Privacy Policy

1. Who is responsible

Aleš Spital, Slovenia operates VR4LL 2.0 VLE and is the controller responsible for the personal data processed for the app’s purposes. In this policy, “we,” “us,” and “our” refer to Aleš Spital.

This policy covers VR4LL 2.0 VLE, including the app distributed under package identifier com.multiversum.vrforall, related support and privacy requests, and this policy webpage. It applies whether you use the app alone or with other participants.

Contact: ales.spital@gmail.com.

2. Information we process

Microphone audio and voice communication

When microphone access is enabled and a voice feature is active, the app processes your microphone audio. Agora carries live voice chat to participants in your session. Microsoft Azure Speech processes audio for speech recognition during AI speaking practice. Other participants can hear what you say in voice chat.

AI dialogue and language practice

Recognized speech, conversation context, selected language, learning prompts, and AI responses are processed to understand your input and produce relevant replies. This includes OpenAI dialogue processing and Microsoft/Azure speech generation. When the AI browsing feature is triggered, a query derived from your dialogue is sent to Kagi to help produce a response. Dialogue may contain personal information if you say it.

Player identity and multiplayer activity

You choose a username (display name), which the app remembers on your headset and shares in multiplayer sessions. Unity automatically authenticates the app anonymously and assigns a player identifier for multiplayer services. The app processes that identifier, lobby/session identifiers and codes, participant membership, readiness, and connection information. Avatar movement, headset/controller poses, and object interactions are processed to represent you and synchronize the shared activity.

Avatars and preferences

The app saves your selected avatar and practice-language preferences on your headset.

Downloaded resources and local caches

The language selector downloads flag images from FlagCDN when they are not already cached. These requests include the requested image path and connection information such as your IP address. Flag images and avatar thumbnails may be cached on your headset.

Technical and diagnostic information

The app and its service providers process connection, device/software, usage, error, and performance information needed to operate and troubleshoot their services. Network services receive connection information such as IP addresses. App diagnostic output can include session identifiers, AI request/response content, and error details.

Support, privacy requests, and conduct reports

If you contact us or submit a report that is delivered to us, we process your contact details, the information you provide, relevant identifiers, and any accompanying evidence or report metadata to investigate and respond.

Please avoid sharing passwords, financial information, health information, or other sensitive personal details in voice chat or AI conversations. You can use a display name that does not identify you in real life.

3. Why we use this information

We process information to deliver the learning activities you request, create and join sessions, represent participants, synchronize interactions, enable voice communication, recognize speech, and generate AI replies and spoken responses. We also use relevant information to remember preferences, diagnose problems, respond to requests, address misconduct, protect the service, and meet legal obligations.

Where European data-protection law applies, our legal bases are performance of the service agreement for processing necessary to deliver requested app features; legitimate interests in operating, troubleshooting, securing, and supporting the app, balanced against your rights; and applicable legal obligations. Where processing requires consent, that consent must be obtained and may be withdrawn. A headset permission controls device access and does not replace any consent required by law.

AI replies are generated for language-learning interactions. This feature is not used by us to make decisions with legal or similarly significant effects about you.

4. Services and sharing

Information is transmitted to the services needed for the feature you use. Providers may process information on our behalf and may separately process service and security information under their own terms.

• Unity services: automatic anonymous authentication and player identifiers (without user registration), lobby membership and session data, and Relay/network traffic for connecting participants. Unity Privacy Policy.
• Agora: live voice audio and the channel, connection, and technical information needed to deliver communications. Agora Privacy Policy.
• Microsoft/Azure: speech recognition and speech generation. Depending on the operation, these services receive microphone audio or text to speak, along with technical request information. Microsoft Privacy Statement and Azure Speech data documentation.
• OpenAI: transcribed dialogue, relevant conversation context and prompts, and generated responses for AI language practice. OpenAI API data controls.
• Kagi: when AI browsing is triggered, Kagi receives a query derived from the dialogue and technical request information to generate a search-assisted response. Its processing can involve its own AI providers. Kagi Privacy Policy.
• FlagCDN / Flagpedia: delivers flag images used by the language selector. The service and its hosting provider receive image requests and connection information; the app does not send voice audio or AI dialogue in these image requests. FlagCDN service information and its linked Flagpedia Privacy Policy.
• Meta: Meta handles platform use, Store distribution, and platform reporting under its own policies. Information included in a conduct report may be made available to us for moderation. Meta Privacy Policy.
• Other participants: participants receive information shared in the session, such as your display name, avatar, movement/interactions, and voice when transmitted. They may retain information they hear or see independently of the app.

If you email us for support or a privacy request, Google/Gmail processes your email address and message; see the Google Privacy Policy. We may also disclose relevant information when required by law or necessary to address abuse, protect people’s rights or safety, or establish or defend legal claims.

5. Storage and retention

Retention depends on the type of information:

• Local preferences, authentication, and caches: your username, avatar/language choices, lobby-code visibility setting, Unity authentication information, and cached images are stored on your headset. They remain until replaced, invalidated, or cleared as applicable. Device backups, where enabled by the platform, may have their own retention.
• Session and dialogue memory: the app holds conversation context in memory while features run and clears or replaces it as conversations change or the app closes. It does not provide a saved conversation-history feature. This does not prevent dialogue from appearing in diagnostic output or provider records.
• Device diagnostics: app and SDK diagnostic logs may include identifiers, errors, and AI request/response content. Retention depends on the device and logging system.
• Provider-held records: providers may retain identifiers, request content or metadata, and diagnostic records for service operation, security, abuse prevention, and legal obligations. Retention depends on the service, its configuration, and the type of record. Ending a session or clearing headset data does not automatically delete these records.
• Support and reports: we keep information for as long as needed to resolve the request or report and any related safety, follow-up, or legal issue. When those purposes end, we delete or anonymize information under our control unless a legal retention obligation applies.

Microsoft documents that audio submitted to its real-time speech-to-text service is processed in server memory without storage at rest. This does not cover the app’s transcripts, diagnostic output, or other services. OpenAI documents that API abuse-monitoring logs can contain prompts and responses and are generally kept for up to 30 days, with legal and safety exceptions; other retention depends on the endpoint and configuration. These provider descriptions are not a guarantee that all app-related data has those retention periods.

6. Your controls

• You can deny or revoke the app’s microphone permission in the headset’s app-permission settings. Voice chat and speech-based AI features need microphone access to receive your speech.
• Use the voice-chat controls provided in the app. AI listening is a separate feature: entering an AI character’s interaction area starts recognition and leaving it stops that recognition path. Muting voice chat should not be treated as a control for every microphone feature.
• To stop all app microphone activity, revoke microphone permission or close the app.
• Choose from the avatars provided in the app and use a username that does not identify you in real life. Clearing local app data resets your saved username and preferences.
• Only share information you intend other participants or AI services to receive. You can leave a multiplayer session at any time.

7. Local data and privacy requests

Your username and preferences are stored on your headset. You can clear local app data through the headset’s app-management options, where available. This does not delete service-provider records.

For privacy questions or deletion requests, email ales.spital@gmail.com. Requests are free and available worldwide. We will explain what identifiable information we hold, what can be deleted, and any legal or technical limitations.

8. Your privacy rights

Depending on applicable law, you may have rights to access your personal data, correct it, request deletion, restrict processing, object to processing based on legitimate interests, and receive portable data. Where processing is based on consent, you may withdraw it without affecting the lawfulness of earlier processing.

Contact ales.spital@gmail.com to exercise these rights. Where the GDPR applies, we normally must respond within one month; if a lawful extension is necessary, we will explain it within that initial period.

You may complain to your local data-protection authority. In Slovenia, this is the Information Commissioner.

9. Younger users

VR4LL 2.0 VLE is intended for users aged 13 and older. It is not directed to children under 13. A 13+ audience designation does not replace local rules about a minor’s ability to use a service or provide valid consent; parent or guardian involvement may be required.

If you believe a child under 13 has provided personal data through the app, contact us so we can investigate and take appropriate steps, including deletion where applicable. Teachers and session organizers should avoid sharing students’ unnecessary personal information in voice or AI interactions.

10. International processing and protection

Service providers operate internationally. Your information may be processed outside Slovenia or the European Economic Area, including in countries whose privacy laws differ from yours. Where required, transfers must rely on a valid mechanism, such as an adequacy decision or appropriate contractual safeguards. Provider documentation explains their arrangements; contact us for information about safeguards applicable to app-related processing.

No transmission or storage method is completely secure. This policy does not promise absolute security or end-to-end confidentiality: other participants receive shared communications, and speech/AI providers process content to deliver their features.

11. Visiting this policy webpage

This page is hosted on GitHub Pages. We have added no analytics scripts, advertising trackers, external fonts, cookies, or data-entry forms to this page. It can be read without signing in or providing information.

GitHub states that it logs and stores visitors’ IP addresses for security purposes, including when visitors are not signed in. See GitHub Pages data collection and the GitHub General Privacy Statement. This website-hosting processing is separate from the app’s voice, AI, and multiplayer processing.

Following an external link takes you to a service governed by its own privacy practices. Selecting an email link opens your email application; a message is sent only if you send it.

12. Updates and contact

We will update this page when app data practices or relevant requirements change, and revise the date at the top. Where a change requires additional notice or consent under applicable law, we will provide it.

For app support, privacy questions, or requests concerning your data, contact Aleš Spital at ales.spital@gmail.com.