GoldenEye VR
Privacy policy
Effective 4 November 2026
GoldenEye VR is a free, non-commercial fan project made by MrSco. This policy covers the GoldenEye VR app for Meta Quest, this website (goldeneyevr.com) and the online service the app talks to (lobbies.goldeneyevr.com), including friends, presence, invites and the optional Discord link. We collect as little as we can, we never sell anything, and there are no ads.
No account needed
You can play without signing up for anything. The app makes an anonymous player ID on your headset the first time you use online features. Linking Discord is optional, and nothing in the game depends on it.
What we collect, and why
Your player profile, when you use friends or online play:
- A random player ID and a friend code (like
GE-7K3QX2), plus hashes of your secret and restore code. We never store the secret or restore code themselves. - The player name you choose. Other players see it, together with your friend code.
- Your friends, pending friend requests, the players you have blocked, and invites sent to or from you. Invites expire after 10 minutes.
- Your presence: whether you are online, and, unless you turn off Show what I'm playing, what you are doing (for example "Facility, Agent" or "Deathmatch, Statue, 3/8") and the code of the lobby you are in. Only your friends see it. Appear offline hides you completely.
- Your settings for presence details, appearing offline and appearing in name search.
Lobbies, when you host or join an online game: the lobby's name, code, map, mode, player count and phase. Public lobbies are listed publicly; private lobbies are reachable only by their code. A lobby is deleted when it closes, and at the latest two hours after it was made. We also keep daily totals (lobbies made, matches started and on which map) that contain no names, codes or player IDs.
Connection details. To connect players, headsets exchange network addresses with each other through the service. These are passed along and not kept once the lobby closes. Game traffic goes directly between headsets, or through Cloudflare's relay when a direct connection isn't possible; it never passes through our servers.
Debug reports, only when you choose to send one from the app: the game's log, crash records, the app version and headset model. IP addresses in the log are removed before it is sent. Reports are kept privately so we can fix bugs.
Website visits are counted with Cloudflare Web Analytics, which is cookieless and does not track you across sites. The website sets no cookies. The trailer only loads from YouTube (youtube-nocookie.com) after you press play.
If you link Discord
Linking uses Discord's own sign-in in your headset browser. GoldenEye VR asks Discord for permission to know who you are, see your Discord friends list and show your activity. With it:
- We store your Discord user ID against your player ID, so signing in again (for example on a new headset) brings back the same player. Your Discord name is shown in the app but not stored on our servers.
- Discord friends: your app sends us the Discord user IDs of your Discord friends. We use them only to find friends who have also linked GoldenEye VR. Two players become friends in the game only when each is in the other's Discord friends list. We do not contact or store anything else about your Discord friends.
- Rich Presence: your Discord status shows what you are doing in the game, for example "In a lobby, Facility co-op, 2/4". It follows the same Show what I'm playing and Appear offline settings.
- Invites through Discord carry a join link to your lobby.
- Sign-in tokens from Discord are kept on your headset, not on our servers. Our server only passes them between your headset and Discord when you sign in or your sign-in is renewed.
We never read your messages, servers, email address or voice, and the app does not use your microphone through Discord.
Unlinking in the app removes your Discord ID and the Discord friends list from our servers, and ends the in-game friendships that came from Discord. You can also remove GoldenEye VR from Discord → User Settings → Authorized Apps. Discord's handling of your data is covered by Discord's privacy policy.
Who else handles data
- Cloudflare hosts the website and the online service, provides the network relay, and processes requests (including IP addresses) to deliver them and protect against abuse.
- Discord, if you link it, as described above.
- GitHub stores debug reports in a private repository. Downloads come from GitHub releases, under GitHub's own privacy terms.
We do not sell, rent or share your data with anyone else, and we don't use it for advertising or profiling.
IP addresses and abuse limits
To stop abuse, the service counts requests per IP address for features like registering, sending reports or requesting a relay. It stores only a one-way hash of the address with the count, and drops it when the time window ends, at most a day later. Cloudflare's own request logs may hold IP addresses for a short time.
How long we keep it
- Lobbies: until they close, at most two hours. Invites: 10 minutes.
- Your player profile, friends and blocks: until you ask us to delete them. Removing a friend or unblocking deletes that entry straight away.
- Your Discord ID and Discord friends list: until you unlink.
- Debug reports: as long as they are useful for fixing the bug.
Your choices and rights
You can turn off presence details, appear offline, hide yourself from name search, block players, unlink Discord, or stop using online features at any time. To see, correct or delete your data, email info@goldeneyevr.com with your friend code. We will delete your player profile, friendships, blocks, invites and Discord link, and answer within 30 days. Depending on where you live, you may have further rights under laws such as the GDPR or CCPA; we will honour them.
Children
GoldenEye VR is not directed at children under 13, and we do not knowingly collect data from them. Meta Quest and Discord accounts have their own minimum ages. If you believe a child has given us data, email us and we will delete it.
Security
Everything travels over HTTPS. Secrets and tokens are stored only as hashes, and lobby and invite data is short-lived. No system is perfectly secure, but we keep what we hold small.
Changes
If this policy changes, the new version is posted here with a new effective date. Significant changes will also be announced on our Discord server.