Wavefront Privacy Policy

Last updated: 9 October 2026

This Privacy Policy explains how AVR Interactive ("we", "us", "our") collects, uses and shares information when you play Wavefront, including when you use community maps.

Who we are

AVR Interactive, based in Germany, is the controller responsible for the personal data described in this policy. If you have questions about this policy or want to exercise any of the rights described below, contact us at privacy@avrinteractive.com.

What data we collect

We collect the following information to run Wavefront:

• Your Meta account identifier. When you sign in, we receive an app-scoped identifier for your Meta account, together with a one-time proof token that lets our server confirm it is really you. We use this to create and sign in to your Wavefront account.
• Your display name and profile picture, as set on your Meta account. These are shown to other players in lobbies and during matches so you can recognize each other.
• Your voice, captured by your headset's microphone during voice chat, so other players in your lobby or party can hear you.
• Your headset and hand movement (tracking data), used on your device to animate your avatar, and also sent to other players in your match so they can see your avatar move in real time.
• Progression and purchase data: your unlocked and purchased cosmetics, progression, friends list and party membership, stored on our own game server against your account.
• Community map account data (only if you rate or report a community map). Community maps are hosted by mod.io. Browsing and downloading maps needs no account and sends no account data. If you rate or report a map, the game asks you to accept mod.io's terms and then signs you in to mod.io. On Meta Quest we send your Meta app-scoped user ID, a one-time proof and an access token to mod.io. On PC (Steam) we send a Steam sign-in ticket. If that sign-in fails, the game falls back to signing you in with an email address and a code, and no Meta or Steam data is sent in that case. mod.io then holds your mod.io account, your ratings, and your reports (the category, the text you write, and your mod.io username).
• Information you give us directly if you contact us for support, for example by email, including your contact details and the content of your message.

We do not store your profile picture on our servers. It is fetched and shown to other players in your match only, and held in memory on each player's device for the duration of that match.

How we use your data and why

We use the information above to:

• create and maintain your player account, and let you keep your progression, cosmetics and friends across reinstalls and different headsets;
• show you and other players who you are playing with, in lobbies and in game;
• carry voice chat between players in the same lobby or party;
• synchronize avatar movement between players so multiplayer matches work;
• apply moderation decisions (such as bans) to your account if you violate our rules;
• let you rate and report community maps through mod.io;
• respond to support requests you send us.

We do not use your data for advertising, and we do not sell it.

Under the GDPR we rely on these legal bases: performance of our contract with you (Art. 6(1)(b)) for your account, multiplayer, voice and avatar features; our legitimate interests in running a safe game, enforcing our rules and answering support requests (Art. 6(1)(f)); and your consent (Art. 6(1)(a)) for the mod.io sign-in, which only happens after you accept mod.io's terms. You can withdraw that consent at any time by deleting your mod.io account (see "Requesting deletion of your data"). Withdrawing does not affect what happened before.

Who we share your data with

We share limited data with the following providers, only so they can provide the service described:

• Unity Technologies, which operates the voice chat service we use (Vivox / Unity Gaming Services). Unity receives your voice audio only, never your display name, profile picture or Meta account identifier.
• Epic Games, whose Epic Online Services we use as a network relay between players in some matches. When active, it carries your display name, profile picture and avatar movement data between players in transit. It does not store, analyze or reuse this data for its own purposes.
• mod.io, which hosts community maps. Only if you rate or report a map, mod.io receives the sign-in data described above and creates and keeps a mod.io account for you. Through your Meta sign-in mod.io may also use your Meta age group and blocked-users list, to apply its own age policies (which may include restricting mature content) and to hide content from creators you have blocked. mod.io acts as an independent controller for the account it creates, so its own terms and privacy policy (https://mod.io/privacy) govern that account and the data it holds.

Some of these providers are located outside the European Economic Area. Unity and Epic are US-based, and mod.io is based in Australia and uses its own service providers in other countries. Where data is transferred outside the EU/EEA, this happens on the basis of safeguards the GDPR permits, such as an adequacy decision or standard contractual clauses, or, for mod.io, your explicit agreement when you accept its terms before signing in.

Our own game server runs on infrastructure we operate ourselves. If that changes, we will update this policy to name the provider.

How long we keep your data

We keep your account data for as long as your account exists. If you ask us to delete your data (see below), we delete or irreversibly anonymize it within 30 days of a verified request, except where we need to keep limited records, for example to enforce a ban, prevent fraud or comply with a legal obligation. In that case we keep only what is necessary for that purpose and for no longer than needed. Data held by mod.io is kept according to mod.io's own policy.

Your rights

Depending on where you live, you may have the right to:

• ask us what personal data we hold about you, and get a copy of it;
• ask us to correct inaccurate data;
• ask us to delete your data (see "Requesting deletion of your data" below);
• object to or ask us to restrict certain uses of your data;
• receive your data in a portable format;
• withdraw consent you have given us.

To exercise any of these rights, contact us at privacy@avrinteractive.com. If you are in the EU/EEA, you also have the right to lodge a complaint with your local data protection supervisory authority.

Requesting deletion of your data

You can ask us to delete your personal data at any time, free of charge, by emailing privacy@avrinteractive.com from an address we can use to verify your request. We may ask you to confirm details only the account holder would know. We will delete or anonymize your data within 30 days of a verified request.

If you have a mod.io account that was created through the game, that account is held by mod.io, not by us. You can delete it yourself at https://mod.io/me/privacy (choose Close Account, then Delete Account) or by opening a ticket with mod.io support at https://support.mod.io/hc/en-us/requests/new. mod.io says deletion can take up to 48 hours and cannot be undone, and that you must first leave any mod teams and delete or hand over mods you published. You can also email us at privacy@avrinteractive.com and we will help you get your request to mod.io.

We may keep a limited record instead of fully deleting it if, for example, your account was banned for rule-breaking and we need to retain that record to enforce the ban or prevent the same person creating a new account to evade it, or where we are legally required to retain certain records. Where this applies, we will tell you why when we respond to your request.

Children's privacy

Wavefront is not directed at children. We rely on Meta Horizon's own account eligibility requirements to determine who may create an account and play, and we do not knowingly collect personal data from anyone below the minimum age Meta's platform requires.

Security

We use reasonable technical and organizational measures to protect your data. No system is completely secure and we cannot guarantee absolute security, but we work to protect your information appropriately for a game of this size.

Changes to this policy

If we make material changes to this policy, we will update the "Last updated" date above and, where appropriate, let players know in the app.

Contact us

AVR Interactive, Germany Email: privacy@avrinteractive.com