Leeds Rhinos Legends Privacy Notice
Version LRL-PN-1.3. Effective date: 22 September 2026.
1. About this notice
This notice explains how Virtual Sport Group Ltd collects and uses personal data when you use the Leeds Rhinos Legends app on Android XR devices (from Google Play) and on Meta Quest devices (from the Meta Horizon Store), including SportX Pro membership. It also explains your rights and how to use them.
We are the controller of the personal data described in this notice. Virtual Sport Group Ltd is a company registered in England and Wales with company number 15793472. Our registered office is Sticks & Glass, York Place Buildings 6-8, York Place, Leeds, West Yorkshire, England, LS1 2DS. You can contact us about privacy at info@virtualsportgroup.com.
Our website privacy policy covers visits to virtualsportgroup.com. This notice covers the app. The app is also governed by our Terms of Service.
2. Summary
- We use your data to run the app, your account, SportX Pro and the social features.
- We do not sell your personal data and we do not show adverts.
- Voice chat is live and we do not record it. The one exception: when you report someone, the last 30 seconds of audio from your lobby or party is sent with your report.
- The digital companions process your voice live and do not keep it.
- The Meta Quest app collects no analytics and sends no crash reports. In the Android XR app, analytics are off unless you agree, and you can change your choice in Settings.
- You can delete your account in the app or on our website.
3. Information we collect and how we use it
Browsing the library without an account
You can browse library artwork without signing in. To send the catalogue and artwork to your device, our hosting provider Cloudflare processes your device's IP address and standard technical information about the request, such as the time and the item requested.
To protect our services from abuse, our servers turn your IP address into a one-way code (a hash) and use it to limit how many requests can be made in a short time. We delete these codes after about two minutes. We do not use your IP address to work out where you are, and our servers do not record your device model or browser details.
Your account
When you sign in, Google Firebase Authentication creates an account for you and gives it a unique account ID.
- If you sign in with Google, Firebase receives the details your Google account shares for sign-in, such as your email address, name and profile photo. Firebase stores these on our behalf. Our own servers do not read or store your email address, name or photo. They store only your account ID and the time you signed in.
- Test and reviewer accounts that we create sign in with an email address and password, which Firebase stores.
Firebase also processes your IP address and device information when you sign in, to keep accounts secure.
Signing in on Meta Quest
On Meta Quest you sign in with the Meta account already in use on your headset. From Meta we receive:
- your Meta account ID, a number identifying your account to this app
- a one-time code, called a user proof nonce, that lets our servers and our providers confirm the account is really yours
- your Meta display name, or your Meta username if you have not set a display name.
We use your Meta account ID and the one-time code to create or sign in to your SportX account, and to confirm whether your account has SportX Pro. Our servers store the link between your Meta account and your SportX account so that you return to the same account each time.
We also pass your Meta account ID, the one-time code and your Meta display name to Epic Online Services, which gives you the player ID used by friends, parties and voice chat.
We do not receive your Meta profile photo, your Meta friends list, your Meta block list or your age group.
Your Meta display name becomes your in-app display name only until you set your own, or when you choose "Use my Meta name". You can change it at any time in the app. Other people see the display name you are using. We never show your Meta account ID to other users and never use it as a name.
The app also stores a sign-in file on your headset whose filename contains your Meta account ID, so that you stay signed in. It is removed when you uninstall the app or clear its data.
Watching videos and My List
When you are signed in, we store:
- the videos you save to My List, and when you saved them
- your watch progress, so you can carry on where you left off, and a record of each progress update we receive, so we can keep your devices in sync
- short-lived playback sessions that let your device stream a video you have access to, which include the video, a coded session token and the time it was created and expires
- your membership status, such as whether you have SportX Pro and when it ends.
SportX Pro membership
On Meta Quest you buy SportX Pro through the Meta Horizon Store. Meta handles your payment and we do not receive your card or bank details. We ask Meta whether your account has bought SportX Pro and store the answer together with your membership's start and end dates. You can manage or cancel a Meta subscription at secure.oculus.com/my/subscriptions.
On Android XR devices, you buy SportX Pro through Google Play. Google handles your payment. We do not receive your card or bank details.
- Google tells us about the purchase. For our records, Google's reports show us an order number and the country, and in some cases the city, region and postcode, of the buyer.
- RevenueCat manages memberships for us. Whichever device you use, it receives your SportX account ID and tells us whether a membership is on file for you. On Android XR, where you buy through Google Play, RevenueCat also receives the Google purchase token and your purchase history. On Meta Quest, your purchase and its history stay with Meta: we read your subscription status directly from Meta using our own server, and we never send a Quest purchase or purchase token to RevenueCat.
- Our servers ask RevenueCat whether your account has an active membership and store the result. When RevenueCat tells us your membership has changed, we store the notification ID, your account ID and the time for 30 days.
Friends, presence and profiles
The social features use Epic Online Services, run by Epic Games, which gives you a separate player ID for this app. Our social service stores, linked to that player ID:
- your display name, which starts as "Rhinos supporter" and which you can change
- a friend code, created at random, so friends can find you
- your friends list, your friend requests and the people you have blocked
- your presence, which is whether you are online, what you are doing in the app (in menus, watching, exploring or away) and whether you are in a party. We keep only your latest status, not a history.
Your friends can see your display name, friend code and presence.
Public voice lobbies and private parties
Public voice lobbies hold up to 16 people. When you join one, our servers record which lobby you are in while you are in it. Private parties are only open to your friends, and our servers check that neither of you has blocked the other before an invitation is sent.
Other people in a lobby or party can see your display name and hear you when you speak. Your voice is sent live through Epic Online Services to the other people in the lobby or party. We do not record or transcribe voice chat, except for the short clip sent with a report, described below.
Inviting friends on Meta Quest
When you invite someone, Meta shows your own Meta friends list inside Meta's own invite panel and sends the invitation. The app does not receive your friends list; it is told only how many invitations were sent.
So that a friend can join you, the app tells Meta which room you are in, using a room code created by our servers, and whether you are open to being joined. That room code says nothing about you. When you accept an invitation, Meta gives the app the room code so that it can take you straight there. This stops when you leave the room.
Direct messages
You can send messages to people on your friends list. Our social service stores the message, who sent it and who it was sent to, and the time. We check message text against a filter and record whether it was filtered, so that we can act on abuse and enforce our community rules. We delete messages after 30 days.
Direct messages are available in the Android XR app. The Meta Quest app does not have direct messaging.
Other people cannot read your messages, and we do not use them to profile you or to advertise to you.
Microphone
Voice chat and the digital companions need permission to use your device's microphone. You can refuse or withdraw this permission in your device settings at any time.
Digital companions in the Legends Tunnel (Meta Quest)
When you talk to a digital companion, the app sends what you say to our supplier Abyshire Technology Ltd (company number 14718576). Abyshire turns your speech into text, creates the companion's reply and turns the reply into speech. It processes your voice live, only to create the reply, and does not keep recordings or transcripts. Some of this processing takes place in the United States.
Reports
If you report another user, we store your player ID, their player ID, the category you chose (harassment, hate, spam or other) and anything you write in the report. We use this to investigate and keep people safe. We delete reports after 30 days.
While you are in a lobby or party, the app keeps the last 30 seconds of its audio on your device, replacing it continuously. This audio does not leave your device unless you report someone. If you do, that 30-second clip is sent with your report to Epic Online Services, where our team reviews it. The clip may include the voices of other people in the lobby or party, and other users' reports may include your voice. Reported clips are deleted after 30 days.
Analytics and crash reports
On Meta Quest, the app does not collect analytics and does not send crash reports. It contains no third-party analytics or crash-reporting software, and it does not collect your device's advertising ID.
On Android XR, the app asks whether you agree to analytics. If you agree, our own servers record app events, such as an event name, when it happened and a small amount of detail about it, linked to your SportX account ID. This stays on our own systems and is not shared with an analytics provider.
We use this information to understand how the app is used, to fix problems and to improve the app for the people using it. We do not use it for advertising, we do not sell it, and the app does not collect your device's advertising ID. You can change your choice at any time in the app's Settings. If you turn analytics off, we stop recording these events.
When you contact us
If you email us, we use your email address and what you tell us to reply and to deal with your request.
Storage on your device
The app stores information on your device that it needs to work, such as the details that keep you signed in and your settings. The software our service providers supply for sign-in, voice chat and purchases also stores information on your device so that those features work. We do this because it is strictly necessary to provide the app you have asked for. In the Android XR app, analytics only store or read information on your device if you agree.
4. Our legal reasons for using your data
Data protection law requires us to have a legal reason, called a lawful basis, for each use of your personal data.
| What we do | Lawful basis |
|---|---|
| Create and run your account, sign you in, stream videos, save My List and watch progress | Performing our contract with you (the Terms of Service) |
| Sign you in with your Meta account and link it to your SportX account | Performing our contract with you (the Terms of Service) |
| Check and apply your SportX Pro membership | Performing our contract with you |
| Run friends, presence, display names, voice lobbies and private parties | Performing our contract with you, when you choose to use these features |
| Send your speech to a digital companion and play its reply | Performing our contract with you, when you choose to talk to a companion |
| Collect analytics in the Android XR app | Your consent, which you can withdraw at any time |
| Handle reports, enforce our community rules and protect users | Our legitimate interest in keeping the app safe, and our legal duties under online safety law |
| Limit requests and prevent abuse and fraud | Our legitimate interest in keeping our services secure and available |
| Respond to your messages and requests | Our legitimate interest in helping you, or performing our contract with you |
| Keep business and financial records | Our legal obligations, such as tax and accounting law |
| Deal with legal claims and requests from authorities | Our legitimate interest in protecting our rights, and our legal obligations |
Where we rely on legitimate interests, we have considered your interests and rights and concluded they do not override ours. You can ask us for more detail and you can object (see section 10).
We do not make decisions about you based solely on automated processing that have a legal or similarly significant effect on you.
We do not sell your personal data.
5. Who we share your data with
We use service providers who process personal data for us, on our instructions and under contracts that protect it:
| Provider | What they do for us | Where the data is processed |
|---|---|---|
| Google (Firebase Authentication) | Accounts and sign-in | United States and other countries where Google has facilities |
| RevenueCat | Membership management | United States |
| Epic Games (Epic Online Services and Unreal Engine) | Player IDs, lobbies and voice chat. Receives your Meta account ID, the one-time sign-in code and your Meta display name in order to create your player ID. | United States |
| Meta Platforms | Sign-in on Meta Quest, SportX Pro purchases, invitations and joining a friend | United States and other countries where Meta has facilities |
| Abyshire Technology Ltd | Speech recognition, replies and speech for the digital companions | United Kingdom and United States |
| Cloudflare | Hosting our servers and databases and delivering video | Our databases are in western Europe. Cloudflare delivers content through its global network. |
We also share information with:
- Google and Meta, which run the app stores and platforms the app is provided through. Google processes your SportX Pro purchases. They use your information under their own privacy policies.
- Other users, as described in section 3, for example your display name and your voice in a lobby.
- Professional advisers, such as lawyers and accountants, where needed.
- The police, regulators, courts or other authorities, where the law requires it, or where we reasonably believe it is necessary to protect someone from serious harm.
- A buyer or successor, if our business or its assets are sold or transferred. We will tell you if this happens.
6. International transfers
Some of our providers process data outside the UK and the European Economic Area, particularly in the United States. When personal data is transferred, we rely on legal safeguards:
- Google is certified under the EU-US Data Privacy Framework and its UK Extension, and its data processing terms include standard contractual clauses.
- RevenueCat and Cloudflare use the European Commission's standard contractual clauses together with the UK International Data Transfer Addendum.
- Epic Games is covered by its data processing agreement with us, which includes the European Commission's standard contractual clauses.
- Abyshire Technology Ltd uses the UK International Data Transfer Agreement or the UK Addendum to the standard contractual clauses for processing in the United States.
You can ask us for more information about these safeguards.
7. How long we keep your data
| Data | How long we keep it |
|---|---|
| IP address hash used to limit requests | About 2 minutes |
| Playback sessions | Until about 24 hours after the session ends |
| Membership change notifications from RevenueCat | 30 days |
| Friend requests | 7 days, or until accepted, declined or cancelled if sooner |
| Direct messages between friends (Android XR app) | 30 days |
| App events recorded by our own servers, if you agree to analytics (Android XR app) | 30 days |
| Reports | 30 days |
| Speech sent to a digital companion | Not kept by Abyshire once the reply has been created |
| Voice clip sent with a report | 30 days |
| Public lobby membership | While you are in the lobby |
| Blocks | Until the person who made the block removes it. If your social profile is deleted, other users' block lists may still contain your player ID. |
| Account ID, My List, watch progress and membership status | While your account is open. When you delete your account, we delete this data within 30 days, and copies in our database backups are removed within a further 30 days. |
| Display name, friend code, presence and friends list (your social profile) | Until you ask us to delete your social profile (see section 12) |
| Record that an account deletion was completed, which does not include your account ID or email address | 12 months |
| Account details held by Firebase | While your account is open. After an account is deleted, Google removes the data from its live and backup systems within 180 days. |
| The sign-in file stored on your headset | Until you uninstall the app or clear its data |
| The link between your Meta account and your SportX account | Until you ask us to delete it (see section 12) |
| Emails you send us | As long as we need them to deal with your request |
8. How we protect your data
We use technical and organisational measures to protect your personal data. For example:
- data sent between the app and our servers is encrypted in transit
- sign-in is handled by Firebase Authentication, and our servers check every sign-in token before giving access to your data
- we store coded (hashed) versions of IP addresses and playback tokens instead of the originals
- we keep only the data each feature needs, and we delete short-lived data automatically, as shown in section 7.
No system is completely secure. If a breach of your personal data is likely to put you at high risk, we will tell you without undue delay.
9. Children
Our Terms of Service require you to be 16 or over to use the app. This is our own minimum age, not a content rating: the age rating shown in the app stores is set separately by the ratings authorities and reflects the content of the app. If we learn that someone under 16 is using the app, we will close their account. If you think a child under 16 is using the app, please tell us at info@virtualsportgroup.com.
10. Your rights
Depending on where you live, you have rights over your personal data. In the UK and the European Economic Area, these include the right to:
- access your personal data and get a copy of it
- correct data that is wrong or incomplete
- delete your data in some circumstances
- restrict how we use your data in some circumstances
- object to our use of your data where we rely on legitimate interests
- data portability, which means receiving data you gave us in a machine-readable format, or having it sent to another organisation, where we rely on our contract with you
- withdraw consent at any time, where we rely on your consent.
To use any of these rights, email info@virtualsportgroup.com. We may need to confirm your identity first. We will reply within one month. If your request is complex, or you make several requests, we may need up to two more months and will tell you if so. Using your rights is usually free.
You can change your display name in the app, remove videos from My List and unblock people at any time. In the Android XR app you can also change your analytics choice in Settings.
11. Complaints
If you are unhappy with how we have used your personal data, you can complain to us by emailing info@virtualsportgroup.com. We will acknowledge your complaint within 30 days, look into it without undue delay, keep you updated and tell you the outcome. If you are under 18 and your complaint is urgent, please say so in your email.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. If you live in the European Economic Area, you can complain to the data protection authority in your country.
12. Deleting your account
You can delete your account at any time in the app, under Settings, then Account & membership, then Delete account, or on our website at virtualsportgroup.com/account-deletion. The deletion page explains what we delete, what we keep and for how long.
Your social profile (your display name, friend code, friends and presence) is linked to your Epic Online Services player ID rather than to your account, so deleting your account does not delete it. To delete your social profile, email info@virtualsportgroup.com with your friend code and display name. The deletion page explains how we check the request.
The link between your Meta account and your SportX account is stored separately from your account record, so deleting your account in the app does not remove it. To have it deleted, email info@virtualsportgroup.com from the address on your account, or with your Meta display name. We will confirm your identity before acting.
If you agreed to analytics in the Android XR app, the app events our servers recorded are linked to your account and are deleted automatically after 30 days. The Meta Quest app does not collect analytics.
Deleting your account does not cancel a SportX Pro membership and does not give you a refund. Please cancel your membership first: if you bought SportX Pro on Meta Quest, cancel it at secure.oculus.com/my/subscriptions; if you bought it on Android XR through Google Play, cancel it at play.google.com/store/account/subscriptions. Deleting your account in the app does not delete your Google or Meta account.
13. Changes to this notice
We will update this notice when our data practices change. If we make a significant change, we will tell you in the app or by email before it takes effect. The version number and effective date at the top show which version applies.
In version 1.1 we described signing in with your Meta account on Meta Quest, buying SportX Pro through the Meta Horizon Store, inviting and joining friends on Meta Quest, direct messages between friends, and the app events our own servers record when you agree to analytics. We corrected what we say about the data RevenueCat receives, and added Meta Platforms to the list of providers in section 5.
In version 1.3 we made clear that our minimum age of 16 comes from our Terms of Service and is separate from the age rating shown in the app stores.
In version 1.2 we corrected our description of analytics and crash reporting. The Meta Quest app collects no analytics and sends no crash reports, and it does not use Google Analytics for Firebase, Firebase Crashlytics or Unreal Engine crash reporting. We removed those services from sections 5 and 7, and made clear that direct messages and app event analytics apply to the Android XR app only.
14. Contact us
Virtual Sport Group Ltd, Sticks & Glass, York Place Buildings 6-8, York Place, Leeds, West Yorkshire, England, LS1 2DS.
Email: info@virtualsportgroup.com