Privacy Policy

1. Scope and controller

This policy explains how Xavana ApS ("Xavana", "we", "us" or "our") handles personal information when you use the Virtual Comic Reader application ("VCR" or the "App"), visit this website, or contact us. Mandatory local privacy law applies where it gives you additional rights.

Xavana ApS is the data controller for the limited processing that Xavana determines:

2. Privacy at a glance

• No Xavana account is required to use VCR.
• Xavana does not sell or rent personal information.
• VCR contains no Xavana-operated advertising, behavioural tracking, analytics or remote crash reporting.
• Your publications, cover images, library catalogue, settings and reading progress remain in the App's private storage unless you deliberately connect or transfer from an external source.
• VCR can transfer publications to your headset, but it does not send your publications or reading and listening activity to Xavana-operated servers.
• The website does not set cookies, use browser storage, run analytics or contain a contact form.

3. Information handled by the App

Publications and library information

Publications include comics, magazines, books, audiobooks and music used with VCR.

To provide the reading and listening experience, VCR may process publication files, file and folder names, titles, file type and size, cover images, thumbnails, reading progress, bookmarks, page position, reading direction, tags, collections, shelf order and cache status. This information is stored in the App's private storage on your headset and is not sent to Xavana.

You are responsible for ensuring that you have the right to access and use the publications you add. VCR does not provide or circumvent digital rights management. Unsupported, encrypted or DRM-protected files may be rejected.

Settings and device capabilities

VCR stores local preferences needed to operate the App, such as display quality, selected environments, audio levels, interface placement, accessibility and interaction choices. It may read the headset model, supported refresh rates, controller availability and abstracted hand-tracking capabilities to provide compatible features. Xavana does not receive this information remotely.

Head, controller and hand interaction

Meta Horizon OS and OpenXR provide real-time position, orientation, controller input and abstracted hand-tracking data required to display and control the App. VCR processes this on the headset. It is not used to identify you, sent to Xavana, or used for advertising or profiling. Local positions and sizes of App windows or objects may be saved so that they can be restored.

4. Passthrough and spatial features

On supported Meta Quest headsets, VCR uses OpenXR passthrough capabilities and OpenGL rendering to show your surroundings behind App content. VCR does not copy, save, analyse or transmit passthrough camera images.

If you choose to place a poster in your physical space, VCR may request Meta Quest scene or spatial permission and use local persistent-anchor functionality. The App may store an anchor identifier, poster image, generated file name and placement information in private local storage. VCR does not use anchor sharing, colocation, Xavana cloud storage or remote spatial telemetry. You may decline the permission or remove saved posters.

Meta independently operates the headset, operating system, passthrough compositor, permissions and platform services under Meta's own terms and privacy notices.

5. Optional file sources and transfers

Local Wi-Fi transfer

When you deliberately start a transfer session, VCR temporarily makes a transfer page available to devices on the same local network and displays a time-limited address and pairing code. Files travel directly from your device to the headset and do not pass through a Xavana server. Use this feature only on a network you trust and keep the pairing code private.

SMB libraries

If you add a private-network SMB library, VCR processes the address, share, folder path, username and password you provide. Passwords remain in memory for the current App session and are not saved. Source configuration, remote metadata and cached content remain in private App storage. Removing a source removes its local configuration and cached copies but does not alter the original source files.

Caches and temporary files

Publications imported from an SMB library are copied to private local storage so they remain available for reading or listening without a network connection. Imported copies and caches remain until removed, evicted under the App's storage controls or deleted when the App is uninstalled. Thumbnails and catalogue metadata may remain until the publication or source is removed.

6. Meta platform, entitlement and purchases

Account and purchase information

When you use Meta purchasing features in VCR, the App uses Meta's Platform SDK to receive your app-scoped Meta User ID (an identifier for your account within this App), basic account/profile information made available by Meta, such as a username, and product, purchase and ownership information. VCR uses only the basic account/profile information needed to identify the signed-in account and associate it with Pro ownership. These data support access verification and restoration of purchased features across sessions, reinstalls and supported headsets when you use the same Meta account.

VCR does not download or display profile photos, use account/profile information for advertising or analytics, or share it with other users.

When offered through Meta purchasing, the Pro upgrade is a single permanent, durable (non-consumable) purchase, rather than a subscription or consumable item. Meta handles checkout, payment details, refunds and its account and purchase records under its own policies. Xavana does not receive complete payment-card details.

VCR does not transmit your Meta account identifiers or profile information, purchase-ownership cache, publications or reading and listening activity to Xavana. The App processes the necessary information on your headset or communicates directly with Meta's services for account and purchase features. Xavana operates no app-user backend or remote telemetry service. If you deliberately email vcr@xavana.com, Xavana receives your email address, message and any attachments for support or the other correspondence purposes described in section 7. Website hosting and logging are separately described there.

Local ownership cache

When verifying Pro ownership through Meta, VCR stores a limited ownership record, including the app-scoped Meta User ID and relevant product and verified ownership status, in private App storage on the headset. This record is associated with the correct Meta account to support subsequent launches and offline access without allowing a different account to inherit Pro. The cache does not replace Meta's purchase records. Access may require a fresh account or ownership check; a fixed offline grace period or permanent offline access is not guaranteed. Account and ownership processing takes place on the headset and through Meta platform services, without a separate Xavana account or Xavana-operated purchase server.

Purchases, refunds and platform records are administered by Meta. See Meta's Supplemental Meta Platforms Technologies Privacy Policy.

7. Website, cookies and email

Website

This website does not set cookies, use local browser storage, run analytics or advertising scripts, or collect information through forms. The hosting provider may process technical request information such as IP address, date and time, requested page, browser information, referrer and security events to deliver and protect the site. Any logs controlled by Xavana are used only for delivery, security and fault diagnosis and kept only as long as needed for those purposes or legal obligations.

Email and support

If you email us, we process your address, message, attachments and correspondence to respond, provide support, handle the business relationship, investigate security issues and meet legal obligations. Email is provided by Nordicway ApS. Do not send passwords, access tokens, complete payment details or publication files unless we specifically request a safe diagnostic item.

Support email is ordinary correspondence only. Xavana does not maintain a CRM or customer database, create customer profiles, or extract messages into app-user records. Xavana has no app-user records to look up or export and cannot supply account or payment records held independently by Meta. This does not prevent you from contacting us about applicable privacy rights relating to correspondence or other information actually held by Xavana, as described in this policy.

Correspondence is kept only as long as needed to handle the matter and for accounting, legal compliance, security or the establishment or defence of legal claims.

8. Purposes and legal bases

Where the GDPR applies, we rely on:

• Contract: providing the App, verifying entitlement, restoring purchases and responding to service requests.
• Legitimate interests: securing and maintaining the App and website, preventing fraud or abuse, answering ordinary enquiries and establishing or defending legal claims.
• Consent: where we specifically ask for it. You may withdraw consent at any time.
• Legal obligation: retaining or disclosing limited information where applicable law requires it.

VCR does not make automated decisions producing legal or similarly significant effects.

9. Recipients and international transfers

The App communicates with Meta platform services, your SMB server and local-network devices only as needed for features you use. Xavana may disclose information to website and email providers, professional advisers or authorities where lawfully necessary.

Meta and hosting providers may process information outside Denmark or the European Economic Area. Their notices describe their processing and transfer safeguards. Where Xavana itself makes a restricted international transfer, it will use a lawful mechanism such as an adequacy decision or approved standard contractual clauses where required.

10. Retention and deletion

• Local publications, metadata, settings, progress, thumbnails, caches, poster images and anchor identifiers remain on the headset until removed through the App, cleared by operating-system storage controls, evicted under a cache limit or deleted when VCR is uninstalled.
• When you use the Meta purchasing features described in section 6, the app-scoped Meta User ID and cached product and ownership status remain in private App storage only while needed to associate and verify access for the correct account. The cache is refreshed or invalidated when account or ownership checks require it, and another account must not receive access from the previous account's record. Clearing the App's data or uninstalling VCR will remove these local records.
• Basic account/profile information used only to identify the current signed-in account is processed for that session; the persistent ownership cache is limited to the account identifier and relevant product and ownership information described above.
• SMB passwords are held in memory for the current App session. Any Meta platform access tokens used for purchasing features are likewise held in memory for the current App session and are not saved in the ownership cache.
• Local transfer sessions expire and do not use a Xavana file server.
• Website logs and emails follow the periods described in section 7.

To delete local publications and related information, use VCR's removal and cache controls or remove sources and posters. To remove all local App information, including any account identifiers and ownership cache associated with Meta purchasing, clear the App's data through available operating-system controls or uninstall it. VCR does not provide an in-App Meta account-deletion function.

Deleting local VCR data does not cancel a purchase or delete account, payment or purchase records independently retained by Meta under its own policies. When using Meta purchasing features, restoring Pro after local deletion or reinstallation requires verification with Meta using the purchasing account. Files or records independently held by your SMB server or email provider are also unaffected; use the relevant provider's controls for those copies.

To request deletion of information held by Xavana, email vcr@xavana.com. We may need to verify your request and may retain information where law permits or requires it.

11. Security

VCR uses safeguards designed to limit unauthorised access, including private App storage, session-only SMB passwords, read-only SMB access and no Xavana cloud relay for publication content. No system can guarantee absolute security. Keep your headset, accounts, local network, pairing codes and passwords secure and install updates when available.

12. Your privacy rights

Depending on where you live and the processing involved, you may have rights to information, access, correction, deletion, restriction, objection, data portability and withdrawal of consent. Legal conditions and exceptions may apply. Contact vcr@xavana.com. We normally respond within one month where the GDPR applies.

You may complain to the supervisory authority where you live or work. In Denmark:

13. Children

VCR is a general-audience reading and listening tool and is not directed to children under 13. Xavana does not knowingly collect personal information directly from children under 13. Meta account, parental-supervision, age-group and store rules may restrict the App or particular features. If you believe a child has provided information directly to Xavana, contact us so we can investigate and delete it where appropriate.

14. Changes and contact

We may update this policy when features, providers, laws or data practices change. The current version will be posted here with a revised effective date. Additional notice will be provided where required for a material change.

For privacy, deletion or security enquiries, email vcr@xavana.com or write to the controller address in section 1.