Disc Golf All Stars privacy policy

Last updated 9 October 2026.

Disc Golf All Stars is a virtual reality game for Meta Quest made by Deep Challenger VR LLC (“we”). This policy covers the game and the services it uses. Questions: privacy@deepchallengervr.com.

The game does not ask you to create a separate account or enter your name, and does not read your Meta profile or friends list. It does collect and process Meta purchase information to unlock what you bought and your Meta user ID when you host or join a group. It has no ads and no third-party tracking, and we do not sell personal information. Only if you choose Share, the game sends us play data: how you play, including purchase status and outcomes, linked to a random ID made on your headset. You can turn it off in Settings at any time and request deletion of what was sent. When you play with friends, your headset connects to theirs, which shares your IP address with the group’s host or with Cloudflare’s relay. If you report another player, we receive the report described below. You can request deletion of your data wherever you live.

What stays on your headset

The game keeps your settings on your headset, in the app’s browser storage: units, disc grip and throw power, movement, the disc camera, where you placed the panels, the course you last chose, whether you have seen the tutorial, and your choice about sharing play data. If you choose to share play data, its random ID and the play data waiting to be sent are kept there too. Game files are cached there so they do not download again. None of this is sent to us, except play data. Clearing the app’s data removes it.

Play data (you can turn it off)

The game asks whether you want to share play data to help us improve it. It records and sends no play data before you choose Share in the VR menu. Keep private lets you play without sharing. You can change your choice in Settings at any time. Turning sharing off stops new play data and requests deletion of what was sent. Players who used the earlier default-on version are asked again; their old queued play data is cleared and deletion is requested for the old ID before they make a new choice. Our service also refuses uploads from the older default-on version and deletes the events and sessions for that ID.

• What it contains. How you use the game: when you start and stop playing and for how long; the menus you use; the courses and holes you play and your scores; for each throw, the disc, the speed and angles of the release as the game measures them, and where the disc went; the settings you change; the free trial, the unlock offer and whether a purchase went through (never payment details); whether you host or join groups, how many players and for how long, and that you reported, hid or removed a player (never who); frame rate, loading times and error messages. With it: your headset model, the Quest Browser version, the game’s version, your headset’s language, and whether the game runs as the app or in Quest Browser.
• What it is linked to. A random ID made on your headset when you first choose to share, replaced with a new one every 13 months. It is not your name, your Meta account, your Meta user ID or any identifier of your headset, and we do not try to find out who you are. We do not receive the tracking of your headset or hands, only the measurements the game makes of each throw.
• Your country, not your IP address. Cloudflare, which runs the service that receives play data, tells it which country your connection comes from. We keep the country. The service does not keep your IP address and keeps no request logs.
• How we use it. Only to understand how the game is played and make it better: which holes are too hard, how throws feel, how the game runs on each headset, what goes wrong, and what to build next. We use reports that combine players’ data and do not identify individual players or headsets. We do not use play data to make decisions about individual players, for advertising, or to identify you. We do not sell it, share it with anyone except Cloudflare as our service provider, or join it to account records or outside datasets.
• How long we keep it. Play data is deleted 13 months after it is sent. We keep each day’s totals (such as how many rounds were played), which contain no IDs, for longer.
• Turning it off and deleting it. In the game, open Settings on the course panel and set Play data to Off. This stops sharing immediately, clears the queued play data, and sends a deletion request. Our service deletes the events and sessions for your ID when it receives that request. If it cannot be reached, the game keeps the request and retries when it runs and can connect. We keep a deletion marker containing the random ID for 60 days to reject delayed uploads; totals that contain no IDs remain. You can also write to privacy@deepchallengervr.com with the play data ID shown beside that setting, and we will delete the events and sessions within 30 days. Note the ID before turning sharing off, uninstalling, or clearing app data: once it is removed from your headset, we cannot find the play data from your name or Meta account. Data not deleted on request expires after 13 months.
• Legal basis. We process optional play data on the basis of your consent. Share gives that consent; Keep private does not. You can withdraw consent at any time by turning Play data off in Settings. You can still play when it is off. Withdrawal does not affect the lawfulness of processing before you withdrew consent.

Meta purchases (In-app purchases / IAP)

Sedona, Acadia & multiplayer is bought through the Meta Horizon Store, which handles payment under Meta’s privacy policy.

• What the app collects and processes. Meta’s billing service supplies purchased item IDs and purchase tokens. For the unlock offer, it supplies the item’s price and currency. A checkout response can contain a purchase token. The game uses this information to determine whether you own Sedona, Acadia & multiplayer, display the price, complete checkout, and restore access when you reopen the app. It checks ownership at launch, when a course loads, and when you choose Try again on the unlock button.
• What we retain. Purchase tokens and the returned purchase list are processed in memory; the game does not save them in browser storage or send them to our servers. Ownership status is kept in memory while the app runs. If Play data is shared, our analytics service also receives ownership status, billing failures and currency, when you start checkout, and its outcome (success, pending or cancelled), linked to the random play data ID. These records follow the retention and deletion rules in Play data. They do not contain purchase tokens or your Meta user ID.
• What Meta retains. Meta maintains the store’s purchase and payment records. We do not receive your card number, bank account details or billing address. Requests about Meta’s own records go to Meta; requests about purchase-related play data we hold can be sent to us as described in Deleting your data.

Meta user ID (User ID)

• What the app collects and processes. When you choose to host or join a group, the app asks Meta’s billing service for your Meta user ID for this app. This is an account identifier supplied by Meta, not your name, email address or profile photo. If Meta supplies a valid ID, the app sends it over HTTPS to our multiplayer service on Cloudflare. It is used for server-side verification of the purchase that includes multiplayer.
• How it is used. When server-side verification is enabled, our service sends the ID and the purchase’s item ID to Meta to ask whether your account owns it. It uses Meta’s yes-or-no answer to issue a temporary multiplayer pass. When the service requires passes, it uses an identifier derived from your Meta ID to keep one account in one live group at a time. When verification is disabled, the service returns no pass and does not perform that check.
• What we retain and share. Our service does not save or deliberately log the original Meta user ID. When verification is enabled, a pass contains a keyed, derived identifier and expires after two minutes. When passes are required, the derived identifier is associated with your group and a random player ID; the stored group assignment expires 24 hours after it was last made. This is pseudonymous account data, not anonymous data. Cloudflare’s diagnostic logs can contain the room code for up to 7 days. Query strings containing player IDs and passes are removed from these logs. Logs made before that change can remain for up to 7 days. We do not send your Meta ID or derived account identifier to other players or to the play data service, and do not use them for advertising.
• Deletion requests. You can write to privacy@deepchallengervr.com to request deletion of data associated with multiplayer purchase verification. Give the group code and approximate time you played so we can investigate the records. Do not send a password, purchase token or payment details. The original Meta ID and the purchase token are not retained by us; short-lived records and service logs expire as described above. See Deleting your data for the request process and limits.

Hosting

The game’s files are served by Cloudflare. As with any website, Cloudflare receives your IP address and standard request details (such as the browser version) to deliver the files and protect the site from attacks.

Playing with friends

Playing with friends comes with the one-time purchase. One player hosts a group and gets a six-digit code; friends who type the code join. Each guest’s headset connects to the host’s headset using WebRTC, a standard way for browsers to connect to each other.

• What other players see. The others in your group receive the position and movement of your head and hands, which disc you hold, your throws and where your disc comes to rest, and your hole and score. Players are known only by colour (Blue, Green and so on). There are no names, voice or text chat, and nothing you type reaches other players.
• Your IP address. To connect, WebRTC tells the host’s headset each guest’s IP address and network port, and tells each guest the host’s. Guests do not receive each other’s addresses: everything between guests passes through the host. When a network does not allow a direct connection, the link goes through Cloudflare’s relay (Cloudflare Realtime TURN) instead, and it is the relay, not the other player, that receives your IP address. Game data is encrypted between the headsets; the relay passes it on without being able to read it. Share your code only with people you want to play with.
• The service that introduces players. A small service we run on Cloudflare gives out room codes, passes each connection’s setup between host and guest (WebRTC offers, answers and network candidates, which contain IP addresses), and issues temporary relay credentials. It receives the room code, a random ID made for you for that group (a new one each time), your IP address, and the connection setup. It keeps a group’s details, including which random IDs joined it, only while the group is playing.
• Checking the purchase. The service processes the Meta user ID and, when enabled, the purchase verification and temporary account identifiers described in Meta user ID. It also counts requests per IP address for about a minute to stop anyone opening groups or guessing codes faster than players do. Cloudflare’s logs of the service are kept for up to 7 days to diagnose problems.

If you do not host or join a group, the game makes none of these connections.

Reporting a player

You can report another player in your group in two ways.

• In the game. On the Multiplayer panel, Report on a player’s row lets you choose a reason and send a report. It goes to the service that introduces players, which keeps it for us. A report contains: the group’s code; the reason you chose; your colour and the reported player’s colour, whether each of you was the host or a guest, the hole each of you was on, and each player’s random ID for that group; the course and number of holes; the number of players; and the time we received it. It does not contain names, your Meta account, anything you type, recordings, or your IP address (the service uses your IP address only to count requests, as above, and Cloudflare’s logs record the request). The reported player is not told. Only we can read reports; we use them to review conduct under Meta’s Code of Conduct for Virtual Experiences and to keep the game safe, and we delete them after 180 days.
• Through Meta. Pressing the Meta button and choosing Report opens Meta’s reporting form. Meta collects what you enter under Meta’s privacy policy and passes the report to us encrypted. We use it as we use reports sent in the game.

The Multiplayer panel also lets you hide a player, so you no longer see them or their throws, and lets the host remove a player from the group. These actions happen on the headsets in the group. If Play data is shared, it records that you used the action, never who you hid or removed.

Who else receives information

• Cloudflare, Inc. hosts the game, the service that introduces players and processes multiplayer purchase verification, the relay, and the service and database that receive play data, as our service provider. See Cloudflare’s privacy policy. Cloudflare uses a global network and can process requests in the United States and the other countries and territories listed on its network page. Processing is not restricted to the United States. Its data-processing agreement is part of its subscription terms; where required, it includes safeguards for international transfers. See Cloudflare’s data-processing agreement.
• Meta handles purchases and runs the headset and its browser, under Meta’s own policies.
• Other players in your group receive what is described above. They never receive reports.

We may disclose information if the law requires it. We do not sell or share personal information for advertising.

Children

The game is rated for ages 13 and up and is not directed at children under 13. We do not knowingly collect personal information from children under 13.

Deleting your data

Anyone, wherever they live, can ask us to delete or correct data we hold about them, free of charge, by writing to privacy@deepchallengervr.com. Use the subject Disc Golf All Stars — data deletion and tell us which data you want deleted, with the identifiers below if you have them. You do not need a separate game account. We may ask for enough information to locate your records and avoid deleting someone else’s data; never send your password or payment details. We will respond within 30 days and explain what we removed or why we could not remove a record.

• Play data, including purchase status and outcomes. Set Play data to Off in the game’s Settings to stop sharing and request deletion of your events and sessions. The request is retried if our service cannot be reached; keep the app’s data until it can connect. Or note the play data ID shown beside that setting and write to us with it, and we will delete the events and sessions within 30 days. Without the ID, we cannot locate these records from your name or Meta account; they expire after 13 months. A deletion marker remains for 60 days to reject delayed uploads. Totals containing no IDs remain.
• Reports. A report names players only by colour and a random ID, so we cannot find one from your name or Meta account. Tell us the group’s code and roughly when you played, and your colour if you remember it, and we will delete the reports from that group that you sent or that were made about you. Every report is deleted after 180 days in any case.
• Meta user ID and multiplayer verification. We do not retain the original Meta user ID or purchase tokens. You can still ask us about any derived multiplayer account data by giving your group code and approximate time you played. Where enabled, the stored group assignment expires after 24 hours without a new assignment. We will explain whether we can locate and remove a record, or whether it has already expired.
• Cloudflare’s service logs. We do not offer deletion of individual entries from these diagnostic logs; they expire automatically within 7 days. Give us your group code and approximate time if your request concerns these logs so we can explain what may remain and when it expires.
• On your headset, clearing the app’s data or uninstalling the game removes your settings and the cached game files.
• Meta’s purchase and payment records. We cannot delete records held by Meta. Ask Meta under Meta’s privacy policy. This does not prevent you from requesting deletion of purchase-related play data held by us.

Your choices

Play data can be turned off in Settings at any time, which stops sharing and requests deletion of what was sent (see Play data). To keep your IP address from other players, play alone. You may write to us with any other request or question.

Changes

We will post changes to this policy on this page and update the date above.

Support · Terms of use · Deep Challenger VR