VR Eddie ("vreddie.com", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data when you use our website and services.
Privacy Request Workflow
For access, correction, deletion, portability, or consent withdrawal requests, use our privacy request form or email hello@vreddie.com. We review each request manually and may ask you to verify your identity before taking action.
2. Information We Collect
Information You Provide
Email address — when you subscribe to our newsletter or create an account
Account information — name and profile details if you register for a VR Eddie account
Quiz responses — answers you provide in our headset recommendation quiz (not stored after generating results)
Payment information — processed securely by Stripe if you subscribe to a paid membership or place a merch order (we never see or store your full card number)
Merch checkout and fulfillment details — if you buy physical merchandise, Stripe Checkout collects your customer email, shipping name/address, and, for some Shapeways orders, a phone number required for fulfillment. We store the order details needed to manage the purchase, including customer name/email, shipping address, items, quantities, sizes, order status, supplier references, tracking details, and internal order notes
Support requests — messages you send through our merch support, return, refund, or tracking workflows, plus the related resolution, refund reference, and delivery status for support emails
Deal alert push notifications— if you turn on deal alerts and grant your browser's notification permission, your browser creates a push subscription and we store it so we can send those alerts. That subscription is an address your browser issues for this site, plus two keys used to encrypt the messages. Creating it means your browser contacts its own push service — Google's for Chrome, Mozilla's for Firefox, Apple's for Safari — which we do not choose and cannot see into. Turning deal alerts off deletes the subscription from our database
Voice input — if you speak to Eddie instead of typing, the audio you record is sent to OpenAI to be transcribed, along with the language hint and a session identifier for that conversation. This happens only for a recording you deliberately start
Ask Eddie messages — the message you choose to send, bounded page context, the active model route, the returned answer, and a bounded grounding query when current information is needed. A safe My VR Setup projection is included only when you separately allow both setup use and Ask Eddie model processing
Information Collected Automatically
This list is maintained from an inventory of every mechanism on the site that can transmit data, not from a list of the tracking tools we expect to find. If something below is missing, that is a defect in the inventory and we want to hear about it.
Page views — the page URL and route, the referring page, approximate location (country, region, city), operating system, browser, and device type, sent to Vercel Analytics on each page view. No cookie is set; a visitor is identified by a hash derived from the incoming request, and that session identity is discarded after 24 hours. Switchable off in section 6
Page performance — the route and URL, network speed, browser, device, country, and Web Vitals measurements, sent to Vercel Speed Insights on each page load. Also cookieless, and switchable off by the same control
Affiliate link clicks— when you click a link to a retailer we record which product, product type, retailer, on-page placement, the page you clicked from, the destination link, and the time. That record holds no identifier for you, so clicks cannot be joined together into one visitor's trail. Being accurate about the rest: the click is sent to us as an ordinary web request, so your browser attaches its user-agent and the address of the page you clicked from, exactly as it does for every page you load, together with any cookies already set for this site — including your session cookie if you are signed in. We do not read or store any of it, and none of it is part of the record, but it does reach our server and may appear briefly in our hosting provider's request logs
Product usage events — an allowlisted event name and sanitized properties, never a user id, email, IP address, or free text. This is not active on the live site; it is enabled only on internal preview deployments, where it also respects your browser's Do Not Track and Global Privacy Control signals
Crash and error reports— when error monitoring is enabled for a deployment, page errors are reported to Sentry, our error-monitoring provider, along with a 10% sample of navigation performance traces. Error reports, performance traces and spans are all stripped in your browser before they are sent, and the filter is deliberately aggressive: the error message is replaced, and the stack trace, the browser and device context, request headers, cookies, tags and any user fields are removed outright. What remains is essentially the error type, the page path with query string and credentials stripped, and the report's own metadata. Separately, when error monitoring is enabled, the same tool sends a short session ping on page load and on navigation — a random session identifier, timestamps, and whether any error occurred — which is how it measures release health. That ping does not pass through the filter described above, because it carries no error content to filter. This is diagnostic rather than commercial: it is not linked to a marketing profile and is not shared with any advertising network
Device information — browser type, operating system, and device type
IP address — visible to our hosting provider and to any service your browser contacts, as it is to every website; used for approximate geographic location and security purposes
Cookies — by default, essential cookies only, for site functionality (authentication, session management) and to remember your cookie choice. We set no advertising cookies at all, and no analytics cookies: our page measurement is cookieless, and the interface-experiment cookies described in section 6 are no longer issued.
3. How We Use Your Information
We use the information we collect to:
Deliver and improve the VR Eddie platform and its features
Send our weekly newsletter with VR news, deals, and recommendations (only if you subscribe)
Process membership payments and manage your account
Process merch purchases, send order confirmations and shipping updates, and submit fulfillment requests to our merch suppliers
Review and resolve merch support, return, refund, damage, and wrong-item requests
Personalize your experience, such as headset recommendations
Answer Ask Eddie questions through the active external model route, ground changing claims with bounded search, and show a processing receipt for the provider and model that actually ran
Analyze site usage to improve content and user experience
Prevent abuse and maintain security
Comply with legal obligations
4. How We Share Your Information
We do not sell your personal information. We may share information with:
Service providers — Vercel (hosting), Resend and Loops (email delivery), Stripe (payments), Sanity (content management), Neon (database), Anthropic and OpenAI (AI features, including speech-to-text for voice input), Google Gemini and Google Search (model answers and grounding when that route is active), and OpenRouter with its selected model endpoint and Exa search (model answers and grounding when that route is active) — only to the extent necessary to provide the requested service
Merch fulfillment providers — if you place a merch order, we share the customer, shipping, and order details required to fulfill it with Printful or Shapeways. For Shapeways-managed orders, that can include a phone number collected during checkout when their workflow requires it
Analytics provider— Vercel, our hosting provider, receives page-view and page-performance data as a first-party processor. No cookie is set and no identifier is shared with any advertising network. This stops entirely if you choose “essential only” in section 6.
Error monitoring — Sentry receives the crash and performance reports described in section 2 when error monitoring is enabled for a deployment
Google Drive — if you connect Drive for Eddie Spaces, your browser talks to Google directly under the drive.file scope, which reaches only the files you pick. You can revoke that access at any time in your Google account
Embedded content providers— some pages load images and video players hosted elsewhere. Your browser fetches that content directly, which means the operator receives your IP address, browser user-agent, and the page you are viewing, even though we send them nothing about you ourselves. This applies to Sanity (article and product images), Steam's content delivery networks and store (game and store artwork), and YouTube for video thumbnails. Our API documentation page loads Swagger UI's stylesheet and JavaScript from jsDelivr; no other page does. We also permit YouTube's player and no-cookie player domains so a video can be embedded, though no page currently embeds one. Each provider has its own privacy policy. No advertising or ad-measurement provider is on this list, and none is permitted to load
Legal requirements — when required by law, court order, or governmental authority
5. AI, Search & Third-Party Services
Ask Eddie is an external-processing feature. Before a website message is sent, the interface identifies the current disclosure and explains that the message and bounded page context must leave VR Eddie to be answered. The server rejects requests that do not carry that exact current disclosure version.
The active Core route may use Google Gemini with Google Search, or OpenRouter to reach the exact model selected by VR Eddie. The answer receipt identifies the route that actually ran
OpenRouter requests are configured to require a zero-data- retention route. If an eligible route is unavailable, VR Eddie fails closed instead of silently removing that requirement
When the OpenRouter route grounds an answer, one bounded query may be sent to Exa. The direct Gemini route uses Google Search grounding. Returned public sources are shown with the answer
Private Session blocks My VR Setup projection and conversation retention. It does not prevent the provider processing required to answer the message you send
Signed-in riders can separately allow or withdraw the safe My VR Setup projection in the Eddie Consent Center. Unknown, stale, unavailable, or withdrawn consent remains off
VR Eddie does not place messages, profile facts, private conversations, provider keys, or Drive identifiers in product analytics. Do not include secrets or information you do not want an active model or search provider to process.
Account and storage integrations
VR Eddie currently supports Google OAuth sign-in and local email/password authentication for account access. We do not currently offer X/Twitter sign-in or other social account integrations for authentication. If you choose Google sign-in:
We request the minimum account information needed to create or link your VR Eddie account
We do not post to your Google account or other third-party accounts on your behalf
You can revoke Google access at any time through your Google account settings
Google has its own privacy policy and account controls, which we encourage you to review. If we add additional third-party sign-in providers or social integrations in the future, we will update this policy before rolling them out.
6. Cookies & Tracking
We do not serve advertising, we use no advertising cookies or ad-measurement scripts, and we do not use Google Analytics. The only cookies set by default are the essential ones. Our page and performance measurement is cookieless and first-party, so there is no consent banner to dismiss — but you can still switch that measurement off below, and the choice is remembered. Error monitoring, described in section 2, is separate: it is diagnostic, sets no cookie, and is not covered by the control below.
Essential cookies — required for site functionality (authentication, session management)
Cookieless first-party analytics— Vercel Analytics counts page views and Vercel Speed Insights samples page-performance metrics. Neither sets a cookie. Visitors are identified by a hash derived from the incoming request, and that session identity is discarded after 24 hours. Speed Insights stores nothing that can reconstruct a browsing session across pages. Both run by default and both stop if you choose “essential only” below.
No Google Analytics — removed on 2026-08-03. No Google tag, no _ga cookies, and no Google analytics or tag-manager origin is permitted by our Content-Security-Policy.
Affiliate link counting — clicking a retailer link records the product and placement described in section 2. It sets no cookie and stores nothing that identifies you, so it is not switched by the control below
Interface experiments— we no longer run any. The four experiments that used to set a variant cookie were removed on 4 August 2026, so no experiment cookie is written at all. If you still have one from before that date it does nothing. Choosing “essential only” below deletes the ones a web page is able to reach; a cookie stored under a different path cannot be removed from the page — browsers do not let a script see which path a cookie belongs to — so that one simply expires on its own within 90 days of being set.
No advertising cookies — the site serves no ads and loads no advertising or ad-measurement scripts
Use the control below to turn first-party analytics off or back on at any time; your choice is stored in a single essential cookie so we can honour it on later visits. Choosing “essential only” takes effect immediately and without a page reload: your choice is applied inside the measurement code itself, which then discards each measurement before it is sent, rather than relying on a script being taken off the page. Disabling essential cookies through your browser may affect site functionality.
Cookie preference
Default: cookieless first-party analytics is on; no optional cookies are set.
Takes effect immediately, without reloading the page, and in every tab you have open. “Essential only” makes our cookieless first-party analytics discard each measurement before it is sent, and clears any leftover experiment cookie; “Allow analytics” turns that measurement back on. We no longer run interface experiments, so nothing here sets an experiment cookie.
7. Data Retention
We retain your personal information for as long as your account is active or as needed to provide services. Newsletter subscriber information is retained until you unsubscribe. Merch order records, fulfillment status and tracking data, internal order notes, and support ticket history are retained for as long as needed to provide order history, customer support, refunds and returns, fraud prevention, and legal/accounting compliance. You may request deletion of your data at any time through our privacy request workflow or by emailing hello@vreddie.com.
Specific periods, where there is one to give:
Experiment cookies— no longer issued. Any remaining one expires within 90 days of when it was set, and choosing “essential only” deletes those a page can reach straight away
Your cookie choice — stored for 180 days, so we can honour it on later visits
Push subscriptions — kept until you turn deal alerts off or the push service reports the subscription as expired, at which point the record is deleted
Page-view and performance measurements — held by Vercel under their retention schedule; the session identity used to group a visit is discarded after 24 hours
Crash and error reports — held by Sentry under the retention configured for that project
Affiliate click records — retained as aggregate placement counts with no expiry set today; see the note below about records created before 3 August 2026
Affiliate click records collected before 3 August 2026
Until 3 August 2026, the affiliate click record described in section 2 also stored the browser user-agent string and the referring page. We stopped storing both on that date. Records created before then still contain those two fields and have not been deleted; what to do with them is under review, and this section will be updated when that is settled. If you would like the records associated with your clicks removed, ask through the privacy request workflow above and we will handle it as a deletion request.
8. Your Rights
Depending on your jurisdiction, you may have the right to:
Access the personal data we hold about you
Request correction of inaccurate data
Request deletion of your data
Object to or restrict processing of your data
Request data portability
Withdraw consent at any time
Unsubscribe from marketing communications via the link in any email
To exercise any of these rights, submit a request through our privacy request form or email hello@vreddie.com. Marketing email opt-outs remain available through the unsubscribe link in each email, and you can withdraw consent to non-essential cookies at any time through the controls above.
9. Data Security
We implement industry-standard security measures to protect your personal information, including encryption in transit (HTTPS), secure hosting on Vercel's infrastructure, and token-based authentication. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.
10. Children's Privacy
VR Eddie is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us and we will promptly delete it.
11. International Data Transfers
Your information may be transferred to and processed in the United States, where our servers are located. By using the Site, you consent to the transfer of your information to the United States.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via the Site or email. The "Last updated" date at the top of this page indicates when the policy was last revised.
13. Contact Us
If you have questions or concerns about this Privacy Policy or our data practices, please contact us at the email below. For formal data-rights requests, use the privacy request form first so we can route and verify the request correctly.