storage, passwords are hashed, and access to back-office tools is restricted to staff who need it. No system is perfectly secure. We'll notify you and the relevant authorities of a breach as the law requires.

11. Changes

We'll post updates here with a new date and, for significant changes, email account holders before they take effect.

12. Contact

Privacy questions and requests can be sent through the contact page. Our address is 10107 Jasper Ave, Edmonton, AB T5J 1W8, Canada.