AZRAQ · Legal
Privacy Policy
The short version
- To sign you in, AZRAQ receives your Meta Horizon app-scoped User ID — not your name, photo, friends or any other Meta profile data.
- Our server checks with Meta that the sign-in is genuine and that your account is entitled to AZRAQ, then keeps your AZRAQ account, your characters and your playtest access.
- The game does not use your microphone, camera, eye, face or body tracking, or room data. Hand tracking is processed on your headset only.
- There is no advertising, no tracking and no analytics on the website, and the website sets no cookies.
- You can ask us at any time for a copy of your data or for its deletion: info@playazraq.com.
Who we are
AZRAQ is a virtual-reality game for Meta Quest, published with the website playazraq.com. The controller of your personal data — the company that decides why and how it is used — is CKAI SRL, Basilieklaan 377/3, 1081 Brussels, Belgium, company number BE 0775.700.882 (“we”, “us”).
For any question about this policy or your data, write to info@playazraq.com.
This policy covers the AZRAQ game on Meta Quest (including the closed playtest), the AZRAQ servers the game connects to, and the website playazraq.com. Meta, Discord and other services you reach from AZRAQ have their own privacy policies.
Your Meta account and the User ID
When you start AZRAQ, the game asks the Meta Horizon platform on your headset for three things, and only these:
- Whether your Meta account is entitled to AZRAQ — the game stops if it is not.
- Your app-scoped User ID — a number Meta creates for your account in AZRAQ only. It is not your Meta username and cannot be used to identify you in other apps.
- A one-time User Proof — a single-use code that lets our server confirm with Meta that the sign-in really comes from your account on your headset.
The game sends the User ID and the User Proof to our server over an encrypted (HTTPS) connection. Our server then asks Meta, from the server side only, to (1) validate the User Proof, (2) verify that your account is entitled to AZRAQ and (3) return your org-scoped ID, an identifier Meta provides so a developer can recognise the same player across its own apps. The User Proof is used once and is not stored.
We do not request your Meta display name, username, profile picture, friends list, age group, invites, parties or purchases, and we do not import anything else from your Meta account. We never use Meta data for advertising, never sell it, and never share it with anyone except the service providers listed below that run AZRAQ for us.
Meta processes your Meta account, your headset's system data and the Meta Horizon Store under its own responsibility and its own privacy policy, available at meta.com/legal/privacy-policy.
What we collect, why, and for how long
| Data | What it is | Why we use it | Legal basis (GDPR) | How long we keep it |
|---|---|---|---|---|
| Meta identifiers | Your app-scoped User ID and, when Meta provides it, your org-scoped ID. Our server links them to a random AZRAQ player ID; your Meta ID is never used as your player number and is never shown in the game. | Sign you in, find your AZRAQ account again, stop the same account from being duplicated or abused. | Contract (providing the game you asked for); legitimate interests (security). | As long as your AZRAQ account exists. |
| Ownership check | Whether your account is entitled to AZRAQ, when we last verified it, how, and the grant time Meta reports. | Give access only to entitled accounts; the closed playtest requires a check made in the last 24 hours. | Contract. | As long as your AZRAQ account exists (updated at each sign-in). |
| Account and sign-in sessions | Your random player ID, account status, sign-in times, and session tokens. Session tokens are stored only as one-way hashes. The game also sends a random install ID (created on your headset, not a hardware identifier); only a hash of it is kept. | Keep you signed in securely and end sessions that look stolen. | Contract; legitimate interests (security). | Access tokens expire after 15 minutes. Refresh tokens expire after 30 days and are never valid for more than 90 days. Session records have no automatic deletion period yet — see “Keeping and deleting data”. |
| Characters | The character name you type (unique in AZRAQ), the appearance options you pick from the game's own catalogue (they are not measurements of you), the character slot, your starting equipment and the records of their creation. | Create and load your characters and keep names unique. | Contract. | As long as your AZRAQ account exists. |
| Closed playtest access | The invitation code you enter (stored only as a keyed hash), your access grant, when your 30-minute session started and ends, your world session start and end times, and an audit trail of who granted or changed access and when. | Run the closed playtest fairly: the server, not the headset, controls the 30-minute allowance. Show you a short player reference you can quote if you contact us. | Contract; legitimate interests (preventing abuse of invitations). | Kept for the playtest programme; no automatic deletion period yet — see “Keeping and deleting data”. |
| Technical and security data | Your IP address, which any internet service necessarily sees. Our server uses it only in memory to limit repeated requests and does not write it to its logs. Error logs record the request path, status and an error reference — not your IP address, player ID, codes or tokens. | Protect AZRAQ against overload and abuse; fix errors. | Legitimate interests (security and reliability). | Rate-limit counters live in memory only. Our hosting providers keep their own operational logs under their own retention rules. |
Your progress in the world is not stored. In the current build, inventory, equipment, your house, gathered resources, quests and your position are not saved — neither on your headset nor on our servers. Only your account, your characters and your playtest access are kept on our servers.
| Data | What it is | Why we use it | Legal basis (GDPR) | How long we keep it |
|---|---|---|---|---|
| Registration forms | When you sign up for a playtest, pre-registration, development news or a Founder reservation: your e-mail address, which form you used, your consent and its time, whether you asked for news, and — if you chose them — your headset model and the Founder tier you are interested in. | Send you what you asked for: a playtest invitation, information about your reservation, and development news only if you opted in. A Founder reservation is not a purchase and involves no payment. | Consent — you can withdraw it at any time. | Until the purpose is fulfilled or you withdraw your consent or ask for deletion, whichever comes first. |
| Playtest invitation requests | When you ask for a playtest invitation on our Discord server: your Discord username and the e-mail address you give us for the invitation. | Send your invitation code by e-mail and answer your questions about the playtest. | Taking the steps you asked for (contract). | Until the closed playtest programme ends, or earlier if you ask us to delete it. |
| Abuse protection | A salted one-way hash of your IP address, with the time of your attempts. | Limit repeated form submissions (five per ten minutes). | Legitimate interests (security). | Ten minutes. |
The website uses no analytics, advertising or social-media trackers and sets no cookies. Its fonts and images are served from playazraq.com itself, so visiting it does not contact Google or other third parties. Like every website, our host receives your IP address and browser information when you load a page.
Website accounts are not open yet. Before they open, this policy will be updated to describe them first.
On your headset
- Stored on the headset only: your comfort and audio settings (turning, vignette, seated mode, height, handedness, haptics, volumes), a random install ID, and the last character you selected. They never leave the device except the install ID, as described above. Android backup is disabled for AZRAQ, and the files are removed when you uninstall the game.
- Sign-in tokens are kept in memory only, never written to the headset; the game signs in again each time it starts.
- Hand and head tracking are processed by your headset in real time to move your hands and body in the game. AZRAQ does not store or send tracking data.
- Not used: the microphone (the permission is removed from the game), cameras or passthrough, eye, face or body tracking, room or scene data, and location.
- No chat: AZRAQ has no voice or text chat today. The only text you enter is your character's name and, during the playtest, an invitation code.
Engine and platform diagnostics
AZRAQ is built with the Unity engine and Meta's XR software kit. AZRAQ itself sends no analytics, crash reports or gameplay telemetry. However, the engine and the kit include their own diagnostics: in the current build, Unity's engine diagnostics can send Unity Technologies technical information such as your device's hardware and system details and crash information, and Meta's XR kit can send Meta usage events about the kit through your headset. Unity Technologies handles that information under its own privacy policy, at unity.com/legal/privacy-policy.
Who processes data for us
We do not sell personal data. We share it only with the providers below, which run AZRAQ for us and may use it only on our instructions, and with Meta as described above:
| Provider | Role | Where |
|---|---|---|
| Supabase, Inc. | Database for AZRAQ accounts, characters and playtest access. | European Union — Ireland (AWS eu-west-1). |
| Render Services, Inc. | Hosts the AZRAQ game server (the “Gateway”) the game connects to. | European Union — Frankfurt, Germany. |
| Infomaniak Network SA | Hosts the playazraq.com website and its registration forms. | Switzerland. |
| Meta | Validates sign-ins and ownership (as described above). Meta operates the Meta Horizon platform as an independent controller, under its own privacy policy. | Under Meta's own policy, including the United States. |
Supabase and Render are companies based in the United States. Their data processing terms, which form part of their terms of service, include the European Commission's Standard Contractual Clauses for any transfer of personal data outside the European Economic Area. Infomaniak is based in Switzerland, which the European Commission recognises as offering an adequate level of protection. Meta processes data under its own policy, including in the United States.
If you join the AZRAQ Discord server, Discord processes your Discord account and messages under its own privacy policy. We see only what you share there.
Keeping and deleting data
Some data is deleted automatically: sign-in challenges an hour after they expire, account-link codes a day after they expire, duplicate-request keys after 30 days, and website rate-limit hashes after ten minutes. Access and refresh tokens expire as described above.
Your AZRAQ account, characters and playtest access records do not yet have an automatic deletion period, and there is not yet a delete button in the game or on the website. Until there is, we handle deletion on request:
- Write to info@playazraq.com from any address and include the player reference shown in the game (for example ABCD-1234), or the e-mail address you used on the website.
- We may ask you to confirm the request from your headset or your e-mail address, so that nobody else can delete — or obtain — your data.
- We will reply within one month. We delete your account, characters and playtest records, or irreversibly anonymise entries that belong to security or integrity logs, and we confirm when it is done. If we must keep something by law, we tell you what and why.
Uninstalling AZRAQ removes the data stored on your headset. It does not delete your account on our servers — ask us to do that as described above.
How we protect your data
- All traffic between the game, the website and our servers is encrypted (HTTPS/TLS), and our server only connects to the database over verified TLS.
- Session tokens, invitation codes and link codes are stored only as one-way or keyed hashes.
- The secret used to talk to Meta stays on our server and is never placed in the game.
- The database restricts every table with row-level security, and our server runs with the least privileges it needs.
- Requests are rate-limited and checked against strict limits; logs exclude tokens, codes and IP addresses.
No system is perfectly secure. If a breach affecting your data occurs, we will notify the authorities and, where required, you.
Your rights
Under the GDPR (and similar laws where you live) you can ask us to:
- access your data and receive a copy of it;
- correct inaccurate data;
- delete your data;
- restrict how we use it, or object to uses based on our legitimate interests;
- receive the data you gave us in a portable format;
- withdraw your consent at any time, for example to stop development news — this does not affect what was done before.
To exercise any of these rights, write to info@playazraq.com. It is free, and we reply within one month.
You can also complain to a data-protection authority — the one where you live or work, or our lead authority: Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit).
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. The 30-minute playtest allowance is the same fixed limit for everyone.
Children
AZRAQ is intended for players aged 13 and over. It is not directed at children, and we do not knowingly collect personal data from children under that age. If you believe a child has given us personal data, write to info@playazraq.com and we will delete it.
Founder packs and payments
Nothing is sold on playazraq.com today: a Founder reservation records your e-mail address and the tier you are interested in, with no payment and no payment details. Before any purchase becomes possible, this policy will be updated to name the payment provider and describe what it processes.
Changes to this policy
AZRAQ is preparing for Early Access, and this policy will change as features are added — for example website accounts, saved progression or co-op play. We will update this page and its date before any change takes effect, and tell you in the game or by e-mail when a change matters to you.
Contact
CKAI SRL · Basilieklaan 377/3, 1081 Brussels, Belgium · company number BE 0775.700.882
Privacy questions and requests: info@playazraq.com