Skip to main content

Privacy and Data considerations

In a nutshell:

  • We do not store your email and password.
  • If you check the "Stay logged in" checkbox, we store your session cookies and tokens in an encrypted file in %APPDATA%/XYVR/.DO_NOT_SHARE__session-cookies.encrypted
  • We store your user ID and real username in %APPDATA%/XYVR/connectors.json
  • We store your address book in %APPDATA%/XYVR/individuals.json
  • We store non-login API requests and responses in %APPDATA%/XYVR/response-collection.jsonl

HTTP requests and live updates:

  • Requests to the VRChat API are done using the url https://api.vrchat.cloud/api/1 at the rate of one request per second on average.
    • We also use the websocket URL: wss://pipeline.vrchat.cloud/
  • Requests to the Resonite API are done using the url https://api.resonite.com/ at the rate of two requests per second on average, and communication with the SignalR protocol for live updates (https://wiki.resonite.com/API#SignalR).
  • There are no requests to any other external services.
    • There is no telemetry, analytics, or tracking of any kind.

Application startup​

When you start the XYVR application, it will do the following:

  • Create a Windows Registry key at HKEY_CURRENT_USER\SOFTWARE\XYVR\SessionDataEncryptionKey that contains an encryption key, if it does not exist already.
  • Create the %APPDATA%/XYVR/ folder.
  • Load user preferences from %APPDATA%/XYVR/ui-preferences.json (dark mode, etc.)

Application exit​

When you exit the XYVR application, it will do the following:

  • Save user preferences in %APPDATA%/XYVR/ui-preferences.json (dark mode, etc.)
  • Save %APPDATA%/XYVR/individuals.json

VRChat login​

Requests to the VRChat API are done using the url https://api.vrchat.cloud/api/1

When you connect to your VRChat account using the XYVR application, it will do the following:

note

The encryption key is stored in the Windows Registry separately from the session cookie file so that if you store or backup your personal data files, the registry key containing the encryption key will not be included.

Resonite login​

Requests to the Resonite API are done using the url https://api.resonite.com/

When you connect to your Resonite account using the XYVR application, it will do the following:

  • Create a Resonite UID and store it in %APPDATA%/XYVR/resonite.uid if it does not exist already.
  • Send an HTTPS request to log in to your Resonite account (https://wiki.resonite.com/API#Creating_a_token) using your username and password with this UID.
  • Upon successful login:
    • The application forgets your typed username and password.
    • If the "Stay logged in" checkbox is checked:
      • Store the session token into an encrypted file in %APPDATA%/XYVR/.DO_NOT_SHARE__session-cookies.encrypted
    • Store your user-id and real username in %APPDATA%/XYVR/connectors.json
    • Send a request to get your user (https://wiki.resonite.com/API#GET_/users/{userId}).
    • Store that user in %APPDATA%/XYVR/individuals.json
note

The encryption key is stored in the Windows Registry separately from the session cookie file so that if you store or backup your personal data files, the registry key containing the encryption key will not be included.

Data collection​

When you request a data collection, it will do the following:

  • Make use of the session cookies or tokens stored in memory during the execution of the application (for when "Stay logged in" was not checked), and the session cookies and tokens stored in the %APPDATA%/XYVR/.DO_NOT_SHARE__session-cookies.encrypted file for the following requests.
  • Perform various requests to the VRChat API at the rate of one request per second on average:
  • Perform various requests to the Resonite API at the rate of two requests per second on average:
  • Write the address book data into %APPDATA%/XYVR/individuals.json.
  • Write request and response data into %APPDATA%/XYVR/response-collection.jsonl.
  • Write a world cache in %APPDATA%/XYVR/.cache_world-names.json so that we don't make repetitive requests to the VRChat API when the app restarts.

Live updates​

Live updates with the Resonite API are done using the url https://api.resonite.com/hub using the SignalR protocol (https://wiki.resonite.com/API#SignalR).

Live updates with the VRChat API are done using the url wss://pipeline.vrchat.cloud/ using the WebSocket protocol (https://vrchat.community/websocket).

UI interaction​

When you click on a link:

  • The application will open the link in your default browser, only if the link starts with https:// or http://.
  • Any link that does not start with https:// or http:// is rejected from being opened.