Privacy Policy

This Privacy Policy explains how BetterVRCX, an open-source desktop companion project developed and maintained by awakenginexe, handles your data.

BetterVRCX is designed around a local-first, privacy-respecting architecture. BetterVRCX is a desktop application that runs on your personal computer. We believe your data belongs to you, and we build our tools to minimize external data exposure.

1. Overview of Application Architecture

BetterVRCX operates locally on your device. The application does not require you to create a BetterVRCX account and does not maintain central servers to collect, track, or analyze your personal application usage.

2. Local Application Data Storage

When you use BetterVRCX, the software stores application data locally on your computer in an SQLite database (typically named vrcx.sqlite3). This local database may contain:

• Your locally saved favorite worlds, avatars, and friends.
• Personal memos, custom notes, and user-assigned avatar tags.
• Activity logs, world visit history, and player join/leave timestamps.
• Notification history and user interface preferences.

This information remains entirely on your local storage unless you explicitly choose to create an external backup.

3. Google Drive Backup & Google User Data

BetterVRCX provides an optional Google Drive Backup feature that allows you to create snapshots of your local SQLite database and store them directly in your own personal Google Drive account.

Direct Client-to-Drive Data Flow

BetterVRCX project servers do not receive or store your backup files. Backups are processed locally by the BetterVRCX desktop application and transferred directly between the user's computer and Google Drive.

When you enable this feature:

• The BetterVRCX desktop client initiates an OAuth 2.0 authorization request directly with Google's authentication servers using PKCE (Proof Key for Code Exchange) and a temporary local loopback receiver.
• The application creates a dedicated folder named BetterVRCX/Backups within your own Google Drive.
• Database backup snapshots (containing your local SQLite database) are uploaded directly from your computer to your Google Drive via Google's official Drive APIs.
• When restoring a backup, the file is downloaded directly from your Google Drive to your computer.

OAuth Permissions & Scope

BetterVRCX follows the principle of least privilege and requests only the specific Google OAuth scope required for the backup feature:

https://www.googleapis.com/auth/drive.file

BetterVRCX uses the limited drive.file permission rather than requesting broad access to all files in your Google Drive. This scope strictly restricts BetterVRCX to accessing only files and folders that were created or opened by BetterVRCX. The application cannot view, read, modify, or delete any other documents, photos, or files in your Google Drive.

Local Storage of Authentication Tokens

To keep your Google Drive connection active without requiring you to re-authenticate on every backup, BetterVRCX retains an OAuth refresh token locally on your computer. This token is protected using operating system-level encryption (Windows Data Protection API - DPAPI) tied exclusively to your current Windows user account.

Google API Limited Use Disclosure

BetterVRCX's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements:

• Google user data is used exclusively to provide user-facing cloud database backup and restore capabilities within the BetterVRCX desktop application.
• We do not transfer Google user data to third parties, except as strictly necessary to interact directly with Google Drive APIs on your behalf.
• We do not use Google user data for advertising, market research, or targeting.
• No human beings at the BetterVRCX project have access to read or inspect your Google user data or backup archives.

How to Revoke Google Access

You maintain full control over your Google connection at all times:

• Within BetterVRCX: Click the "Disconnect" button in the Google Drive Backup settings. This immediately wipes all cached tokens and encrypted credentials from your local device.
• Via Google Account Settings: You can revoke BetterVRCX permissions at any time through your Google Account Third-Party Apps & Services dashboard.

4. Other External Network Communications

To perform its intended companion functions, the BetterVRCX desktop application interacts with the following external endpoints:

• VRChat API: Communicates directly with VRChat servers using your active VRChat session to retrieve friend statuses, world information, and avatar details.
• GitHub Releases API: Checks https://api.github.com/repos/awakenginexe/BetterVRCX/releases/latest to notify you of available application updates.
• Local IPC: Integrations such as Discord Rich Presence and SteamVR/OpenVR overlay operate via local inter-process communication on your own machine.

5. Data Sharing, Selling, and Analytics

• No Data Selling: We do not sell, rent, monetize, or trade your personal data, database records, or Google account information under any circumstances.
• No Third-Party Telemetry: BetterVRCX does not include third-party tracking scripts, analytics SDKs, advertising beacons, or telemetry collectors.

6. Open-Source Transparency

BetterVRCX is open source under the MIT License. The complete source code - including the Google Drive backup implementation, network handlers, and storage mechanisms - is publicly available for review, verification, and contribution at:

https://github.com/awakenginexe/BetterVRCX

7. Contact and Inquiries

If you have questions, feedback, or concerns regarding this Privacy Policy or BetterVRCX data practices, please open an issue on the project's official GitHub Issue Tracker.