Privacy Policy
The short version. ARISE is local-first. Your character, quests, stats and workout history live on your own device and are not sent anywhere unless you create an account and turn on cloud save. There is no analytics, no advertising and no third-party tracking in ARISE — no Google Analytics, no advertising pixels, no session recording. We never see your card details.
1. Who is responsible
ARISE is operated by Salvus Paul, trading as Zelicra. For any privacy question or request, contact support@ariseinvr.com.
2. What stays on your device
By default everything does. ARISE stores your progress in your browser's own storage (IndexedDB and localStorage) on the device you play on:
- Your character: name, level, XP, rank, class, the seven attributes.
- Quests, completions, grades, streaks and activity history.
- Settings and preferences, and which tier you hold.
- Where your room scan is used for mixed reality, the room geometry stays on the headset. ARISE does not receive camera images or passthrough video — the headset does not make those available to a web page.
Save data is encrypted at rest on the device. Clearing your browser's site data for ariseinvr.com deletes it, and if you have no account there is no other copy.
3. What leaves your device, and only if you choose it
| If you… | We process | Why |
|---|---|---|
| Create an account | Email address, authentication identifiers, and a profile row | To sign you in and let you restore progress and purchases on another device |
| Use cloud save | Your character and progression data | To sync progress between your devices |
| Buy a tier | A purchase and entitlement record: which product, when, its status, and your user id | To grant what you paid for, and to revoke it on refund |
| Join the waitlist | The email address you typed | To email you about the launch. Held separately from the game database |
| Connect Strava | Activity data you authorise Strava to share | To convert real workouts into progression. Optional; disconnect at any time |
We do not sell personal data, and we do not share it for advertising.
4. Payments
Payments are processed by Dodo Payments, which acts as merchant of record. Your card number, expiry and security code are entered on their checkout and are handled by them and their processors. We never receive or store card details. What we receive back is a webhook telling us a payment succeeded, failed, renewed, was refunded or was disputed, so that access can be granted or revoked. Dodo Payments processes your payment data under its own privacy policy.
5. Processors we use
- Supabase — database and authentication for accounts, entitlements and purchases; and, on a separate project, the launch waitlist.
- Vercel — hosting and content delivery for the website. Vercel processes standard server request data such as IP address in order to serve the site.
- Dodo Payments — payment processing, as described above.
- Strava — only if you connect it.
6. Legal bases
Where UK/EU data protection law applies: we process account, sync and purchase data to perform our contract with you; we process the waitlist email with your consent, withdrawable at any time; and we rely on legitimate interests for keeping the service secure and preventing abuse. Purchase records are also kept to meet legal obligations such as tax and accounting.
7. How long we keep things
Account, profile and sync data are kept while your account exists, and deleted within 30 days of you deleting it. Purchase and entitlement records are kept for as long as tax and accounting law requires, even after account deletion, because we are required to. Waitlist emails are kept until you unsubscribe or ask us to remove them.
8. Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to processing, or port it elsewhere. Email support@ariseinvr.com and we will respond within 30 days. You can delete most of your data yourself at any time by deleting your account and clearing site data. If you are in the UK or EU you may also complain to your data protection authority.
9. Children
ARISE is not directed at children under 13, and we do not knowingly collect their personal data. Meta requires users of Quest headsets to meet its own minimum age. If you believe a child has given us personal data, contact us and we will delete it.
10. International transfers
Our processors may store and process data outside your country, including in the United States. Where required, transfers rely on appropriate safeguards such as the European Commission's standard contractual clauses.
11. Security
Save data is encrypted on your device. Traffic to the site and to our processors is encrypted in transit. Payment webhooks are signature-verified and rejected if they fail. No system is perfectly secure, and we cannot guarantee absolute security.
12. Changes
We may update this policy; the "last updated" date changes when we do. If a change materially affects how we use your data, we will make that clear before it takes effect.