VRC.Quest.Privacy.1

1. Click on the privacy policy link provided.
2. Is the Privacy Policy signed by a trusted Certificate Authority to properly create an https connection?
   A website Certificate Authority is trusted if it is widely recognized and respected as a reliable issuer of digital website certificates. For more information, please visit https://https.cio.gov/certificates/⁠.
3. Is the Privacy Policy live?
   A Privacy Policy URL is considered Live if it doesn’t return a HTTP error code or error message such as “page can not be found”, “bad gateway”, redirects to a homepage, and so on.
4. Is the link publicly available?
   “Publicly available” means the user does not have to provide data prior to getting access to the developer’s privacy policy.
5. Does the linked page take you to a “privacy policy”?
   The only thing that needs to be present in this page is the “Privacy Policy” term that could be in the heading OR within the text content - however we will also accept variations of it such as: Terms of Services, Terms and Conditions, Data Collection, Privacy Policy, Protection of Personal Data, Data Policy, GDPR (General Data Processing Regulation), Confidentiality Agreement, Policy of Personal Data, Data Management Policy, etcetera. (a title/heading is not mandatory in order to be compliant).
   Privacy Policies should be owned by the team or parent team.
6. Is the privacy policy hosted on an acceptable platform?
   The privacy policy must not be hosted on another VR app distribution platform. Acceptable hosting includes your own website, Google Docs, Google Sites, and GitHub. Any web-hosted PDF should not prompt a download.

• Link is live, publicly available, and is a privacy policy.
• The privacy policy is not hosted on another VR app distribution platform.

• 2026-03-30: Added requirement that privacy policies must not be hosted on another VR app distribution platform.
• 2024-07-31: Removed App Lab from VRC platform requirements.
• 2024-04-03: Added the requirement that privacy policies be signed by a trusted certificate authority.
• 2022-10-17: PDF files are no longer allowed as a format for distributing privacy policy documents.

• Data Protection and Privacy Guidelines — overview of all data handling requirements.
• Data Protection Assessment — required assessment process for apps that handle user data.
• Data Use Checkup — certification for platform feature access.
• Guide to secure data handling — answers to common data handling questions.
• Developer Data Use Policy — the policy governing how developers can use collected data.