1. Who we are and what this covers
Kindsty Studios ("Kindsty," "we," "us," or "our") operates Liminality VR. This Privacy Policy explains how we handle personal information when you use the Liminality VR game, its websites, accounts, community features, support channels, and related online services (together, the "Services").
For privacy questions or requests, contact privacy@liminalityvr.net.
2. Information we collect
Account and platform information
We may receive an account identifier, username, display name, profile color, roles, permissions, linked-platform identifiers, entitlement status, and authentication results. When you sign in through Meta or Steam, those providers authenticate you and give us the identifiers and account information authorized for the connection. We do not receive your Meta or Steam password.
Age information
We may collect your date of birth to confirm eligibility and assign an age group, such as 13–17 or 18+. We use this information for access, safety, and age-appropriate operation of the Services.
Gameplay and economy information
We collect data needed to run and protect the game, including session and lobby participation, region and server information, progression, discoveries, achievements, inventory, virtual-currency balances and transactions, beta eligibility, build version, and gameplay events used to validate progression or investigate abuse.
Social, communications, and voice information
Multiplayer features may process player identifiers, interactions, reports, and communications. Voice chat transmits microphone audio to other participants through our voice provider. Kindsty does not intentionally record or retain voice chat unless a future reporting or safety feature clearly tells you otherwise before collection. Other players may independently record what they hear using tools outside our control.
Device, network, and security information
We may collect IP address, session and account identifiers, device or installation identifier, device label, platform, operating system, game build, browser type and user agent, timestamps, approximate region derived from network information, authentication events, diagnostics, crash information, and security logs. We use this data to deliver connections, bind and protect sessions, prevent fraud, diagnose failures, and enforce our rules.
Kubian Integrity device attestation and environment protection
Liminality VR uses Kubian Integrity, an Android and Meta Quest integrity and anti-cheat service operated by Static Labs LLC ("Kubian"). During a protected session, the Kubian software and verification backend may collect or generate:
- A Liminality player identifier, device-registration date, challenge nonce, signed session token, verification history, request timestamps, and resulting integrity verdicts.
- Hardware-backed attestation information, including the integrity certificate chain, attested hardware serial number, device or platform issuer, verified-boot state, bootloader-lock state, device-integrity result, operating-system security patch level, hardware security level, and hardware-backed key properties.
- Application-integrity information, including the application package name, application certificate or SHA-256 digest, and whether the running application and signed session match the registered release.
- Runtime environment and tampering signals, including signs of root or hidden root, Magisk or KernelSU, Frida, Xposed, Zygisk, LSPosed, Substrate and similar hooking or injection frameworks, attached debuggers or debugging attempts, modified or insecure system properties, and SELinux enforcement state.
- Security detections, detection reasons, review status, actions taken, and device-level kick or ban records. Verification requests may also produce ordinary network and service logs, such as IP address, request metadata, and error information.
At the start of a protected session, Kubian issues a unique, single-use challenge. Your device uses its hardware-backed key store, such as a trusted execution environment or StrongBox, to sign attestation information. Kubian verifies the certificate chain and signature, checks the device, application, and challenge against Liminality VR's integrity policy, checks for replay attempts and device bans, and returns a signed verdict. While the protected game is running, Kubian continuously monitors the running process and system for configured environment and tampering conditions and reports detections to its backend in real time.
We use Kubian information to authenticate trusted game sessions, protect the game and other players, prevent replay and application tampering, investigate suspected cheating, maintain audit records, and enforce these Terms. Depending on our configured rule for a particular detection, a Kubian result may create an alert for review, remove a player from an active session, prevent access to a protected session, or apply a device ban. Some actions may occur automatically. Where appropriate, Kindsty may review the detection with other technical and contextual evidence and handle an appeal through its moderation process.
Kubian processes this information for Kindsty as a security service provider in the United States. Kubian may use hardware-attestation services supplied by the device platform, such as Meta or Google, to validate the device issuer and integrity certificate. Integrity and enforcement records are retained for as long as reasonably needed to protect the Services, investigate and review detections, enforce active restrictions, prevent repeat abuse, resolve disputes, and meet legal obligations. You can submit an access, correction, deletion, or objection request to Kindsty using Section 9; security, fraud-prevention, and legal exceptions may apply. More information about the technology is available on Kubian's security architecture page.
Support and moderation information
If you contact us or are involved in a report, we may collect the material you provide, correspondence, report details, evidence, enforcement decisions, appeal history, mute or voice-suspension status, ban or termination reasons, and relevant account or gameplay records.
3. Where information comes from
We receive information directly from you, automatically from your device and use of the Services, from connected platforms such as Meta and Steam, from infrastructure and service providers, and from other users when they submit reports or interact with you. We do not treat a player report or another client’s claim as conclusive proof of misconduct; it may be evaluated with other technical and contextual evidence.
4. How and why we use information
- Provide accounts, authentication, matchmaking, distributed-authority multiplayer, voice, progression, virtual items, notifications, beta access, and support.
- Verify platform ownership or entitlement and link the correct game account.
- Protect players and the Services, detect manipulation or instant-progression abuse, investigate reports, enforce rules, and preserve service integrity.
- Maintain, troubleshoot, measure, and improve performance, stability, accessibility, and game design.
- Send service, safety, maintenance, and account communications.
- Meet legal obligations and establish, exercise, or defend legal claims.
Where applicable law requires a legal basis, we rely on performance of our agreement with you, our legitimate interests in operating and securing the Services, compliance with legal obligations, protection of vital interests in an emergency, and consent where required. You may withdraw consent for future processing where consent is the basis, but this does not affect earlier lawful processing.
5. How we disclose information
We disclose information only as needed for the purposes above:
- Service providers. Hosting, content delivery, security, game backend, multiplayer, authentication, voice, analytics, diagnostics, and support providers process information for us. These may include Kubian Integrity (Static Labs LLC), Cloudflare, brainCloud, Unity, Meta, Steam, and the voice provider enabled in the current game build.
- Other players. Your username, display name, profile appearance, public roles, presence, voice, and actions can be visible to people sharing a game or public feature with you.
- Safety and legal recipients. We may disclose information when reasonably necessary to comply with law, protect players or the public, investigate fraud or abuse, or protect rights and security.
- Business transfers. Information may transfer as part of a merger, financing, acquisition, reorganization, or sale of assets, subject to applicable law.
We do not sell personal information for money, and we do not share it for cross-context behavioral advertising. We do not use sensitive personal information to infer characteristics about you.
6. Website, cookies, and embedded media
Our public website is delivered through Cloudflare, which processes network and request information to deliver and secure the site. The public pages do not currently offer account sign-in. We may use strictly necessary browser storage or cookies when an online function requires them.
The homepage may embed YouTube in privacy-enhanced mode. Loading or interacting with an embedded video connects your browser to Google or YouTube, which may receive network, device, and interaction information under its own privacy terms.
7. Retention
We keep personal information only as long as reasonably needed for the purpose collected. Retention depends on the type of record, whether an account remains active, operational and security needs, dispute and enforcement history, platform obligations, backup cycles, and legal requirements. Security and moderation records may be retained after account closure where needed to prevent repeat abuse, protect users, resolve disputes, or comply with law. We delete or de-identify information when it is no longer needed, subject to those exceptions.
8. International processing
Our providers may process information in the United States and other countries that may have different data-protection laws from your home country. Where required, we use legally recognized transfer safeguards and require providers to protect information consistently with their obligations to us.
9. Your choices and privacy rights
Depending on where you live, you may have rights to know or access your information, correct it, delete it, restrict or object to processing, receive a portable copy, withdraw consent, and appeal a denied request. You may also have the right to lodge a complaint with your local data-protection authority and to receive equal service and pricing when exercising privacy rights.
Send requests to privacy@liminalityvr.net. Describe the account and request clearly. We may verify your identity and authority before acting, and legal exceptions may apply. An authorized agent may submit a request where local law permits. We will not discriminate against you for exercising a privacy right.
Because we do not sell personal information or use it for cross-context behavioral advertising, there is no sale or advertising-sharing opt-out needed for our current practices. If that changes, we will update this Policy and provide required controls before the change applies.
10. Children
Liminality VR is not directed to children under 13, and people under 13 may not create or use an account. If we learn that we collected personal information from a child under 13 without valid authorization, we will take steps to delete it. If you believe this has happened, contact us promptly. Users under the age of legal majority where they live should review these terms and the Services with a parent or legal guardian.
11. Security
We use administrative, technical, and organizational safeguards designed to protect information, including access controls and protected authentication and session handling. No online service is completely secure. Protect your platform account, do not share authentication codes or session data, and tell us if you suspect unauthorized access.
12. Changes to this Policy
We may update this Policy as Liminality VR and its providers change. We will post the updated version here, revise the effective date, and provide additional notice when required by law or when a change materially affects how we handle personal information.