Privacy Policy
The short version. Your character and progress are saved on your own device. Without an account, the only things that leave it are anonymous usage counts (which screens and milestones are reached, never your name or email) and the ordinary requests any website makes. With an account, your save is copied to our database so you can play on more than one device. There is no advertising and no selling of data, and we never see your card details. Health and fitness readings are only used to level you up in the game.
1. Who is responsible
ARISE is operated by Salvus Paul, trading as Zelicra. For any privacy question or request, contact support@ariseinvr.com.
2. What stays on your device
ARISE stores your progress in your browser's own storage (IndexedDB and localStorage) on the device you play on: your character (name, level, XP, rank, class, the seven attributes), quests, grades, streaks, activity history, settings, and any body metrics or health readings you add. Clearing your browser's site data for ariseinvr.com deletes it; if you have no account there is no other copy.
- Where your room scan is used for mixed reality, the room geometry stays on the headset. ARISE does not receive camera images or passthrough video.
- On a phone, Room Mode shows your camera on screen behind the game. No frame is stored or sent anywhere.
- The local save is scrambled with a key built into the app. That stops casual reading of the file, but it is not protection against someone who has access to your device.
3. What leaves your device
| When | What | Why |
|---|---|---|
| Always, for every visitor | Page views through Vercel Web Analytics (the page address and referrer; Vercel derives your country from your IP address; no cookies). Anonymous milestone events (for example "entered VR", "gate cleared", "purchased") with the day, your tier and a random install id stored in your browser — never your name, email or account id | To see how many people reach each part of the game and fix where they get stuck |
| Always | Your IP address, to Google Fonts (the game's typefaces) and, in VR, to the jsDelivr CDN (a fallback font used for some on-screen text) | To load the fonts the pages use |
| You create an account | Email address, password hash or Google sign-in identity (including the name on your Google account), and account identifiers | To sign you in and restore your progress and purchases on another device |
| Your first sign-in | Your email and your hunter name (or your Google name) to Brevo, which sends one welcome email | To send the welcome and handbook email, once |
| You are signed in and your tier includes cloud save (Shadow, or the free trial) | Your whole save, sent automatically a few seconds after each change: character, progress, inventory, training sessions, and any body metrics, health readings and notes you have added | To keep your progress in step across devices |
| You join the leaderboard (off by default) | The handle you choose, with level, rank, total XP, streak and class, visible to signed-in players. The top 100 handles with level, rank, total XP and class are also shown publicly on the web at ariseinvr.com/leaderboard | To rank you against other hunters. Going private deletes your row |
| You join a Covenant | Covenant name and motto are visible to signed-in players, and members see each other's handles. Inside the Covenant hall in VR, your handle and position are broadcast live on the hall's channel, which other signed-in players can also receive | To play together |
| You turn on alerts | A push subscription (the address your browser's push service gave us, its keys, and your browser's user-agent string). It is not linked to your account | To send game notifications. Turning alerts off deletes it |
| You use hosted AI quests (Shadow) | Your seven attribute values, goals, level, rank, class and time of day, with a signed licence token containing your account id, to our service on Amazon Web Services, which asks an Anthropic Claude model on Amazon Bedrock to write quests | To generate personal quests |
| You connect your own AI server | Stats, recent quests, goals and voice commands go to the server address you entered; we never receive them | To use your own assistant |
| You connect Strava | Strava's activity read access (including activities you marked private): for each activity its date, distance, moving time, average heart rate and calories, and your first name. Requests pass through our server to Strava | To turn real workouts into progression. Disconnect at any time |
| You buy a tier | A purchase and entitlement record: which product, when, its status, the amount, and your account id | To grant what you paid for, and to revoke it on refund |
| You join the waitlist | The email address you typed, held separately from the game database | To email you about the launch |
| You use voice commands | Speech recognition is done by your browser; in some browsers the audio is processed by the browser maker's speech service, under their policy | To understand the command |
We do not sell personal data, we do not use it for advertising, and there are no ads in ARISE.
4. Health and fitness data
Health Connect (Android app). If you connect Health Connect, ARISE reads steps, distance, active and total calories burned, heart rate, sleep and exercise sessions. It only reads; it never writes to Health Connect. Readings are reduced on your device to one summary per day and used only to grant in-game progression. They stay on your device unless you are signed in with cloud save active, in which case the daily summaries are stored with your save. Health data is never sold, never used for advertising, and never shared with third parties except the processors listed below. ARISE's use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements.
Body metrics and manual logs. Height, weight, age, gender, body fat, measurements and logged steps, heart rate, sleep and calories are optional. They are used to tailor quests and stats, and they follow the same rule: on your device, and in your cloud save only if cloud save is active.
5. Payments
Payments are processed by Dodo Payments, which acts as merchant of record. Your card number, expiry and security code are entered on their checkout and are handled by them and their processors. We never receive or store card details. What we receive back is a notice that a payment succeeded, failed, renewed, was refunded or was disputed, so that access can be granted or revoked. Dodo Payments processes your payment data under its own privacy policy. Nothing can be bought inside the Android app.
6. Processors we use
- Supabase — database, sign-in and realtime: accounts, cloud saves, purchases and entitlements, leaderboard and Covenant data, push subscriptions, the anonymous milestone events, and (on a separate project) the launch waitlist.
- Vercel — hosting, content delivery, Web Analytics, and our server functions (checkout, licence tokens, the welcome email, Strava and push relays). Vercel processes standard request data such as IP address in order to serve the site.
- Amazon Web Services — the hosted AI quest service (API Gateway, Lambda, DynamoDB, CloudWatch) and Amazon Bedrock, which runs the Anthropic Claude model.
- Brevo — sending the welcome email.
- Dodo Payments — payment processing, as described above.
- Google — Google sign-in, if you use it, and Google Fonts.
- jsDelivr — a font file for some VR text.
- Strava — only if you connect it.
- Your browser's push service — only if you turn on alerts.
7. Legal bases
Where UK/EU data protection law applies: we process account, cloud save, leaderboard, Covenant and purchase data to perform our contract with you; we process health and body data, which the law treats as special-category data, only with your explicit consent, given by connecting Health Connect or Strava or by entering it, and withdrawable at any time by disconnecting or deleting it; we process the waitlist email with your consent; and we rely on legitimate interests for the anonymous usage counts, the welcome email, and keeping the service secure and free of abuse. Purchase records are also kept to meet legal obligations such as tax and accounting.
8. How long we keep things
- Account, profile, cloud save, leaderboard and Covenant data: while your account exists, and deleted when you delete your account.
- Purchase records: kept for as long as tax and accounting law requires, with your account id removed when you delete your account.
- Anonymous milestone events and push subscriptions are not linked to your account, so deleting your account does not remove them; turning alerts off removes the push subscription.
- Hosted AI: rate-limit records for up to 48 hours and service logs (which hold only a shortened fingerprint of your account id) for 14 days.
- Waitlist emails: until you unsubscribe or ask us to remove them.
9. Deleting your account and data
In the app, open Settings → HUNTER ACCOUNT → DELETE ACCOUNT. That removes your account, cloud save, entitlements, leaderboard and Covenant rows at once. To remove what is on a device, clear the site data for ariseinvr.com (or uninstall the Android app). If you cannot use the app, email support@ariseinvr.com from the address on the account and we will delete it for you.
10. Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to processing, or port it elsewhere. Email support@ariseinvr.com and we will respond within 30 days. If you are in the UK or EU you may also complain to your data protection authority.
11. Children
ARISE is not directed at children under 13, and we do not knowingly collect their personal data. Meta requires users of Quest headsets to meet its own minimum age. If you believe a child has given us personal data, contact us and we will delete it.
12. International transfers
Our processors may store and process data outside your country, including in the United States. Where required, transfers rely on appropriate safeguards such as the European Commission's standard contractual clauses.
13. Security
Traffic to the site and to our processors is encrypted in transit. Your account data is protected by per-account access rules in the database, and payment notices are signature-verified and rejected if they fail. On Android, your phone's own backup may include the app's data. No system is perfectly secure, and we cannot guarantee absolute security.
14. Changes
We may update this policy; the "last updated" date changes when we do. If a change materially affects how we use your data, we will make that clear before it takes effect.