Privacy, without the fog.
PHOTONKATANA can be played without creating an account. Core game progress and settings are stored on your device. Technical server logs are processed to deliver and protect the service. Account login, global leaderboard submissions, feedback and benchmark uploads are optional online features.
Who is responsible?
Outerfar Studios, sole proprietorship of Christopher Prokop, Reutte, Tyrol, Austria, is responsible for the processing described in this policy.
c.prokop@outerfar.com
Please include enough information to identify the relevant account, nickname or benchmark report ID. Do not send passwords or Google credentials.
What data is handled?
Technical access and security data
When the website, WebXR game or app-hosted web content is requested, the hosting infrastructure may process the IP address, request time, requested URL, response status, referrer, browser or user-agent information and device category. The IP address is also used temporarily in memory for abuse prevention and rate limiting.
Rejected implausible leaderboard submissions may be recorded with IP address, internal account ID, submitted score and distance, and rejection reason for up to 90 days to investigate manipulation and protect the public leaderboard.
Local game and device data
PHOTONKATANA stores game preferences and progress locally on the device using browser storage such as LocalStorage and, where required for offline assets, browser cache storage. This may include:
- settings, selected language, audio, haptics, comfort, quality and HUD preferences;
- local scores, best distance, unlocks, loadout, Photon Shards and tutorial progress;
- a randomly generated local Runner ID and locally remembered rank information;
- posture, safety calibration and device-performance preferences;
- offline application assets and service-worker cache status.
Head, controller and hand pose data supplied by Meta Horizon OS or the browser are processed in real time on the device for gameplay and safety calibration. Outerfar Studios does not upload raw tracking poses, raw camera images or microphone recordings.
The Outerfar Studios website stores functional language and display preferences locally, including session-only intro or notice dismissals. It reads public leaderboard, feedback and benchmark summaries; these read requests create only the ordinary technical connection data described above.
Optional Google account and leaderboard data
If you choose Google sign-in, the server stores a pseudonymous Google account identifier (sub), your chosen public nickname, account creation and last-login timestamps, tester tier where applicable, and a technically necessary Secure, HttpOnly, SameSite session cookie with a lifetime of up to 30 days. The server does not store your Google email address, profile image or real name. Leaderboard entries contain the public nickname, score, distance and timestamp.
Optional alpha feedback
If you submit the in-game feedback form, the selected category ratings, optional free-text comment, displayed nickname or “anonymous” label, account reference when signed in, app version and submission time are stored. Public feedback views expose only aggregated ratings and anonymised excerpts, not account identifiers or IP addresses.
Optional benchmark reports
A benchmark report is uploaded only after a separate confirmation. It can include benchmark measurements, app version and time, detected device class, browser and operating-system information, GPU description, XR framebuffer size, refresh rate, and—where exposed by the browser—logical CPU cores and memory. A compressed WebP image of the result screen may also be included. The report does not include your name, email address, account ID, login cookie or complete user-agent string.
No tracking banner is needed.
Outerfar.com does not set advertising, analytics or cross-site tracking cookies and does not load third-party embeds. It uses only first-party functional storage required to provide a language choice and to remember interface actions within the current browser session. No consent banner is shown because there is no optional tracking to accept.
| Entry | Technology | Purpose | Lifetime |
|---|---|---|---|
| outerfar_lang | LocalStorage | Remembers the language only after the visitor actively changes it. | Until browser storage is cleared |
| outerfar_intro_seen | SessionStorage | Prevents the studio intro from blocking the page repeatedly in one tab session. | Current tab session |
| outerfar_store_rail_dismissed | SessionStorage | Remembers that the visitor closed a store notice. | Current tab session |
| Static asset cache | Browser HTTP cache | Stores self-hosted fonts, images, audio, video and code for reliable and efficient delivery. | According to cache headers; generally up to 30 days, fonts up to 365 days |
These entries contain no account identifier and are not combined into a visitor profile. They are used under the technically necessary exception in section 165(3) of the Austrian Telecommunications Act 2021. Visitors can remove them at any time through their browser's site-data controls.
PHOTONKATANA is separate: the game uses local device storage for settings and progress. A Secure, HttpOnly, SameSite session cookie is created only if the optional Google account login is requested, and lasts for up to 30 days. Details are listed in the data inventory above.
Why is the data used?
- Service delivery: load the game, website, audio and visual assets and maintain offline functionality.
- Operational security: detect abuse, rate-limit requests, investigate failures and keep the service reliable.
- Local continuity: remember settings, accessibility choices, progress, calibration and unlocks on the device.
- Requested online features: authenticate an optional account, publish leaderboard results and return account exports.
- Product improvement: evaluate voluntary ratings and diagnose device compatibility or performance using voluntarily submitted benchmark reports.
Delivery, technical logs, public-data requests and abuse prevention are based on Article 6(1)(f) GDPR (our legitimate interest in a secure, reliable and informative service). Requested account, login and leaderboard functions are processed under Article 6(1)(b) GDPR. Voluntary feedback and benchmark uploads are processed under Article 6(1)(a) GDPR where the interface asks for consent. Consent can be withdrawn without affecting processing already carried out lawfully. Where an optional function is not used, its associated data is not submitted.
Third-party services and recipients
Hosting
The game and related online services are hosted on infrastructure operated by Hetzner in Germany. Hosting infrastructure processes connection data required to deliver and protect the service.
Google Identity Services
Google Identity Services is loaded only when the optional Google sign-in flow is started after consent. Google Ireland Limited processes data under its own Privacy Policy. Google may process information outside the EEA and states that it relies on applicable adequacy decisions, including the EU–US Data Privacy Framework for certified US recipients, and on Standard Contractual Clauses where required. Its current safeguards are described in Google's data-transfer framework.
Meta platform
When PHOTONKATANA is obtained or launched through Meta Horizon, Meta processes store, account, device and entitlement information as an independent controller under Meta's own policies. Outerfar Studios does not receive your Meta password, payment data or raw headset camera feed.
PHOTONKATANA does not integrate third-party advertising networks, cross-site analytics, behavioural profiling or data brokers.
How long is data retained?
- Technical server logs: no longer than 14 days under the current server configuration, unless a security incident requires limited further retention.
- Rejected implausible scores: security records may be retained for up to 90 days to protect leaderboard integrity.
- Local device data: until you reset progress, clear the app/browser storage or uninstall the application.
- Account and leaderboard data: while the account exists. On account deletion, the account is removed and associated leaderboard entries are anonymised as “ANON”.
- Feedback: the service currently retains at most the latest 5,000 submissions and has no shorter automatic time limit. Identifiable feedback can be deleted on request; rolling backup copies expire after no more than 14 days.
- Benchmark reports and images: automatically deleted after no more than 30 days. Aggregated, non-identifying statistics may remain.
- Daily service backups: retained for no more than 14 days.
Your rights and controls
Subject to applicable law, you may request access to, correction of, export of, restriction of or deletion of personal data, object to processing based on legitimate interests, and withdraw consent.
- Signed-in users can export their stored account data and delete their account from within PHOTONKATANA.
- Local game data can be removed through the in-game reset function or the device's app/browser storage controls.
- Voluntary benchmark uploads can be deleted early using the locally stored deletion credential on the benchmark report management page.
- For any access or deletion request, email c.prokop@outerfar.com.
Required data and automated checks
Technical connection data is generated automatically and is necessary to transmit and secure the requested website or game content; without it the service cannot be delivered. Account, nickname, leaderboard, feedback and benchmark information is not required by law. If the relevant optional data is not provided, only that requested online feature remains unavailable.
Outerfar Studios does not use profiling or automated decision-making that produces legal or similarly significant effects within Article 22 GDPR. Automated plausibility checks can reject an implausible score or distance from publication on the public leaderboard. The check compares submitted gameplay values with technical game limits; its only consequence is that the entry is not published. A review can be requested through the privacy contact above.
You also have the right to lodge a complaint with a competent data-protection authority, including the Austrian Data Protection Authority.
Meta Horizon Store app
When distributed through the Meta Horizon Store, the app is a packaged delivery of the same hosted web application, so the web and server practices described above apply. The current PHOTONKATANA build does not use Meta Platform profile, entitlement or in-app-purchase APIs and Outerfar Studios currently receives no Meta platform profile data. Meta independently processes store account, installation, purchase, device and diagnostic data under its own policies. This policy and the Meta dashboard declarations will be updated before any Meta Platform data API is enabled.
Changes to this policy
We may update this policy when features, service providers or legal requirements change. The effective date at the top of this page identifies the current version. Material changes will be communicated through the website or application where appropriate.
Last updated: 11 August 2026 · Policy version 1.1