Privacy policy

Last updated 30 September 2026

There are no accounts, no cookies, no analytics and no ads. The server keeps what it needs in memory while a page is open and writes none of it to disk. This page explains the details.

Visiting this website

To send you a page, the server processes your IP address, the address you asked for, the time and the headers your browser sends. It keeps no access log of any of it.

Everything on the site comes from this server. There are no cookies, no tracking, no analytics and nothing loaded from anyone else, fonts included.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in delivering the site and keeping it secure.

Downloads and updates

While you download the app, the server holds your IP address in memory to limit how many downloads one address can run at once. It's dropped when the download ends.

The app checks for updates a few seconds after it starts and every six hours after that. The request carries your IP address and the app's version number and nothing else. It is not logged.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in keeping the service available and the app up to date.

If you share your avatar

When you start sharing, the app connects to the server and sends what your friends page shows:

• the page title, your links and the names you gave your controls and looks
• the current values of the controls you shared, and the design you picked
• only if you turn them on: your height range and height, your heart rate (current, lowest and highest), what's playing (title, artists, app, cover picture and position), the names you gave your shockers with what each may do and the most of it, and the names of your toys with what each may do, how strong, and where each of their sliders stands right now. Never your OpenShock token or OpenShock's own ids.

Real parameter names never leave your PC, and neither do your avatar's name or id unless you typed them into a title or label yourself.

The server holds all of this in memory only. Values, heart rate, music, height and where your toys' sliders stand are cleared as soon as the app disconnects. The rest is cleared when the last of your friends leaves the page. A restart of the server clears everything.

The server sees the IP address your app connects from. It's used to limit how many pages one address can run, is dropped when the app disconnects, and is never shown to anyone. The connection is encrypted from the app to the server itself, so nothing on the way can read it.

Your heart rate is health data. It's only sent while "Show on your friends page" is on for the heart rate monitor, and then everyone with your link can see it. Legal basis for that: your explicit consent, Art. 9(2)(a) and Art. 6(1)(a) GDPR. You can withdraw it at any time by turning the switch off, which clears it from the page at once.

That you use toys says something about your sex life, which the GDPR protects the same way. Their names, limits and where their sliders stand are only sent while "Let friends use them" is on for your toys, and then everyone with your link can see them. Legal basis for that: your explicit consent, Art. 9(2)(a) and Art. 6(1)(a) GDPR. You can withdraw it at any time by turning the switch off, which takes them off the page at once.

Legal basis for everything else: Art. 6(1)(b) GDPR, providing the service you asked for.

If you open a friends page

The server uses your IP address to limit how many connections and room code attempts one address can make. Connection counts are dropped when you leave; room code attempts are counted for up to ten minutes.

The page keeps three things in your browser's local storage:

• the page's design, so it opens in the right colours
• a pass, if you typed a room code, so you aren't asked again
• a random value, so you're counted once however many tabs you open

The random value never leaves your browser. The page sends a code made from it and the page's address, so the server can't tell that two pages were opened by the same browser. The first two are stored under the page's address, so your browser's storage shows which friends pages you opened. You can delete all of it in your browser's settings for this site.

Legal basis: § 25(2) No. 2 TDDDG, storage that is needed for the page you asked for, and Art. 6(1)(f) GDPR, our legitimate interest in running it fairly.

The person whose page it is sees what you press, under a name like "Viewer 3". They never see your IP address. Everyone on the page sees how many people are there, and nothing else about them.

Blocking

If the page's owner blocks you, the server turns your IP address (the whole address for IPv4, the first half for IPv6) into a one-way code, using a secret only the server holds. The owner's app keeps that code, not your address, for as long as the block lasts, from five minutes to permanently. Nobody can turn the code back into an address.

So that a block still works after you've left, the server keeps the same kind of code for the last 64 people who left each page, in memory, until the page closes. It never makes one from a private network address.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in letting people keep others away from their page.

Server logs

The server's log records starts, stops, errors and how many pages and connections are open. It doesn't record page addresses, and it doesn't record IP addresses, except those of anyone making too many attempts to publish a release. The log is limited to three files of 10 MB and is deleted whenever the server is updated. Performance figures are counts only and name nothing.

The app on your PC

Your settings, looks, shared controls and blocks are stored on your PC in %APPDATA%\myAviLink. We never receive them. The key that proves your link is yours is encrypted with Windows' own protection.

The app keeps a log on your PC. It can contain your avatars' names and ids, look names, the names viewers appear under, and your heart rate monitor's name and Bluetooth address. It only leaves your PC if you send it to us, for example for help with a problem, and then we use it only for that.

Everything else the app does stays on your PC: it talks to VRChat, XSOverlay and OyasumiVR on your own computer, to your heart rate monitor over Bluetooth, and to Windows for what's playing. To be found by VRChat it sends a short announcement on your local network with the app's name, and nothing personal.

Links to other sites

A friends page can show links its owner added. They lead to other sites, where those sites' own privacy policies apply. The page doesn't tell them where you came from.

Who else processes data

Two companies process data on our behalf, under data processing agreements:

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, runs the server.
• Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, connects the site to the internet and handles its encryption. Your IP address and requests pass through Cloudflare, which may process them in the USA. Cloudflare is certified under the EU-U.S. Data Privacy Framework.

If you add OpenShock in the app, each press of a shocker goes from your PC to OpenShock's servers with your OpenShock token, named as "myAviLink". That is your choice and your account with them, not processing on our behalf; nothing about the friend who pressed is sent, and the token never leaves your PC for anywhere else.

If you add toys in the app, each move of a slider goes from the app to your toy over Bluetooth, and nowhere else. Nothing about the friend who moved it is sent.

Nobody else receives your data. It isn't sold, used for advertising or used to profile you, and no decisions are made about you automatically.

Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16) or deleted (Art. 17), to restrict its processing (Art. 18), to receive it in a portable form (Art. 20), and to object to processing based on legitimate interest (Art. 21). Where you gave consent, you can withdraw it at any time with effect for the future (Art. 7(3)). Write to [email protected].

Because almost nothing is kept and nothing is tied to a name, there is often nothing to find. If so, we'll tell you.

You can also complain to a data protection supervisory authority (Art. 77 GDPR), in particular in the EU country where you live or work.

Changes

When the app or the site changes what it does with data, this page changes with it, and the date at the top moves.