Privacy Policy

Who is responsible

The data controller is Seek2Seek LLC, a Delaware (USA) limited liability company. Contact us at technocrat@seek2seek.com. Our servers and backups are in the United States (Google Cloud, region us-central1).

If you are an artist: what we collect

• Email address and sign-in records: the time, IP address and browser user agent of each sign-in.
• VRChat account: your VRChat user id and display name, and a snapshot of your public profile taken when you verify the account (we are reducing what we keep from that snapshot to the id, display name, avatar image and join date).
• VRChat group: the id, name, member count and owner id of the group you attach to a collection.
• Agreement details: your legal name, creator name and country of residence, entered for the Publishing Agreement, and the signed agreement record (typed signature, time, IP address, user agent and document hashes). We keep that record permanently as a contract record.
• Artwork: the files you upload, kept unmodified — including any embedded metadata such as EXIF — together with their titles, descriptions, credit lines and licence notes. The puzzle images we derive from them carry no metadata.
• Payout details: your PayPal email, or your choice of VRC+ gift months, with a short change history, and your monthly statements.
• Audit log of the actions in your account, with IP addresses. The IP addresses are removed from it after 12 months.
• Support: the emails and Discord messages you send us.

If you are a player: what we receive

Players never use this portal. The VRChat world talks to our server in two ways.

• Beacons. When the world loads a puzzle, a game is played or completed, or a store listing is opened, it sends a small request to our server. We store only a salted one-way hash of the IP address and user agent, a count per puzzle and a timestamp. That data is pseudonymous; we use it for statistics and to prevent abuse, and we delete it after 400 days. Raw IP addresses appear only in short-lived server access logs.
• Purchase records. We are the seller of record for the puzzles in VRChat's Creator Economy, so VRChat provides us with the purchase records of our store listings: VRChat user id, display name, gift recipient id, listing, price, time and status. We use them to attribute sales to artists, to pay artists, and to handle refunds and fraud. We keep them for 7 years as business and tax records. Artists see only counts, never who bought.

The world itself runs on VRChat and is governed by VRChat's terms and privacy policy.

What is public

The world reads a catalog feed from jigsaw.seek2seek.com and from a mirror on GitHub Pages. Anyone can read both. They contain, for each collection and jigsaw: the artist's credit name, the collection name and VRChat group id, the collection blurb and member count, jigsaw titles, descriptions, licence notes and price tier, the counts of plays, completions, downloads and sales per jigsaw, the puzzle image itself (2048×1365) and a preview. This is how the VRChat world works; the feed cannot be restricted to buyers.

Why we use it

• To perform the Publishing Agreement and operate the portal (in GDPR terms: performance of a contract).
• To meet legal obligations: tax, accounting, and responding to rights claims.
• For our legitimate interests: security, preventing fraud and abuse, statistics, and defending claims.
• With your consent, where we ask for it.

Who receives it

• Google Cloud — hosting, database backups and file storage.
• Resend — transactional email.
• GitHub — the public mirror of the catalog.
• VRChat — we send the listing and product text and the artwork image to your store listing; we receive purchase records.
• PayPal — your PayPal email, if you choose PayPal payouts.
• Our attorney or accountant when needed, and authorities when the law requires it.

We do not sell personal information. There is no advertising, and there are no analytics trackers.

International transfers

If you are outside the United States, your data is transferred to and processed in the United States. For artists in the EU and the UK we rely on the transfer being necessary for our contract with you and, where applicable, on standard contractual clauses with our processors.

How long we keep it

Your rights

You can ask for access to your data, for correction, for deletion (except records we must keep, such as signed agreements and payment records), and for an export of your data, and you can object to a use or ask us to restrict it. If you are in the EU, the UK or Switzerland you can also complain to your supervisory authority. If you are in California: we do not sell or share personal information for cross-context behavioural advertising.

To exercise a right, email technocrat@seek2seek.com from the email address on your account. We answer within 30 days.

Do Not Track: we do not track you across other sites, so we do not respond to DNT signals specifically.

Cookies and security

The portal sets two first-party cookies: s2s_sess (your sign-in session, 30 days) and, for the operator only, s2s_admin (8 hours). Both are strictly necessary, so no consent banner is needed. There are no third-party cookies.

Connections use HTTPS, our VRChat session is stored encrypted, and access to the data is limited to the operator. No system is perfectly secure.

Children

The portal is for adults (18+). We do not knowingly collect data from anyone under 18 on the portal. For players, VRChat's age rules apply; we do not knowingly collect personal data from children under 13.

Changes

When this policy changes we post the new version here with its date. Material changes are emailed to artists.