Privacy policy
Last updated: 10 October 2026.
This policy explains which personal data Genvr (genvr.net) processes, why, and what rights you have. It follows the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).
1. Who is responsible
Dpro GmbH, Wipplingerstraße 20/18, 1010 Wien, Austria. Email: privacy@dpro.at. Phone: +43 676 905 4441. More in the Impressum.
We have not appointed a data protection officer, because the law does not require one for us. Write to privacy@dpro.at for any privacy question.
2. What we process and why
| Data | Why | Legal basis (GDPR) | How long |
|---|---|---|---|
| Google sign-in: your name, email address, profile picture and Google account ID | To create your account and sign you in | Art. 6(1)(b), the contract (our terms of use) | Until you delete your account |
| Date of birth and country (asked once after the first sign-in) | Genvr is for people aged 13 and over; your age and country decide which safety settings apply to you | Art. 6(1)(c) and (f), legal duties and protecting minors | Until you delete your account |
| Your profile, avatar and settings | To show you to other players the way you chose | Art. 6(1)(b) | Until you delete your account or change them |
| What you create: places, worlds, games, items, films, voice lines, scripts, ratings and reviews | To store, show and publish them as you ask | Art. 6(1)(b) | Until you or we delete them |
| Live play data: position, movement and chat messages in a place | To run multiplayer and apply safety controls | Art. 6(1)(b) and (f) | Recent chat and original message evidence are temporarily held in room memory; reported messages can become moderation evidence. Visit times are kept for 12 months |
| Reports, notices of illegal content and moderation decisions | To keep Genvr safe and meet the EU Digital Services Act | Art. 6(1)(c) and (f) | Up to 3 years after the case is closed |
| Technical data: IP address, browser type, time of access, error messages | To deliver the site, protect it from attacks and fix faults | Art. 6(1)(f), our interest in a safe, working service | Server logs: up to 30 days |
| Optional product events and browser error/performance diagnostics | To understand feature use or investigate browser faults when an adult separately opts in | Art. 6(1)(a), consent | Until no longer needed for the stated purpose; withdrawal stops future collection, and you may request deletion |
| Linked YouTube channels (see section 5) | To publish your films to your channel when you ask | Art. 6(1)(b) | Until you unlink the channel or delete your account |
| AI tool access (MCP tokens) you create in Settings | To let your own AI tools work on your places | Art. 6(1)(b) | Until you revoke the token |
We do not sell personal data. We do not use your data for advertising. We do not make decisions about you that are based only on automated processing and that have legal or similarly significant effects (Art. 22 GDPR).
3. Cookies and browser storage
Sign-in cookies keep your session and protect authentication. Browser storage remembers requested settings, including theme, audio, avatar and editor preferences; a theme cookie is not used. You can clear this storage through your browser, but doing so may sign you out or reset settings. Necessary storage supports the functions you request.
The footer's Cookie preferences and Accessibility options controls use the open-source Web Respect package. They store your choices locally in your browser, separately from account data. Cookie choices expire after at most 180 days or when their policy version changes; accessibility choices stay until you reset them or clear browser storage. The package does not send these choices to a receipt server or enable third-party tracking in this deployment. You can reopen Cookie preferences and withdraw optional choices at any time; optional services are currently disabled. Accessibility options supplement the site and do not guarantee that every page, game or 3D canvas meets accessibility standards.
Optional browser analytics and diagnostics are disabled in the current public deployment. If we introduce optional collection, we will update this notice with the actual provider, data, retention and transfer safeguards and offer the required choices before collection begins. Necessary server-side security/error logging is separate and supports protecting the service under Art. 6(1)(f) GDPR.
4. Who receives your data
- Hosting: our servers are run by WHG Hosting Services Ltd in a data center in Frankfurt am Main, Germany (EU), under a data processing agreement (Art. 28 GDPR).
- Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), when you sign in with Google or link YouTube. Google processes this data under its own privacy policy. Google may transfer data to the USA; Google LLC is certified under the EU-US Data Privacy Framework.
- Other players see what you publish and your public profile (name and avatar). They never see your email address or date of birth.
- Authorities, only when the law requires it.
- Optional browser tools: PostHog analytics and Sentry browser diagnostics are not configured in the current public deployment. They do not receive browser data from these disabled integrations. If enabled later, this notice will identify the recipient, data, retention and any international-transfer safeguards before optional collection starts; Cookie preferences will require a separate adult opt-in for each category.
5. YouTube
If you link a YouTube channel in Settings, Genvr uses YouTube API Services. By linking a channel you agree to the YouTube Terms of Service. Google's privacy policy applies: policies.google.com/privacy.
- What we access: the name and ID of the channel you choose (scope
youtube.readonly), and the right to upload videos to it (scopeyoutube.upload). - What we do with it: we show the channel's name in Settings, and we upload a film to it only when you press "Publish". We never upload, change or delete anything on your channel without your action.
- What we store: the channel's ID and name, and the access tokens Google gives us. They are kept on our server and never sent to your browser or to anyone else. The film file goes from your browser straight to YouTube.
- How to remove access: press "Unlink" in Settings. This deletes the tokens on our side and asks Google to revoke them. You can also remove Genvr's access at any time in your Google account: myaccount.google.com/permissions.
Genvr's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
6. Children and teenagers
Genvr's minimum account age is 13. Onboarding rejects dates showing a younger age, but self-reported dates are not proof of age. If you believe a younger child has an account, write to privacy@dpro.at so we can investigate and take appropriate action. In Austria, a child's own consent under GDPR Article 8 for directly offered online services is valid from 14 (§ 4(4) DSG); thresholds vary by country. This is separate from account eligibility and contractual capacity. We do not currently provide verified parental-consent onboarding. Optional browser tracking is currently disabled for all users. Our Community and child safety rules prohibit exploitation and unsafe conduct.
7. Your rights
You have the right to:
- get access to your data (Art. 15 GDPR)
- have wrong data corrected (Art. 16)
- have your data deleted (Art. 17)
- restrict processing (Art. 18)
- receive your data in a portable format (Art. 20)
- object to processing based on our legitimate interests (Art. 21)
- withdraw a consent at any time, with effect for the future (Art. 7(3))
To use these rights, or to delete your account and everything in it, write to privacy@dpro.at from the email address of your account. We answer within one month.
You can also complain to the Austrian Data Protection Authority: Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Wien, dsb.gv.at.
8. Security
All connections to Genvr are encrypted (HTTPS). Access to the servers is limited to the people who run them. Tokens for linked accounts are kept on the server only.
9. Changes
We update this policy when Genvr changes. The date at the top shows the latest version. We tell you about important changes on the site before they apply.