Legal · Privacy Policy
Privacy Policy
This policy describes what SigChain Guard actually collects, why, where it goes and how long it stays — written against the system as it runs today, not as we hope it will run. Where something is not automated yet, the policy says so rather than promising it.
The short version. We hold two kinds of data: developer account data (yours — email, login, games, billing status) which we control, and player validation data (hashed device identifiers and integrity signals from headsets running your game) which we process on your instructions. We do not sell either, we do not run advertising or analytics trackers, and we never receive player names, emails or accounts.
01Who we are and the two roles we play
SigChain Guard ("SCG", "we") is an independently operated anti-cheat service for Unity VR games. Contact for anything in this policy: support@sigchainguard.com.
For developer account data — the information you give us to run an account — we are the controller (the party deciding how and why it is used).
For player validation data — what the SDK collects from a headset when your game calls it — we are your processor (under the GDPR) or service provider (under the CCPA). You decide to use the Service in your game and you tell your players; we process that data only to give you verdicts and the dashboard, on your instructions and under the Terms of Service. Players with questions about a specific game should contact that game's developer; we will help the developer answer.
02Developer account data we collect
| Data | Why | How it is stored |
|---|---|---|
| Email address | Sign-in, verification, security codes, service notices | Plain text — it has to be, to email you |
| Password | Sign-in | bcrypt hash only; we cannot read it |
| Age and Terms confirmation | Eligibility (18+) and evidence of acceptance | Timestamp and the Terms version you accepted |
| Two-factor and one-time codes | Sign-in second step, sensitive actions | Hashed; expire within minutes; used codes are deleted nightly |
| Session | Keeping you signed in for up to 7 days | A first-party cookie (scg_session, HttpOnly, Secure) whose value is stored as a hash, bound to a hash of your browser's user-agent string |
| Game registration | Issuing and verifying your API key | Game name, Android package name, the SHA-256 fingerprint of your signing certificate; your API key is encrypted at rest with a key held outside the database |
| APK you upload to register a game | Extracting the signing certificate | Processed on our server and deleted from disk as soon as the certificate is read; never kept |
| Plan and usage | Limits, overage, the dashboard | Plan, monthly active player counts per month, validations-per-minute, rate-limit events aggregated per minute |
| Beta key use | Invite-only access; stopping key sharing | The key's hash, when it was used, and a hash of the browser that used it |
| Discord webhook (optional) | Sending you alerts you configured | The webhook URL you paste, which alert types you want, and a failure counter |
| Discord account link (optional) | Letting the Discord bot act for your account | Your Discord user ID, username and avatar URL, and when you linked; link tokens are single-use, hashed and expire in 10 minutes |
| Support email | Helping you | Kept in our mailbox as ordinary correspondence |
| IP address and user agent | Rate limiting, abuse prevention, security | Used in memory and in short-term server logs; not attached to your account record |
When paid plans open, Lemon Squeezy will collect your billing details as merchant of record under its own privacy policy; we receive your plan, invoice status and a customer reference — never card numbers.
03Player validation data we process for you
When your game calls the SDK, the headset produces a sealed payload and our server checks it. This is what that involves:
| Data | What it is | Kept? |
|---|---|---|
| Device identifier | A one-way hash computed on the headset from hardware-backed values. We never receive the underlying serial numbers, and the hash cannot be reversed into them | Yes — it is how bans, allow-lists and "same device across games" work |
| Hardware attestation | A certificate chain the headset's secure hardware signs against a one-time challenge from us, proving the request came from genuine, unmodified hardware | Verified in memory; not stored |
| Integrity signals | Whether the device reports root, hooking frameworks, developer mode, an unlocked bootloader, an unusual installer, and similar. Some are hardware-proven, some are the device's own report — the documentation says which | Yes, as part of the validation record |
| Device model and SDK version | So you can see what your players run and so we can retire old SDKs safely | Yes |
| Result and timing | Pass/fail, which checks failed, when, how long the check took, which endpoint answered | Yes |
| Network reputation | Per device hash, across all SCG-protected games: how many validations, how many games have banned it, whether it is blacklisted. This is what makes cross-game banning possible | Yes, in aggregate per device hash |
| Your moderation actions | Bans, flags, allow-listed devices, the message you show a banned player | Yes, until you change them |
| IP address | Used for per-address rate limits on the challenge and validation endpoints | In memory and short-term server logs only; not written to the validation record |
What we never receive about players: names, email addresses, account or platform IDs, friends, voice, gameplay content, precise location, or payment information. The SDK is designed not to send them, and the Terms forbid developers from adding them.
The validation record has room for a device serial and a device fingerprint that the current SDK does not send; those columns are empty for every record we hold. If a future SDK ever sends them, this policy will be updated first.
04How we use data, and on what basis
- To provide the Service — verdicts, the dashboard, key rotation, the Discord bot. Basis: performance of our contract with you.
- To keep it secure — rate limiting, detecting abuse, protecting other customers. Basis: our legitimate interest in running a secure service, which is also yours.
- To meter and bill — counting verified players per month; when paid plans open, invoicing through the merchant of record. Basis: contract, and legal obligations around tax records.
- To contact you — verification codes, security notices, changes to these documents, and replies to your support requests. Basis: contract and legitimate interest. We do not send marketing email during the beta; if we ever do, you will be able to opt out in every message.
- Optional integrations — Discord alerts and account linking only when you turn them on. Basis: your consent, withdrawable by disconnecting.
Automated decisions. Our server decides automatically whether a device passes its checks and returns that result to your game. It does not decide what happens to the player — you configure that, and any consequence for a player is your decision under your own rules. We do not build profiles of players beyond the anti-cheat purpose described above.
What we do not do. We do not sell or rent personal information, we do not share it for cross-context behavioural advertising, we do not run third-party analytics or advertising trackers on the site or in the SDK, and we do not use developer or player data to train machine-learning models.
05Who else touches the data
We use a small number of providers to run the Service. Each receives only what its job requires, under its own contractual and security commitments.
| Provider | Role | Data | Where |
|---|---|---|---|
| Supabase | Database | Everything in sections 2 and 3, encrypted at rest | United States (AWS, Oregon) |
| Railway | Runs the API and processes APK uploads | All requests in transit; short-term server logs | United States (west) |
| Vercel | Hosts the website and dashboard | Standard web-server request logs | Global edge network; origin in the United States |
| Resend | Sends our email | Your email address and the message content (codes, notices) | United States |
| Google Fonts | Serves the typefaces the site uses | Your IP address and browser details, as with any web font request; no cookies | Google's network |
| Discord | Only if you connect a webhook or link an account | Alerts you configured; your Discord user ID and profile if you link | Discord's network |
| Lemon Squeezy | Billing, when paid plans open | Your billing details; our plan and invoice references | United States / EU |
We may also disclose data if the law requires it, to protect the rights and safety of players, customers or the public, or as part of a merger or sale of the Service — in which case this policy continues to apply and you will be told.
Discord alerts, precisely. If you connect a webhook, an alert can contain the first eight characters of the already-hashed device identifier, the result and reason, and — depending on your plan — device model, SDK version and failed checks. Full device hashes are never sent to Discord.
06Cookies and local storage
The public website sets no cookies. The dashboard sets one first-party cookie, scg_session, when you sign in; it is HttpOnly and Secure, lasts 7 days, and exists only to keep you signed in. Signing out deletes it.
The site remembers your light/dark theme choice and whether an intro animation has already played, in your browser's local storage. That data never leaves your device and clearing site data removes it.
We use no analytics cookies, no advertising cookies and no third-party cookies, so there is no consent banner because there is nothing to consent to.
07How long we keep data — as it actually works today
Honesty note. Earlier versions of this policy promised automatic retention windows that the system did not enforce. This version describes what happens today. When we add automatic windows, we will update this section first.
- Account data is kept while your account exists. Ask us to close it and we delete the account and its games, keys and settings; we aim to complete that within 30 days.
- Validation records and device hashes are kept while the game they belong to is registered. There is no automatic purge yet. You can ask us to delete the records for a game at any time, and they are deleted when the account is closed.
- Network reputation for a device hash is kept as long as any SCG-protected game has recorded it, because it protects other developers too. When you unban a device, its cross-game count is reduced accordingly.
- Sessions, one-time codes, Discord link tokens and onboarding tokens are deleted every night once expired or used. A rotated-out API key is removed 30 days after rotation.
- One-time challenges are consumed on use and any that go unused are deleted within a minute.
- Uploaded APKs are deleted from disk as soon as the certificate is extracted.
- Monthly active player counts: the per-device, per-month tracking rows are deleted after three months; only the current month's counter on your account remains.
- Server logs are held by our hosting provider for a limited period and then rotate out. During the beta our servers run with detailed logging on, which means log lines can include hashed device identifiers and one-time challenge values. We use these logs only to debug the Service. We intend to turn detailed logging off at public launch.
- Backups made by our database provider are retained for a short period for disaster recovery and are not used for any other purpose; deleted data leaves them on their normal rotation.
- Billing records, once paid plans open, are kept as long as tax and accounting law requires.
08Security
Everything travels over TLS. Passwords are stored as bcrypt hashes, session tokens and one-time codes as hashes, and API keys encrypted with a key kept outside the database. Database access is restricted to our own server with row-level security enabled as a second line. Sign-in supports email two-factor authentication, and sensitive dashboard actions ask for your password again. The SDK computes device identifiers on the headset and seals its payload so that the values cannot be read or altered in transit.
No system is perfectly secure. If we learn of a breach that affects your data, we will tell you without undue delay — and within 72 hours where the law requires — by email, with what we know and what you should do.
09Children
Developer accounts are for adults. You must be 18 or older to hold one, and you confirm this at sign-up. We do not knowingly collect information from anyone under 18 through the dashboard; if we learn we have, we delete it and close the account.
Players may be of any age — that is between them and the game they play. The SDK is designed so that we never receive information that identifies a player as a person, which is why COPPA's verifiable-parental-consent rules do not attach to what we receive. If your game is directed at children under 13 in the United States, or at children under the age of digital consent in Europe, you are responsible for your game's compliance, including how you describe SigChain Guard to parents, and you must not add personal information to what the SDK sends.
10Your rights and how to use them
Wherever you are, you can email support@sigchainguard.com from your account address to:
- Access a copy of the personal data we hold about your account;
- Correct it — most of it you can change yourself in the dashboard;
- Delete it by closing your account, or delete the validation records of a specific game;
- Export your account and game data in a machine-readable format;
- Object to or restrict processing based on our legitimate interests, or withdraw consent for an optional integration by disconnecting it.
We verify requests using the account email and, for anything sensitive, a second factor. We answer within 30 days, or tell you why we need longer. We will not treat you differently for exercising a right.
If you are in the EU, EEA, UK or Switzerland
Our legal bases are listed in section 4. Our servers are in the United States, so your data is transferred there; where the law requires a transfer mechanism we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum), which we will provide on request. You also have the right to complain to your local data protection authority, though we would appreciate the chance to resolve the issue first.
If you are in California
In the last twelve months we have collected the categories described in sections 2 and 3: identifiers (email, hashed device identifiers), internet and device activity (validation records, server logs), commercial information (plan and usage), and professional information (the games you register). We do not sell personal information and do not share it for cross-context behavioural advertising, and we have not done so in the past twelve months, so there is no "Do Not Sell or Share" choice to make. You have the rights to know, delete, correct and to non-discrimination described above; an authorised agent may act for you with written permission. We do not use or disclose sensitive personal information for purposes other than providing the Service.
Other US states
Residents of states with comprehensive privacy laws have similar rights, exercised the same way. We do not engage in targeted advertising, sale of personal data, or profiling with legal effects.
11A note to players
If a game you play uses SigChain Guard, the game asked our servers whether your headset was genuine and unmodified when you started a session. We received a one-way hash of your device, the outcome of hardware checks, your headset model and the SDK version — not your name, account, voice or anything you did in the game. The game's developer decides what to do with the result. Questions about a ban or flag in a specific game go to that developer; if you believe our data about your device is wrong, email us and we will investigate with them.
12Changes to this policy
When we change this policy in a way that matters — new data, new purposes, new providers, or a change to retention — we will email account holders and show a notice in the dashboard at least 14 days before it takes effect, and the version and date at the top of this page will change. Minor clarifications take effect when posted. Earlier versions are available on request.
13Contact
Privacy questions, requests and complaints: support@sigchainguard.com. Put "Privacy" in the subject line and it will be handled first.
Version 2.0 · effective 19 September 2026. Changes from the 27 July 2026 policy: written against the running system — retention now states what is automated and what is not; Discord account linking, Resend, Vercel and Google Fonts added as providers; the age/Terms confirmation recorded at sign-up added; the two-role (controller/processor) structure made explicit; beta logging disclosed; a note to players added.