Cozy Worlds Privacy Policy

Last Updated: May 13, 2026

Scope

This Privacy Policy (“Policy”) describes how RalphVR Inc., doing business as VRTogether (“Company,” “we,” “us,” or “our”), collects, uses, maintains, discloses, and protects information collected from players (each, a “Player,” or “you”) of any VRTogether game, including but not limited to Cozy Worlds, Cozy Worlds Together, and Rope Up (collectively, the “Games”), as well as visitors to the vrtogether.us website. This Policy applies regardless of the platform on which you obtained or are running the Games (including, for example, the Meta Horizon Store, Steam, or another distribution platform). By using or playing the Games, you signify your acceptance of this Policy.

Data Controller

RalphVR Inc., a Delaware corporation doing business as VRTogether, is the data controller responsible for the personal information collected in connection with the Games. You can reach us with privacy-related questions at info@vrtogether.us.

Information We Collect

We collect information in four ways: information you provide to us directly, information collected automatically by analytics while you play, information provided to us by the distribution or identity platform on which you are running the Games, and information collected by in-game features such as voice communication and screen capture.

Information You Provide

We collect personally identifiable information that you voluntarily submit to us, including but not limited to your name, email address, mailing address, and phone number, when you create an account, fill out a form, contact us by email, sign up for our newsletter, or use other services, features, or resources within the Games or on our website.

Information Collected Automatically by Analytics

When you play a VRTogether Game, we use Unity Gaming Services Analytics, operated by Unity Technologies, to collect information about your hardware (device model and operating system), the manner in which you play, the levels and content you have completed, the time at which you play, your IP address (used by Unity to derive your country and then discarded), and similar gameplay metrics. Unity Gaming Services Analytics assigns a persistent Unity Player ID that allows us to recognize returning sessions in aggregate. We use this information in aggregated, anonymized form to understand how Players use the Games as a group; we do not use it to identify you personally.

Where required by applicable law (including the GDPR in the European Economic Area, the United Kingdom, and Switzerland), we request your consent before initiating analytics data collection and provide an in-Game setting to withdraw that consent at any time. Withdrawing consent stops further data collection and, on

request, triggers deletion of previously collected data associated with your installation.

Data Collected via Distribution and Identity Platforms

When you play a VRTogether Game, we may receive certain data from the platform on which you obtained or are running the Game — for example, the Meta Horizon Platform, Steam, or another distribution or identity platform. The specific data depends on the platform but typically includes:

A persistent platform user identifier — referred to as USER_ID in Meta's Data Use Checkup, and known as the App-Scoped User ID on the Meta Horizon Platform, the Steam ID on Steam, or an equivalent identifier on other platforms — that allows us to recognize you across sessions and save your in-game progress;
Where the platform provides one and you have consented, your platform display name;
A one-time authentication token, ticket, or proof issued by the platform and used solely to verify with that platform that the account presented at sign-in is valid.

Some platforms (such as Meta Horizon for apps within the same developer organization) may also issue an organization-scoped identifier that allows us to recognize you across multiple VRTogether Games on that platform.

We use this data to authenticate you, save your in-game progress, and enable features that require account identity (such as multiplayer matchmaking and cross-game features within VRTogether). We do not share platform-provided identifiers with third parties for marketing purposes. We never receive your platform account password or your platform payment information.

Information Collected by In-Game Features

Certain Games include features that collect or transmit additional information while you use them. Where you do not use a feature, the associated data is not collected.

Voice communication (Cozy Worlds Together, Rope Up, and other multiplayer Games): When you speak in a multiplayer voice channel, your microphone audio is captured and transmitted in real time to other Players in the same session through Photon Voice, operated by Exit Games GmbH (“Photon”). Photon also receives a session identifier and your IP address as required to route the audio. Voice audio is not recorded or stored by us; Photon transmits the audio packets to recipients in the session and does not retain them after transmission.
In-Game screen capture and recording (Cozy Worlds): Cozy Worlds includes an in-Game capture feature provided by the LIV Capture Kit, operated by LIV Inc. (“LIV”). When the feature is active, LIV may transmit operational telemetry to LIV’s servers, including a per-device installation identifier, the application identifier, application and engine versions, render pipeline and graphics API in use, and event metadata indicating when the capture feature is initialized or used. LIV does not receive your name, email address, or platform account credentials from us.

How We Use Collected Information

We collect and use Player information for the following purposes:

To run, operate, and improve the Games and our other services. We use information about your gameplay to identify problems, deliver updates, and improve the Games.
To authenticate accounts and save progress. Identifiers from distribution and identity platforms are used solely to recognize returning players and persist their saved worlds and progress.
To enable in-Game features. Voice audio is used to enable real-time communication between Players in the same session. Capture and recording metadata is used to operate the capture feature.
To improve customer service. Information you provide helps us respond to support requests more efficiently.
To research and analyze gameplay in aggregate. We use anonymized information to understand how Players use the Games as a group and to evaluate our marketing and business efforts.
To send Players opt-in communications. Where you have opted in, we use your contact information to send updates, news, and marketing information about VRTogether and our Games.
To respond to inquiries. We may use your email address to respond to your direct questions or requests.

We may also disclose collected information, including personally identifiable information, in any of the following circumstances: (1) where the disclosure is necessary or useful to our provision of the Games or related services; (2) where we believe in good faith that disclosure is necessary to protect our rights, interests, or property; (3) where we are acting in good faith to protect your safety or the safety of others, to investigate fraud, or to respond to a verified government request; (4) where we believe in good faith that disclosure is required by law (such as compliance with a subpoena, search warrant, court order, or similar legal or administrative process); or (5) in connection with a sale, merger, acquisition, or other transfer of all or substantially all of the Company’s assets, in which case your information will likely be among the assets transferred.

How We Share Information with Third Parties

We share data only with:

Infrastructure providers that we use to operate the Games. Currently this includes Railway (backend hosting) and Amazon Web Services (save-data storage).
Distribution and identity platforms that you have chosen to use to access the Games (such as the Meta Horizon Platform or Steam), strictly to authenticate your account and operate platform-required features.
Analytics providers that help us understand aggregated gameplay patterns. Currently this is Unity Technologies (Unity Gaming Services Analytics).
Real-time voice and networking providers that enable multiplayer features. Currently this is Exit Games GmbH (Photon Voice and Photon Fusion), used in Cozy Worlds Together and Rope Up.
In-Game capture providers, currently LIV Inc. (LIV Capture Kit), used in Cozy Worlds to power the in-Game capture feature.
Email service providers used to deliver newsletters you have opted in to. Currently this includes Mailchimp.
Parties legally entitled to receive the information under the legal-disclosure conditions described above.

We do not sell personal information to third parties, and we do not share personal information for cross-context behavioral advertising.

Data Retention

We retain personal information only for as long as is necessary to provide you with the Games, satisfy our legitimate business interests, or meet legal obligations:

Account and saved-world data: retained for as long as your account remains active and for up to thirty (30) days after a verified deletion request, after which it is permanently deleted unless we are required by law to retain it longer.
Email-list data: retained until you unsubscribe, after which it is deleted from our active mailing systems within thirty (30) days.
Anonymous gameplay analytics: retained in aggregate form by Unity Gaming Services Analytics in accordance with Unity’s retention policies, and may be retained indefinitely because the data does not identify individual Players.
In-Game voice audio: not retained — transmitted in real time only.
In-Game capture telemetry: retained by LIV in accordance with LIV’s own retention policies. We do not retain a copy of LIV capture telemetry on our own servers.
Customer-support correspondence: retained for up to two (2) years from the last interaction so we can reference prior issues if you contact us again.

Data Deletion Requests

You may request deletion of the personal information we hold about you at any time, regardless of where you reside. To submit a deletion request:

Email us at info@vrtogether.us with the subject line "Data Deletion Request."
Include the platform on which you play (for example, Meta Horizon or Steam) and, if known, your in-game display name or platform user identifier, so that we can locate the correct records.

Upon receiving a verified request, we will delete the personal information associated with your account within thirty (30) days, except where we are required by law to retain specific records. Deletion includes saved-world data, account records, and platform-issued identifiers stored on our systems. Anonymous, aggregated analytics data that does not identify you personally may be retained.

If you play on the Meta Horizon Platform, you may also initiate a deletion request by uninstalling the Game and submitting a request through Meta's account tools; Meta will forward the request to us and we will process it as described above.

How We Protect Your Information

We use industry-standard practices to safeguard your information, including:

All data transmitted between your device and our services is encrypted in transit using HTTPS/TLS.
Save data is stored in encrypted Amazon S3 buckets with access restricted to authorized backend services.
Authentication uses cryptographically signed JSON Web Tokens (JWTs) with limited lifetimes.
Access to user data is restricted to personnel with a business need, with role-based access controls and audit logging.
Sensitive credentials (such as platform app secrets and database passwords) are stored as encrypted environment variables on our hosting providers.

No method of transmission or storage is perfectly secure, however, and we cannot guarantee the absolute security of your information.

Data Breach Notification

In the event of a data breach affecting your personal information, we will notify affected users without undue delay and in accordance with applicable law, including, where required, within 72 hours of becoming aware of the breach. Notifications will describe the nature of the breach, the categories of data involved, the likely consequences, and the steps you can take to protect yourself.

Children’s Privacy

The Games are not designed to solicit or collect personally identifiable data from individuals under the age of 13 (or under the age of 16 for Players in the European Economic Area or the United Kingdom, where the higher threshold applies under GDPR Article 8). In accordance with the Children’s Online Privacy Protection Act (COPPA) and applicable equivalents, we do not knowingly collect or store any personal information about children under the applicable age.

If we discover we have inadvertently collected such information, we will delete it within a reasonable time. Parents or guardians who believe we may have collected information from a child under the applicable age may contact us at info@vrtogether.us. Upon reasonable verification, we will delete the child’s information within a reasonable time and disable any associated account.

Your Rights

Rights for Players in the European Economic Area, United Kingdom, and Switzerland (GDPR / UK GDPR)

If you are a resident of the EEA, the UK, or Switzerland, you have the following rights with respect to your personal information:

Right of access: to request a copy of the personal information we hold about you.
Right to rectification: to ask us to correct inaccurate or incomplete information.
Right to erasure (“right to be forgotten”): to request that we delete your personal information.
Right to restriction of processing: to ask us to limit how we use your information.
Right to data portability: to receive your information in a structured, commonly used, machine-readable format.
Right to object: to object to processing based on legitimate interests, including direct marketing.
Right to withdraw consent: where we rely on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
Right to lodge a complaint: with the data protection authority in your country of residence.

The legal bases on which we rely for processing your data are: (a) performance of a contract (operating the Games and providing the services you request); (b) legitimate interests (improving the Games, security, fraud prevention); (c) consent (analytics collection where required, marketing communications, optional features); and (d) legal obligation (responding to lawful requests).

To exercise any of these rights, contact us at info@vrtogether.us. We will respond within the timeframes required by applicable law (generally one month under GDPR).

Rights for California Residents (CCPA / CPRA)

If you are a California resident, you have the following rights:

Right to know the categories of personal information we collect, the sources, the purposes for collection, and the categories of third parties we share it with.
Right to access the specific pieces of personal information we have collected about you in the past 12 months.
Right to delete personal information we have collected about you, subject to certain exceptions.
Right to correct inaccurate personal information we maintain about you.
Right to opt out of sale or sharing of your personal information. As stated above, VRTogether does not sell or share personal information for cross-context behavioral advertising.
Right to non-discrimination for exercising any of these rights.

The categories of personal information we collect are: identifiers (name, email, IP address, platform-issued identifiers, Unity Player ID, per-device installation identifiers); commercial information (account history, purchases, if any); internet or network activity (gameplay metrics, log data); audio information (real-time voice communication in multiplayer Games, transmitted but not retained); and inferences drawn from the above (preferences, gameplay patterns).

To exercise any of these rights, contact us at info@vrtogether.us. We will verify your identity before responding and will respond within the 45-day window required by the CCPA.

California “Shine the Light”

Under California’s “Shine the Light” law, California residents who provide personal information in obtaining products or services for personal, family, or household use are entitled to request and obtain from us, once per calendar year, information about the customer information we shared, if any, with other businesses for their own direct-marketing uses during the immediately preceding calendar year. To request this information, send an email to info@vrtogether.us with “Request for California Privacy Information” in the subject line.

Do Not Track

The Games do collect personal information as described elsewhere in this Policy (including platform-issued identifiers such as the Meta App-Scoped User ID). However, we do not track Players' activity over time across third-party websites or online services, and we do not build cross-site behavioral profiles. Because the Games do not engage in cross-site tracking, they do not currently respond to browser "Do Not Track" signals.

All Other Players

If you reside outside the regions listed above, you may still contact us at info@vrtogether.us at any time to request access to, correction of, or deletion of your personal information, and we will respond as required by applicable law.

Email Communications

If you opt in to our mailing list, you may receive emails that include company news, updates, and information about our Games and related products and services. You can unsubscribe at any time using the unsubscribe link at the bottom of any email or by contacting us at info@vrtogether.us.

International Data Transfers

VRTogether is based in the United States. By using the Games, you understand that your information may be transferred to, stored in, and processed in the United States and other countries where our infrastructure providers operate. Where required by law, we use appropriate safeguards (such as Standard Contractual Clauses) for international transfers of personal data from the EEA, the UK, or Switzerland to the United States.

Updating Your Information

If you believe the Games contain information about you that needs to be updated or corrected, please contact us at info@vrtogether.us.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last Updated” date at the top of this page and post a notice on vrtogether.us. We encourage Players to review this page periodically. Where required by law, we will provide more prominent notice (including, for material changes, by email if you have provided one). Your continued use of the Games following the posting of changes constitutes your acceptance of those changes.

If you have any questions or concerns about this Privacy Policy or how we handle your personal information, please contact us:

Email: info@vrtogether.us
Mailing address: RalphVR Inc., 348 E Main Street, Lexington, KY 40507, United States