Privacy
Privacy Policy
ČeštinaApplies to the EduVR app for Meta Quest (com.NEKR_VR.EduVR) distributed through the Meta Horizon Store, and to this website.
Who processes your data
The EduVR app (bundle identifier com.NEKR_VR.EduVR) is developed and operated by NEKRVR. For school sign-in data (school name, UserID, API key) we act as the data controller. Vocational training telemetry is processed on behalf of the school and on its instructions — the school decides who uses the headset and how the results are used.
Privacy contact: info@eduvr.cz. Use the same address for deletion, correction, or data access requests.
What the app sends
The app sends nothing until a school signs in on the headset. Once signed in with the colour pairing code, we send the following to new.eduvr.cz:
- School name — identifies the school that owns the licence and the results.
- UserID — the numeric school account id returned by sign-in.
- API key — the auth token stored on the headset and sent in the APIkey header.
- Training telemetry to /api/data — session start and end, time spent per module (moduleID, timeSpent), level progress (level number, Completed / Failed / Abandoned state, timings), and completed tasks.
- Competition scores to /api/competitionSubmit — competition id, finish time, completion, start and finish dates, and points.
- App version to /api/updates — so we can return the correct changelog and update notice.
The app does not use Meta account sign-in and does not know a pupil’s name or Meta user id. Data is tied to a school and to a specific headset, never to a named pupil.
What this build does not collect
The following features are switched off in the Meta Horizon Store build, so no data leaves the headset through them:
- No microphone and no voice recording — the microphone is disabled in this build.
- No Gemini or other Google AI — no AI prompts or responses are sent.
- No connectivity probe against Google servers.
- No live I2 Localization translation sync through Google Apps Script.
- No log upload to third parties.
- Sandblasting and painting creations stay on the headset and are never uploaded.
- No advertising IDs and no Meta Platform SDK user id.
The only host the app contacts at runtime is new.eduvr.cz.
Where the data goes
Every call goes to https://new.eduvr.cz. Authenticated requests are verified with the APIkey header.
| Endpoint | Header | Purpose |
|---|---|---|
| POST /api/colors | colors | colour-code sign-in |
| POST /api/confirm | user, colors | confirm school, issue API key |
| GET /api/modules | APIkey | licensed module list |
| GET /api/getRotation | — | free rotating module |
| GET /api/getAttemptsCount | APIkey | remaining competition attempts |
| GET /api/updates | APIkey, version | app version and changelog |
| POST /api/checkkey | APIkey | verify the sign-in is still valid |
| POST /api/data | APIkey | session, module, level, and task telemetry |
| POST /api/competitionSubmit | APIkey | submit a competition result |
| GET /api/getcolors | — | sign-in screen colours |
| POST /api/deleteData | APIkey | erase this headset’s data |
| HEAD https://new.eduvr.cz | — | connectivity check |
Purpose and legal basis
We process this data to operate school sign-in, unlock the modules the school has licensed, record vocational training progress for the school, and run optional competitions.
The legal basis is performance of our contract with the school under Article 6(1)(b) GDPR, and our legitimate interest in operating, securing, and protecting the service from abuse under Article 6(1)(f) GDPR. We do not use the data for profiling or automated decision-making.
How long we keep it
- Training telemetry and competition scores are kept for the duration of the school’s licence agreement. After it ends we delete or anonymise them within 12 months at the latest.
- Headset sign-in data (the API key and its binding to a school) is deleted as soon as the headset is unpaired or the user runs Delete my data.
- After deletion we keep only an irreversible checksum of the erased API key. It lets us show the request was honoured and lets a repeated call succeed instead of erroring. It contains no school name, no UserID, and no training data.
This website (outside the app)
The new.eduvr.cz website uses PostHog analytics so we can see which pages schools are interested in. Measurement starts only after you consent in the cookie banner, and you can decline it. This applies to the website only — the Meta Quest app contains no analytics.
If you send us an enquiry through the website, we process the contact details you provide in order to reply to the school.
Children and age rating
EduVR is not intended for children under 13 and is not intended for elementary schools. It is built for secondary and vocational technical schools, meaning ages 13 and over; it is listed in the Meta Horizon Store as Teens and Adults (13+). It is used under teacher supervision. We do not knowingly collect data from children under 13.
Your rights and deleting your data
You have the right to access, correct, erase, restrict, and port your data, and the right to object. You can lodge a complaint with the Czech Data Protection Authority (uoou.cz) or your local supervisory authority.
- On the headset: after signing in, open the Account section and choose Delete my data. The app calls POST /api/deleteData and the server erases this headset’s training telemetry, screenshots, and sign-in records. The headset always signs out and wipes its local data, even if the server is unreachable.
- Competition scores are stored per school rather than per headset. In-app deletion deliberately leaves them alone so that one device cannot erase everyone else’s results. Email info@eduvr.cz to have them removed.
- By email: if you no longer have the headset, write to info@eduvr.cz. We respond within 30 days at the latest.
Changes to this policy
We publish material changes at this address and update the effective date above. It is worth checking back when the app receives a larger update.