DustCrow and this website are run by Null Effect Studio, a trading name of a sole trader based in the United Kingdom. For the data described below, Null Effect Studio is the data controller. You can reach us about anything on this page at privacy@nulleffectstudio.com.
This document covers the data we handle across our services: the DustCrow game on Meta Quest, this website, and our Discord "SARIS Bot".
DustCrow has an online economy. To run it fairly, we need to tell players apart using an identifier a player cannot reset to dodge rate limits or a ban.
When you launch DustCrow, the game reads your Meta (Oculus) user ID through the Meta Platform SDK, together with a single-use proof code (a "nonce"). We check that proof directly with Meta's servers to confirm it is really you. We then run your Meta user ID through a one-way hash (a UUID v5) to produce a player identifier.
This data is sent to our backend, keyed to your hashed identifier, so we can run the economy, anti-cheat, and aggregate statistics.
DustCrow has public leaderboards, shown both in the game and on this website. If you play online, your Meta (Oculus) username is displayed next to your ranking so other players can see who set a score. We read your username through the Meta Platform SDK for this, and it is the one part of your Meta profile we show publicly. You can opt out of appearing on the leaderboards in the game's settings, and if you do, your username is not shown. We do not use your username to contact you or to link you to anything outside the game.
DustCrow can record video clips and take photos from inside the game. This is built on the LIV Creator Kit. The headset asks for microphone access the first time you open the recorder on the Site Tablet, and not before. You can decline it and still play, and you can still record without your voice. The microphone is only captured while a recording is actually running, and your voice and the game audio go into that clip together.
Clips and photos are written to your headset's own storage. We do not receive them, and we have no way to access them. Sharing a clip is something you do yourself, from the headset.
LIV is a separate company. It is not a processor acting for us: it is its own data controller for what the Creator Kit collects. Its own privacy policy says it automatically collects device and game information (your headset, the game version, the developer, and a randomly generated code), usage logs and durations, error reports, and approximate location at city level. LIV's documentation states that your recorded video and your microphone audio are not sent to LIV. What LIV does with that data is governed by its policy and not by this one, so please read LIV's privacy policy.
Our lawful basis for this processing is legitimate interests (UK GDPR / EU GDPR Article 6(1)(f)): our interest in keeping the game secure, keeping the economy fair, running community features such as leaderboards, and improving the game. You can object to this processing, including opting out of the leaderboards, as set out under Your Rights below.
The game itself does not collect or store your IP address. Our hosting providers may process it transiently to route and secure your connection, but we do not use it to profile or track you.
Game data is stored and processed by Supabase (Supabase Inc.), a managed-database provider we use as a data processor. Our database is hosted in Supabase's EU (London) region, so the data itself lives in the United Kingdom.
Supabase Inc. is a US-based company, so your data may also be accessed or processed from the United States (for example, for infrastructure operations and support). These transfers are covered by our Data Processing Agreement with Supabase, which incorporates the EU Standard Contractual Clauses and the UK Addendum, the safeguards UK and EU law require for transfers outside the UK and EEA. We do not sell your data to anyone.
Supabase is the only processor that handles the game data described above. The one other company in the picture is LIV, and it is not a processor for us: it is a separate controller for the recording data described under Recording and the Microphone.
We keep your hashed identifier and the session, economy, and anti-cheat records tied to it for as long as we operate DustCrow's online services, because they are what let anti-cheat sanctions and rate limits stay in force. Aggregate statistics that no longer identify an individual player may be kept indefinitely. If we retire DustCrow's online services, we will delete or fully anonymise the account-keyed records. You can ask us to delete your data at any time (see below).
Because your player data is tied to a stable, account-derived identifier, deleting and reinstalling the game will not unlink or reset your past data. To access, correct, or delete the data linked to your identifier, or to object to the processing described above, email privacy@nulleffectstudio.com and we will act on it. If you are in the UK or EU, you also have the right to complain to your data protection regulator (in the UK, the Information Commissioner's Office).
To hand out game keys and run community events on Discord, SARIS Bot collects and processes:
DustCrow is intended for players aged 13 and over. We do not knowingly collect data from children under 13. If you believe a child under 13 has provided us data, contact privacy@nulleffectstudio.com and we will remove it.
We may update this policy as the game and our data handling change. When we do, we will update the "Last updated" date at the top. Material changes will be noted on this page.
For any privacy question or request: privacy@nulleffectstudio.com. For general questions, you can also reach us through our official Discord community.