Leeds Rhinos Legends Privacy Notice
Version LRL-PN-1.0. Effective date: 11 September 2026.
1. About this notice
This notice explains how Virtual Sport Group Ltd collects and uses personal data when you use the Leeds Rhinos Legends app on Android XR devices (from Google Play) and on Meta Quest devices (from the Meta Horizon Store), including SportX Pro membership. It also explains your rights and how to use them.
We are the controller of the personal data described in this notice. Virtual Sport Group Ltd is a company registered in England and Wales with company number 15793472. Our registered office is Sticks & Glass, York Place Buildings 6-8, York Place, Leeds, West Yorkshire, England, LS1 2DS. You can contact us about privacy at info@virtualsportgroup.com.
Our website privacy policy covers visits to virtualsportgroup.com. This notice covers the app. The app is also governed by our Terms of Service.
2. Summary
- We use your data to run the app, your account, SportX Pro and the social features.
- We do not sell your personal data and we do not show adverts.
- Voice chat is live and we do not record it. The one exception: when you report someone, the last 30 seconds of audio from your lobby or party is sent with your report.
- The digital companions process your voice live and do not keep it.
- Analytics and crash reporting are off unless you agree, and you can change your choice in Settings.
- You can delete your account in the app or on our website.
3. Information we collect and how we use it
Browsing the library without an account
You can browse library artwork without signing in. To send the catalogue and artwork to your device, our hosting provider Cloudflare processes your device's IP address and standard technical information about the request, such as the time and the item requested.
To protect our services from abuse, our servers turn your IP address into a one-way code (a hash) and use it to limit how many requests can be made in a short time. We delete these codes after about two minutes. We do not use your IP address to work out where you are, and our servers do not record your device model or browser details.
Your account
When you sign in, Google Firebase Authentication creates an account for you and gives it a unique account ID.
- If you sign in with Google, Firebase receives the details your Google account shares for sign-in, such as your email address, name and profile photo. Firebase stores these on our behalf. Our own servers do not read or store your email address, name or photo. They store only your account ID and the time you signed in.
- Test and reviewer accounts that we create sign in with an email address and password, which Firebase stores.
Firebase also processes your IP address and device information when you sign in, to keep accounts secure.
Watching videos and My List
When you are signed in, we store:
- the videos you save to My List, and when you saved them
- your watch progress, so you can carry on where you left off, and a record of each progress update we receive, so we can keep your devices in sync
- short-lived playback sessions that let your device stream a video you have access to, which include the video, a coded session token and the time it was created and expires
- your membership status, such as whether you have SportX Pro and when it ends.
SportX Pro membership
On Android XR devices, you buy SportX Pro through Google Play. Google handles your payment. We do not receive your card or bank details.
- Google tells us about the purchase. For our records, Google's reports show us an order number and the country, and in some cases the city, region and postcode, of the buyer.
- RevenueCat manages memberships for us. It receives your account ID, the Google purchase token and your purchase history, and the type of device and operating system you use. RevenueCat uses your IP address to identify your country and does not keep it.
- Our servers ask RevenueCat whether your account has an active membership and store the result. When RevenueCat tells us your membership has changed, we store the notification ID, your account ID and the time for 30 days.
Friends, presence and profiles
The social features use Epic Online Services, run by Epic Games, which gives you a separate player ID for this app. Our social service stores, linked to that player ID:
- your display name, which starts as "Rhinos supporter" and which you can change
- a friend code, created at random, so friends can find you
- your friends list, your friend requests and the people you have blocked
- your presence, which is whether you are online, what you are doing in the app (in menus, watching, exploring or away) and whether you are in a party. We keep only your latest status, not a history.
Your friends can see your display name, friend code and presence.
Public voice lobbies and private parties
Public voice lobbies hold up to 16 people. When you join one, our servers record which lobby you are in while you are in it. Private parties are only open to your friends, and our servers check that neither of you has blocked the other before an invitation is sent.
Other people in a lobby or party can see your display name and hear you when you speak. Your voice is sent live through Epic Online Services to the other people in the lobby or party. We do not record or transcribe voice chat, except for the short clip sent with a report, described below.
Microphone
Voice chat and the digital companions need permission to use your device's microphone. You can refuse or withdraw this permission in your device settings at any time.
Digital companions in the Legends Tunnel (Meta Quest)
When you talk to a digital companion, the app sends what you say to our supplier Abyshire Technology Ltd (company number 14718576). Abyshire turns your speech into text, creates the companion's reply and turns the reply into speech. It processes your voice live, only to create the reply, and does not keep recordings or transcripts. Some of this processing takes place in the United States.
Reports
If you report another user, we store your player ID, their player ID, the category you chose (harassment, hate, spam or other) and anything you write in the report. We use this to investigate and keep people safe. We delete reports after 30 days.
While you are in a lobby or party, the app keeps the last 30 seconds of its audio on your device, replacing it continuously. This audio does not leave your device unless you report someone. If you do, that 30-second clip is sent with your report to Epic Online Services, where our team reviews it. The clip may include the voices of other people in the lobby or party, and other users' reports may include your voice. Reported clips are deleted after 30 days.
Analytics and crash reports (only if you agree)
The app asks whether you agree to analytics and crash reporting. If you agree:
- Google Analytics for Firebase collects information about how you use the app, such as when you open it and which parts you use, together with your device model, operating system, app version, language, approximate location based on your IP address, and an ID for your installation of the app.
- Firebase Crashlytics (from Google) and Unreal Engine crash reporting (from Epic Games) collect crash reports. These contain technical details of the crash, your device model and operating system, and an ID for your installation of the app.
We use this information to understand how the app is used and to fix problems. We do not use it for advertising, and the app does not collect your device's advertising ID. You can change your choice at any time in the app's Settings.
When you contact us
If you email us, we use your email address and what you tell us to reply and to deal with your request.
Storage on your device
The app stores information on your device that it needs to work, such as the details that keep you signed in and your settings. The software our service providers supply for sign-in, voice chat and purchases also stores information on your device so that those features work. We do this because it is strictly necessary to provide the app you have asked for. Analytics and crash reporting only store or read information on your device if you agree.
4. Our legal reasons for using your data
Data protection law requires us to have a legal reason, called a lawful basis, for each use of your personal data.
| What we do | Lawful basis |
|---|---|
| Create and run your account, sign you in, stream videos, save My List and watch progress | Performing our contract with you (the Terms of Service) |
| Check and apply your SportX Pro membership | Performing our contract with you |
| Run friends, presence, display names, voice lobbies and private parties | Performing our contract with you, when you choose to use these features |
| Send your speech to a digital companion and play its reply | Performing our contract with you, when you choose to talk to a companion |
| Collect analytics and crash reports | Your consent, which you can withdraw at any time |
| Handle reports, enforce our community rules and protect users | Our legitimate interest in keeping the app safe, and our legal duties under online safety law |
| Limit requests and prevent abuse and fraud | Our legitimate interest in keeping our services secure and available |
| Respond to your messages and requests | Our legitimate interest in helping you, or performing our contract with you |
| Keep business and financial records | Our legal obligations, such as tax and accounting law |
| Deal with legal claims and requests from authorities | Our legitimate interest in protecting our rights, and our legal obligations |
Where we rely on legitimate interests, we have considered your interests and rights and concluded they do not override ours. You can ask us for more detail and you can object (see section 10).
We do not make decisions about you based solely on automated processing that have a legal or similarly significant effect on you.
We do not sell your personal data.
5. Who we share your data with
We use service providers who process personal data for us, on our instructions and under contracts that protect it:
| Provider | What they do for us | Where the data is processed |
|---|---|---|
| Google (Firebase Authentication, Google Analytics for Firebase and Firebase Crashlytics) | Accounts and sign-in, and analytics and crash reports if you agree | United States and other countries where Google has facilities |
| RevenueCat | Membership management | United States |
| Epic Games (Epic Online Services and Unreal Engine) | Player IDs, lobbies and voice chat, and crash reports if you agree | United States |
| Abyshire Technology Ltd | Speech recognition, replies and speech for the digital companions | United Kingdom and United States |
| Cloudflare | Hosting our servers and databases and delivering video | Our databases are in western Europe. Cloudflare delivers content through its global network. |
We also share information with:
- Google and Meta, which run the app stores and platforms the app is provided through. Google processes your SportX Pro purchases. They use your information under their own privacy policies.
- Other users, as described in section 3, for example your display name and your voice in a lobby.
- Professional advisers, such as lawyers and accountants, where needed.
- The police, regulators, courts or other authorities, where the law requires it, or where we reasonably believe it is necessary to protect someone from serious harm.
- A buyer or successor, if our business or its assets are sold or transferred. We will tell you if this happens.
6. International transfers
Some of our providers process data outside the UK and the European Economic Area, particularly in the United States. When personal data is transferred, we rely on legal safeguards:
- Google is certified under the EU-US Data Privacy Framework and its UK Extension, and its data processing terms include standard contractual clauses.
- RevenueCat and Cloudflare use the European Commission's standard contractual clauses together with the UK International Data Transfer Addendum.
- Epic Games is covered by its data processing agreement with us, which includes the European Commission's standard contractual clauses.
- Abyshire Technology Ltd uses the UK International Data Transfer Agreement or the UK Addendum to the standard contractual clauses for processing in the United States.
You can ask us for more information about these safeguards.
7. How long we keep your data
| Data | How long we keep it |
|---|---|
| IP address hash used to limit requests | About 2 minutes |
| Playback sessions | Until about 24 hours after the session ends |
| Membership change notifications from RevenueCat | 30 days |
| Friend requests | 7 days, or until accepted, declined or cancelled if sooner |
| Reports | 30 days |
| Speech sent to a digital companion | Not kept by Abyshire once the reply has been created |
| Voice clip sent with a report | 30 days |
| Analytics data (Google Analytics for Firebase) | Up to 14 months |
| Crash reports in Firebase Crashlytics | 90 days |
| Crash reports sent to Epic Games | As long as needed to investigate and fix the crash |
| Public lobby membership | While you are in the lobby |
| Blocks | Until the person who made the block removes it. If your social profile is deleted, other users' block lists may still contain your player ID. |
| Account ID, My List, watch progress and membership status | While your account is open. When you delete your account, we delete this data within 30 days, and copies in our database backups are removed within a further 30 days. |
| Display name, friend code, presence and friends list (your social profile) | Until you ask us to delete your social profile (see section 12) |
| Record that an account deletion was completed, which does not include your account ID or email address | 12 months |
| Account details held by Firebase | While your account is open. After an account is deleted, Google removes the data from its live and backup systems within 180 days. |
| Emails you send us | As long as we need them to deal with your request |
8. How we protect your data
We use technical and organisational measures to protect your personal data. For example:
- data sent between the app and our servers is encrypted in transit
- sign-in is handled by Firebase Authentication, and our servers check every sign-in token before giving access to your data
- we store coded (hashed) versions of IP addresses and playback tokens instead of the originals
- we keep only the data each feature needs, and we delete short-lived data automatically, as shown in section 7.
No system is completely secure. If a breach of your personal data is likely to put you at high risk, we will tell you without undue delay.
9. Children
The app is for people aged 16 and over. If we learn that someone under 16 is using the app, we will close their account. If you think a child under 16 is using the app, please tell us at info@virtualsportgroup.com.
10. Your rights
Depending on where you live, you have rights over your personal data. In the UK and the European Economic Area, these include the right to:
- access your personal data and get a copy of it
- correct data that is wrong or incomplete
- delete your data in some circumstances
- restrict how we use your data in some circumstances
- object to our use of your data where we rely on legitimate interests
- data portability, which means receiving data you gave us in a machine-readable format, or having it sent to another organisation, where we rely on our contract with you
- withdraw consent at any time, where we rely on your consent.
To use any of these rights, email info@virtualsportgroup.com. We may need to confirm your identity first. We will reply within one month. If your request is complex, or you make several requests, we may need up to two more months and will tell you if so. Using your rights is usually free.
You can change your display name in the app, remove videos from My List, unblock people and change your analytics and crash reporting choice in Settings at any time.
11. Complaints
If you are unhappy with how we have used your personal data, you can complain to us by emailing info@virtualsportgroup.com. We will acknowledge your complaint within 30 days, look into it without undue delay, keep you updated and tell you the outcome. If you are under 18 and your complaint is urgent, please say so in your email.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. If you live in the European Economic Area, you can complain to the data protection authority in your country.
12. Deleting your account
You can delete your account at any time in the app, under Settings, then Account & membership, then Delete account, or on our website at virtualsportgroup.com/account-deletion. The deletion page explains what we delete, what we keep and for how long.
Your social profile (your display name, friend code, friends and presence) is linked to your Epic Online Services player ID rather than to your account, so deleting your account does not delete it. To delete your social profile, email info@virtualsportgroup.com with your friend code and display name. The deletion page explains how we check the request.
Analytics data is linked to your installation of the app, not to your account, so deleting your account does not delete it. It is deleted automatically within 14 months.
Deleting your account does not cancel a SportX Pro membership and does not give you a refund. Please cancel your membership in Google Play first, at play.google.com/store/account/subscriptions. Deleting your account in the app does not delete your Google or Meta account.
13. Changes to this notice
We will update this notice when our data practices change. If we make a significant change, we will tell you in the app or by email before it takes effect. The version number and effective date at the top show which version applies.
14. Contact us
Virtual Sport Group Ltd, Sticks & Glass, York Place Buildings 6-8, York Place, Leeds, West Yorkshire, England, LS1 2DS.
Email: info@virtualsportgroup.com