Privacy Policy

Effective date: October 11, 2026 · Applies to Crazy Golf VR for Meta Quest

Fiskar Varmations (Harshvardhan Varma, doing business as “Fiskar Varmations”), Calgary, Alberta, Canada · HarshvardhanV98@gmail.com

1. Who we are

Crazy Golf VR (“the app,” “we,” “us”) is a multiplayer mini-golf game for Meta Quest, developed and published by Harshvardhan Varma, a solo developer doing business as Fiskar Varmations, in Calgary, Alberta, Canada. Fiskar Varmations is the data controller for the information described here. This policy covers the Crazy Golf VR app; the Meta Horizon platform may show it to you before you use features such as multiplayer, voice chat or invites.

2. Information we process

We process only what the app needs to work. The categories, with examples:

• Meta account information. Your Meta user ID, display name, profile photo and age group (child, teen or adult), received from Meta when the app starts. We use them to recognise you between sessions, show you to the players you are playing with, and apply age-appropriate limits.
• Meta Avatar. Your avatar is loaded from Meta through the Meta Avatars SDK each session and shown to you and to the players in your session. We do not store it.
• Gameplay and progress. Your settings, course progress, earned titles and achievements are stored on your headset. If you are 13 or older, achievements are also recorded with your Meta account, and your best scores are posted to the game’s Meta leaderboards, where other players can see your display name and score.
• Multiplayer session data. To host and join online sessions we use Unity Gaming Services. Unity Authentication gives each installation of the app an anonymous Unity player ID; it is not linked to your Meta account or your name. While a session runs, Unity’s session service holds the room code, the room’s settings and, for rooms hosted by players aged 13 or older, the room name they type; Unity Relay carries the game traffic and sees your IP address. During play, your position, shots, avatar movement and game actions are sent in real time to the other players in the session.
• Movement and hand tracking. The app reads your headset, controller and (if you use them) hand-tracking positions on the device to control the game and your avatar. These movements are sent to the players in your session as avatar motion. We do not store or analyse them.
• Voice (13 and older only). If you turn on voice chat, your microphone audio is streamed live to the players in your voice channel through Vivox, a Unity service. It is not recorded. See Voice chat.
• Typed text (13 and older only). A display name you choose, the name of a room you host, and posts on the in-room message board are shown to the players in your session. Message-board posts exist only for the session and are not stored. The app has no other text chat.
• Social features. If you are 13 or older: your friends list, invites you send and receive, and the session you are in (so friends can join you). Every player: the people you have blocked on Meta, so they stay muted and hidden. See Meta platform features we use.
• Reports. Every player can report a teen or adult they meet from that player’s card: Meta’s reporting tool opens and Meta receives the report, including the reported player’s identity. Report in the Meta menu works for every player in your session and sends the report to us through Meta.
• Mixed reality (passthrough). The pause screen shows your surroundings using the headset’s passthrough, which is drawn by Meta’s system. The app never receives, records or stores camera images or scans of your room.
• Support messages. If you email us, we process your email address, the message and any attachments to reply.
• Diagnostics. Meta provides us with crash reports and performance statistics collected by the Meta Horizon platform, which we use to find and fix bugs. We do not use Unity Analytics or Unity crash reporting, and these reports contain no voice or messages.

3. Meta platform features we use

Crazy Golf VR uses the following Meta Horizon platform features under Meta’s Developer Data Use Policy. For each feature, this is the data we receive and the only purposes we use it for. Features marked “13+” are switched off for players aged 10–12.

User ID

Data: your app-scoped Meta user ID. Use: to confirm you own the app (entitlement check), recognise you between sessions, load your avatar, post your leaderboard scores and achievements (13+), and honour blocks. For players aged 13 and older it is shared with the players in your session so their apps can show your avatar and profile; it is never shared for players aged 10–12.

User Profile

Data: your Meta display name and profile photo. Use: to show who you are on your name tag, in the players list and on leaderboards, to the players in your session (13+). For players aged 10–12 these are never shown to other players; they appear under a generated name such as “Golfer 4108”.

User Age Group

Data: the coarse age group of your Meta account (child 10–12, teen or adult), from Meta’s Get Age Category API. We never receive your date of birth. Use: only to apply the age limits described in Children’s privacy. The last answer is remembered on your headset (per account) so the limits still apply when you play offline; until an age group is known, children’s limits apply.

Friends (13+)

Data: the user IDs, display names and online status of the people you follow on Meta who also play Crazy Golf VR. Use: to show your friends list so you can join or invite them, and to open Meta’s follow-request flow when you choose Follow on another player’s card. We do not store your friends list; it is fetched when you open it.

Invites (13+)

Data: who sent and received an invite, and the session it is for. Use: to open Meta’s invite panel and roster panel and to deliver invites to and from your friends. We do not keep invite records after the invite is used or expires.

Deep Linking, Destinations and Group Presence (13+)

Data: the session you are currently in (one of the app’s Destinations, such as a course or the clubhouse, and a session identifier) and the join links you open. Use: to let friends see where you are and join you, and to take you straight into the right session when you accept an invite or use Meta’s “Go To”. Your presence is cleared when you leave the session.

Avatars

Data: your Meta Avatar and the access token the Meta Avatars SDK needs to load it. Use: to show your avatar to you and to the players in your session (13+). Players aged 10–12 are shown to others with a default avatar. We do not store or edit avatar data.

Blocked Users

Data: the list of people you have blocked on Meta. Use: only to honour your blocks inside the app. We do not use it for anything else.

Leaderboards and Achievements (13+)

Data: your scores and achievement progress, stored with Meta against your user ID. Use: to rank scores and record achievements. Players aged 10–12 are not posted to leaderboards, and their achievements stay on the headset.

4. How we use information

• To sign you in, confirm you own the app, and save your progress;
• To run multiplayer sessions, Quick Match, room codes, invites and leaderboards;
• To show your name, avatar and game actions to the players you play with;
• To apply age-appropriate limits;
• To keep players safe: honour blocks, support reports, and act on abuse;
• To find and fix bugs and performance problems;
• To answer your emails and privacy requests;
• To meet our legal obligations.

We do not sell, rent or license your information, use it for advertising, combine it with data from outside the app, or use it to train AI models.

5. Legal bases (GDPR, UK GDPR and Quebec Law 25)

• Performance of our contract with you (the Terms of Service): sign-in, multiplayer, gameplay and saving progress;
• Consent: voice chat, which needs your microphone permission;
• Legitimate interests: safety, abuse prevention, security and bug fixing, balanced against your rights;
• Legal obligations: including child-protection law and lawful requests.

Automated decisions (Quebec Law 25). Quick Match automatically places you in an open public session, or starts one if none is open. This only routes you to a session; it has no legal or similarly significant effect on you. Contact us with any questions.

6. Voice chat

Voice chat is available only to players aged 13 and older. For players aged 10–12 it is off, and the app never asks for microphone permission (see Children’s privacy).

• Your microphone is used only after you grant permission on your Meta Quest.
• Audio is streamed live through Vivox (operated by Unity Technologies) to the players in your voice channel. We do not record, store, transcribe or analyse it.
• To run the service, Vivox keeps limited connection data (a truncated IP address, the Vivox user ID and a device identifier) for up to 30 days for routing and abuse prevention.
• You can mute yourself, mute others or leave voice at any time from the in-game menu or Meta’s system controls.
• Other players can hear you while you are unmuted, and could record what they hear. Please think about what you share.

7. Children’s privacy (ages 10–12)

Crazy Golf VR is self-certified as a “Mixed Ages” app on the Meta Horizon Store: it is for players 10 and older. When Meta tells us your account is in the child age group (10–12), or before any age group is known, the app applies these limits:

• No voice chat. Voice is off and the app never asks for microphone permission.
• No typed text. No custom display name, no room names and no message-board posts.
• No Meta social features. No friends list, follow requests, invites, group presence or “Go To”.
• No identity sharing. Other players see a generated name such as “Golfer 4108” and a default avatar, never the child’s Meta name, profile photo, user ID or avatar. Children are not posted to leaderboards, and their achievements stay on the headset.
• Multiplayer with these limits. Children can play online by room code, Quick Match or the public room browser, so they may play alongside teens and adults. Because of the limits above, they share no voice, text or personal identity with anyone. Every player can mute or hide any other player, every player can block and report the teens and adults they meet through Meta’s tools, and parents can report problems to us by email.
• No advertising or profiling. We do not use advertising identifiers or build behavioural profiles for anyone, including children.

For a child, the data we process is limited to the Meta user ID, age group, avatar (shown only to the child), settings and progress on the headset, the blocked-users list, and the anonymous session data needed to play online.

Parental controls. Meta requires a parent or guardian to create and manage the Meta account of a child aged 10–12. Parents can manage app access, time limits and social features through Meta Family Center at familycenter.meta.com.

COPPA. Meta’s parental consent covers the Meta account and Meta’s own services, not third-party apps. Crazy Golf VR does not collect voice, typed text or advertising identifiers from children, does not share their personal identity with other players, and limits their data to what is needed to run the game, as described above. A parent or guardian can review or delete a child’s data at any time by emailing HarshvardhanV98@gmail.com (see Deleting your data).

Crazy Golf VR is not for children under 10, and Meta does not permit them to use Meta Quest.

8. Storage and retention

Data	Where	How long
Settings, progress, titles, achievements, remembered age group	On your headset	Until you uninstall the app or clear its data
Leaderboard scores and achievements (13+)	Meta, against your user ID	While the app is offered, or until you ask us to delete them
Session data (room code, room name, settings, relay connection)	Unity Gaming Services	While the session runs
Message-board posts, gameplay and movement updates	Sent between players in the session	Not stored; gone when the session ends
Anonymous Unity player ID	Your headset and Unity Authentication	On the headset until uninstall; not linked to your Meta account
Voice audio	Vivox (live stream only)	Not stored
Vivox connection data	Vivox	Up to 30 days
Crash and performance reports	Meta	Up to 12 months
Support emails	Our email	As long as needed to resolve your request and meet legal obligations

9. Sharing

We never sell or rent personal information. We share it only with:

• Meta Platforms, Inc., which provides sign-in, entitlement checks, Meta Avatars, age groups, friends, invites, group presence, blocking, reporting, leaderboards, achievements, crash reporting and store distribution. Meta’s handling of data on its platform is covered by its own privacy policy.
• Unity Technologies, which provides Unity Authentication, multiplayer sessions and relay, and Vivox voice. Unity acts as our processor (GDPR) and service provider (CCPA). See Unity’s data processing addendum and privacy policy.
• Other players in your session, who see your name and avatar (for players aged 10–12, a generated name and a default avatar) and your game actions, and, in voice channels (13+), hear you while you are unmuted.
• Authorities, only when required by valid legal process or to protect the safety of players.

We do not share data with advertising networks, data brokers or AI training datasets.

10. Deleting your data

You can ask us to delete the data we hold about you at any time, free of charge:

1. Email HarshvardhanV98@gmail.com with the subject [Delete] Crazy Golf VR data, and include your Meta display name (a parent or guardian can do this for a child).
2. We may reply to confirm the request comes from you.
3. Within 30 days we delete your leaderboard entries and achievement progress through Meta’s server tools, and any support emails we no longer need to keep by law. We then confirm by email.

You can also delete data yourself:

• On your headset: uninstalling Crazy Golf VR (or clearing its app data) deletes your settings, progress, titles, remembered age group and anonymous Unity player ID.
• Voice and session data are never stored, and Vivox connection data expires within 30 days, so there is nothing further to delete.
• Data Meta holds about your Meta account can be reviewed, downloaded or deleted in Meta’s Accounts Center at accountscenter.meta.com.

11. Your rights and choices

Wherever you live, you can ask us to access, correct, delete or export your data, withdraw consent (for example, by turning off voice chat), or object to or restrict processing. Email HarshvardhanV98@gmail.com; we reply within 30 days, free of charge, and explain if we cannot do something.

• EEA and UK (GDPR / UK GDPR): you may also complain to your local data protection authority.
• California (CCPA / CPRA): you have the rights to know, delete and correct, and to opt out of the sale or sharing of personal information. We do not sell or share personal information for cross-context behavioural advertising, and we do not knowingly process the personal information of California residents under 16 for those purposes.
• Quebec (Law 25): you may also request portability and de-indexing, and complain to the Commission d’accès à l’information du Québec. The person responsible for protecting personal information is Harshvardhan Varma (email above).
• Canada (PIPEDA): you may also complain to the Office of the Privacy Commissioner of Canada.

12. Security

Sign-in goes through Meta, so we never see or store your Meta password. Data travels encrypted between the app, Meta and Unity, and access to support email is limited to the developer. No system is perfectly secure; if we learn of unauthorised access to your information we will notify Meta and, where the law requires, you and the relevant authorities. To report a security problem, email us with the subject prefix [Security]; we acknowledge reports within five business days and will not take legal action against good-faith researchers.

13. International transfers

We are based in Canada; Meta and Unity are based in the United States and run services worldwide, so your data may be processed outside your country. For transfers from the EEA, UK or Switzerland we rely on the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, through our providers’ standard agreements.

14. Changes to this policy

If we change how the app uses data, we will update this page and its effective date before the change ships, and tell you in the app or by email where the law requires.

15. Contact us

Questions about this policy or your data: Harshvardhan Varma, Fiskar Varmations, Calgary, Alberta, Canada · HarshvardhanV98@gmail.com. Use the subject prefix [Delete] for deletion requests, [Report] for conduct reports and [Security] for security issues.