Privacy policy
This policy explains what information CreativeCrew (“we”, “us”) collects when you play AiRhythm or use Satellite, how we use it, and the choices you have. It covers the AiRhythm app for Meta Quest and the online services it uses: Satellite accounts, leaderboards, replays, community charts and multiplayer.
CreativeCrew is an independent game studio based in Australia. It is not yet a registered company; we'll update this policy with our registration details once it is. You can contact us about privacy at privacy@creativecrew.xyz or scarylegalemail@creativecrew.xyz.
The short version
- You can play AiRhythm offline without an account. Nothing leaves your headset unless you sign in to Satellite or join a multiplayer room.
- A Satellite account is just a username and password, and passwords are stored hashed.
- If you sign in, we store your scores and replays of your runs, including how your hands and headset moved while you played. The replay of your highest score on each song is public.
- In multiplayer, your hand and head movements are shared live with the other players in your room, and nothing is kept once the room is done.
- We don't show ads, we don't use third-party analytics or tracking tools, and we don't sell your information.
Information we collect
1. On your headset only
These stay on your device and aren't sent to us:
- Your settings (note speed, audio offset, volume, comfort options) and local best scores.
- Songs and charts you download.
- Video clips you make of your runs. They're saved to your headset's videos folder and only go anywhere if you share them yourself.
- Your Satellite sign-in, stored as a sign-in token plus your Satellite user ID and username. Your password is sent to Satellite over an encrypted connection to sign in and is never stored by the app.
2. Your Satellite account
AiRhythm's online features use Satellite, CreativeCrew's community service for rhythm-game charts. To create an account you choose a username and a password. That's all we ask for. Passwords are stored only in hashed form, so your actual password stays private even in the unlikely event of a data breach.
3. Scores and replays (when signed in)
When you finish a song while signed in, AiRhythm sends:
- Your score: score, accuracy, how many notes you hit at each timing grade, early and late counts, best chain, fever results, and which song, chart version and difficulty you played.
- A replay of your run: the timing of every note you hit or missed, and your movement during the song. That means the positions of your hand joints (26 points per hand) and your headset’s position and rotation, recorded 30 times a second, plus your note speed and offset settings.
If an upload fails (for example, you're offline), the replay is kept on your headset and sent the next time you sign in.
Who can see it: your public score is your highest score on a song. It appears on the leaderboards with your username, and its replay can be watched by anyone, on the Satellite website or in the game. Your other scores and replays stay private to you.
4. Multiplayer
When you create or join a multiplayer room, AiRhythm connects to our room server and shares with the other players in that room:
- Your Satellite user ID and username, whether you're ready, and the song you picked.
- Your live score, accuracy and chain while you play, and your final result.
- Your head position and rotation and your hand positions, including a simplified outline of your fingers when you use hand tracking, about 10 times a second, so others can see your avatar move.
Movement data is relayed in real time and never stored. The server keeps room information, such as who is in the room and the results, only while it's needed, and deletes it as soon as it isn't.
To keep rooms friendly, AiRhythm checks other players' hand shapes on your own headset and blurs offensive gestures. This happens locally and nothing about it is recorded.
5. Hand tracking and movement data
AiRhythm uses Meta Quest hand tracking and controller tracking to let you play. This tracking is processed on your headset. Movement data only leaves your device in the two ways described above: in replays when you're signed in, and live in multiplayer rooms.
We use movement data only to show your replays and your avatar and to run the game. We don't use it to identify you, build a profile of you, or for advertising, and we don't sell it or share it with anyone except as described in this policy.
6. Security and reliability data
When you use Satellite (including through AiRhythm), we record your IP address, your Satellite account ID if you're signed in, and general traffic data, such as how much you download. We use this only for security: to spot abuse and keep the services reliable and usable for everyone. We don't use it for marketing or build profiles from it. Cloudflare keeps these records for one month, and our own management system keeps them for two weeks.
How we use information, and why
- To provide the game's online features you ask for: accounts, leaderboards, replays, community charts and multiplayer. This is needed to provide the service you signed up for.
- To keep the services fair, secure and reliable, for example verifying scores against the chart, and investigating cheating, abuse or unusual traffic. This is in our and our players' legitimate interests.
- To fix problems and improve AiRhythm, in our legitimate interests.
- To comply with the law, where we're legally required to.
We provide AiRhythm in the European Economic Area and the United Kingdom, and we hold ourselves to the GDPR and UK GDPR for all players. Our legal bases are performance of a contract (providing the services you ask for), legitimate interests (security, fairness and improvement), and legal obligation. Questions about the GDPR, such as how long we keep data, can be sent to scarylegalemail@creativecrew.xyz.
Who helps us run the services
We share information only:
- with other players, as described above (leaderboards, public replays, multiplayer rooms);
- with the providers that run our infrastructure:
- Google hosts Satellite and AiRhythm's online services, including charts, scores, accounts and replays;
- Cloudflare protects Satellite's network and security;
- when required by law, or to protect the rights and safety of our players and our services.
Meta provides the Quest platform and store, and handles information under its own privacy policy.
Where your information is stored
Your information is stored and processed in the United States (Oregon). If you live elsewhere, including Australia, the EU or the UK, your information is transferred there so we can provide the services. Wherever it's processed, your information is encrypted, and our services only ever send you data you're meant to see: public things like leaderboards and public replays, never other players' private details.
Keeping and deleting your information
We keep your account, scores and replays for as long as your Satellite account is active. You can delete your account from inside Satellite at any time. Once you do, your account data, scores and replays are removed from our live systems, and copies in our backups are held for up to 7 days before they are wiped too. Data on your headset is removed when you uninstall AiRhythm.
Your rights
Depending on where you live, you may have the right to access, correct, delete or export your information, or to object to how we use it.
To make a data request or ask for deletion, start at satellitedx.space. The site creates a private key that proves the request is from you, adds it to an email, and opens your mail app with that email ready to send. Please use this route for access and deletion requests, so we can confirm the request really comes from the account holder. You can also delete your account from inside Satellite at any time. Other GDPR questions can go to scarylegalemail@creativecrew.xyz.
If you're unhappy with how we've handled your information, please contact us first. In Australia you can also complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. If you're in the EU or UK, you can complain to your local data protection authority.
Age requirements
AiRhythm is not directed at children under 13. Playing AiRhythm requires a Meta account that isn't parent-managed, and Meta requires everyone with such an account to be at least 13. We don't knowingly collect information from children under 13. If you believe a child has given us information, contact us and we'll delete it.
CreativeCrew also runs community spaces on third-party platforms, including Instagram, Discord and YouTube. Those spaces are run under each platform's own terms, privacy policy and age rules, including Australia's Social Media Minimum Age requirements where they apply to that platform. We have assessed Satellite against the Social Media Minimum Age rules using the eSafety Commissioner's self-assessment, and it is not an age-restricted social media platform.
Security
Your information is encrypted, passwords are stored hashed, our services never send you another player's private details, and access to our systems is restricted. No service is perfectly secure, but we work to protect your information.
Changes to this policy
If we make important changes, we'll update the date above and let you know in the app or on this page.
Contact
CreativeCrew, Australia · privacy@creativecrew.xyz · scarylegalemail@creativecrew.xyz