Privacy Policy

Who is responsible

This site is run privately by Simon Sohneg (sohneg.ch) in Switzerland — it is a non-commercial project, nothing is sold here. For any privacy question or request, write to contact@vrc-nextworld.com; we answer from that address and it is the official contact channel for data protection matters.

What we store

• Account: your e-mail address, your display name, and — depending on how you sign in — a scrambled, non-reversible version of your password and/or the account identifier Google sends us. Your actual password is never stored and cannot be recovered by us. We also record whether and when your e-mail address was confirmed.
• Sessions: refresh tokens, so you stay signed in on several devices. They expire after 7 days; the short-lived access token lasts 15 minutes.
• Your contributions: the worlds you share, your ratings, your comments and the categories you assign. These are public and shown together with your display name.
• Technical data: your IP address, used to enforce per-IP rate limits and recorded in the server logs together with the requested URL and timestamp. If something breaks in the browser, the error message, the page URL and a short context string are sent to our own server log.

Cookies

We set exactly two cookies, access_token and refresh_token. Both are HttpOnly, both exist only to keep you signed in, and neither is used to recognise you across other websites. They are strictly necessary for the service, so we do not ask for consent — signing out deletes them.

Why we may do this

Account data and your contributions: to provide the service you signed up for (contract). IP addresses, rate limits and server logs: our legitimate interest in keeping the site available and defending it against abuse. Where a processing operation needs your consent, we ask for it first and you can withdraw it at any time.

Who else sees it

• Hosting: the site, its database and the mirrored images run on our own server at Hetzner in Germany. Germany is recognised as providing adequate data protection, so no additional transfer safeguards are required. No data is sold, and none of it is shared for advertising.
• E-mail delivery: Infomaniak (Switzerland) sends the verification and password-reset messages and therefore processes your e-mail address.
• Discord: only if you choose "Continue with Discord". Discord then tells us your user id, your name and your e-mail address, and learns that you signed in here. Discord is based in the United States, so this involves a transfer there; their privacy policy applies to what happens on their side. Sign in with e-mail and password instead if you would rather avoid this.
• VRChat: we fetch world metadata and preview images from VRChat's API and mirror the images on our own server, so your browser never contacts VRChat. No data about you is sent to them.

How long we keep it

Account data stays until you delete your account. Refresh tokens expire after 7 days, verification and reset links much sooner. Server logs, including IP addresses, roll over daily and are kept for 30 days.

Deleting your account

You can delete your account yourself under My shared worlds. Doing so erases your e-mail address, display name, password hash, Google identifier and all your sessions immediately and irreversibly.

Your public contributions stay online without your name attached, shown as "anonymous". This is deliberate: removing them would silently rewrite other people's rating averages and counters on worlds you happened to share or rate. If you need a specific comment removed as well, ask us and we will delete it.

Your rights

You can ask us for a copy of the data we hold about you, have it corrected or deleted, object to processing based on legitimate interest, and receive your data in a portable format. One mail to contact@vrc-nextworld.com is enough. You may also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, if you live in the EU/EEA, to your local supervisory authority.

Changes

If this policy changes, the date at the top changes with it. Substantial changes will be announced on the site.