Privacy Policy

Last updated: 29 September 2026

Liveshare VR ("the service") lets you stream your phone camera live to people who have your session link or code. This policy explains what data the service touches and what it does not.

What we collect

• Accounts (optional). Watching and streaming need no account. To keep replays, share 360° videos or make a replay public you sign in with your email address: we email you a one-time link, so there is no password. We store your email address, the name you choose, when you joined and last signed in, and links between your account and the replays and shared videos you own. Signing in sets one essential cookie that keeps you signed in for 30 days (plus a small marker cookie so pages know whether to check); we set no other cookies. We email you only to sign you in and to tell you when a video you shared is listed or not listed.
• Camera and microphone. Only when you press "Preview camera" on the stream page and grant permission. Your video and audio are transmitted live to viewers of your session. They are not recorded or stored unless you turn on Save a replay.
• Replays. If a host turns on Save a replay, the host's picture and sound are recorded and stored for up to 30 days, then deleted. Viewers see a REC sign while this happens. Viewers' chat, reactions and names are not part of the recording. Replays recorded while signed in belong to your account; you can make them public, keep them link-only or delete them any time from your account. Replays recorded without an account stay link-only and can be managed from the device that recorded them.
• External cameras. If you stream from a camera app or OBS, we create a private stream key for your session and delete it when you end the stream. If you scan the pairing QR code with a second phone, that phone's camera joins your session for as long as it is connected.
• Permanent cameras (optional, account needed). A permanent camera keeps a stream address and key with your account, together with the name, title and settings you chose, until you delete the camera or the account. QR codes for camera setup, including any Wi-Fi password you type, are drawn in your browser and are not sent to us.
• Shared videos. When you share a video link, you must be signed in. We store the link, the title and details you enter, the name you choose to show, and your account, so we can tell you when it is listed (your email address is never shown to others). A one-way hashed identifier from your IP address helps us stop abuse.
• Session details. The session code, an optional display name and stream title, the capture mode, whether you chose to list the stream publicly, and the time it started. These exist only while the session is live and are deleted when the room closes.
• Chat, reactions and guidance. Messages, emoji reactions, "look left"-style nudges and pointer taps are relayed live to the people in the session and are not stored. Anyone who joins later does not see earlier messages. Your display name is shown with what you send.
• Snapshots. A viewer can save the current frame of a stream to their own device. The image is created in their browser and is not uploaded. The host is notified each time a snapshot is saved.
• Explore videos. Recorded 360° videos in Explore are streamed directly from Wikimedia Commons (upload.wikimedia.org). When you play one, your browser connects to Wikimedia's servers, which receive your IP address under the Wikimedia privacy policy. Nothing about what you watch is stored by Liveshare VR.
• Videos from YouTube, Vimeo and Facebook. Shared videos play in their site's own player. That player only loads after you press Play video; from then on the video site receives your IP address and may use cookies under its own privacy policy. We use YouTube's privacy-enhanced mode.
• Reports. If you send a report or a privacy request, we receive what you enter (the reason, your description, the session code and, if you give one, your email address) plus a one-way hashed identifier derived from your IP address to help detect abuse. We use this only to review the report and reply, and delete it within 12 months unless we need to keep it to meet a legal obligation.
• Abuse protection. To stop spam and attacks we count requests per visitor (sign-in emails, reports, shared videos, new sessions, wrong admin keys). The count is stored against a one-way keyed hash of your address, not the address itself, and is deleted after about two days. Sign-in emails never repeat text typed by someone else, and we do not accept temporary email addresses.
• Connection data. IP addresses and technical connection details are processed to route the live stream and to protect the service from abuse (rate limiting). Server logs are retained for a short period for troubleshooting.

What we do not collect

• No passwords or payment details. Accounts are optional and email-only.
• No advertising trackers or third-party analytics cookies.
• No recordings of your streams unless you choose to save a replay, and no chat history.

Who can see a stream

Anyone who has your session link or code can watch while you are live. Streams marked "List on Live now" are additionally shown on the Watch page to everyone. Treat the code like a meeting link: share it only with people you want to have it.

Service providers

Live media is routed through LiveKit, our real-time streaming provider, the site is hosted on Vercel, and accounts, replays, shared-video listings and reports are stored with Cloudflare R2. Sign-in emails are sent through Resend. They process data on our behalf under their own privacy terms.

Your choices

• Revoke camera and microphone access at any time in your browser settings.
• Hosts can switch off chat, reactions and guidance, lock a session to new viewers, and remove viewers at any time.
• End a stream with the "End" button; the room closes shortly after the last participant leaves.
• Sign out, or sign out of every device, from your account at any time. You can download a copy of your data or delete your account there; deleting it removes your profile, replays and shared videos.
• Leave a stream you are watching with the back button; nothing about you persists.

Accessing or deleting your data

Streams, chat, reactions and guidance are not stored, so there is nothing to delete once a session ends. Replays are deleted automatically after 30 days, and you can delete them sooner. If you have an account, your account page lets you download everything we hold about you and delete the account, which removes your profile, replays and shared videos immediately. Without an account, your display name and preferences stay in your own browser; clear the site's data in your browser settings to remove them.

To ask what data we hold about you, or to ask us to delete a report you sent or anything else linked to you, use the privacy request form and include an email address so we can reply. We respond within 30 days.

Children

The service is not directed at children under 13 (or the age required in your country), and we do not knowingly collect their data.

Changes and contact

We may update this policy as the service evolves; the date above shows the latest revision. For questions about privacy, use the privacy request form.