Privacy Policy
Virtual Me: Origins · Last updated 28 October 2026
Virtual Me: Origins turns things you really do into character stats. That only works if we can check evidence you send us — so this policy explains exactly what we collect, who processes it, and how to get rid of it.
Who we are
Virtual Me: Origins is developed by Richard de Souza. For any privacy question or request, contact privacy@virtualmeorigins.com.
Who can use the app
Virtual Me: Origins is for adults aged 18 and over. The app asks for your year of birth and will not let you continue if it indicates you are under 18. We do not knowingly collect data from children. If you believe a minor has used the app, email us and we will delete the account.
What we collect
| What | Why |
|---|---|
| Your name (first and last) | So we know who is who and can keep rewards fair. It is never shown to other players. Some future rewards may ask you to confirm it with an ID check; if we add that, we will explain it and update this page first. |
| Your email, if you sign in with Apple or another account | The address that account shares with us (with Apple this can be a private relay address). Used to keep your character attached to you and to contact you about your account. |
| Details you tell us — sex, year of birth, height, and anything you add under "About you" | Your stats are scored against people of a similar age and sex. Height is used to size your avatar correctly in connected games. |
| Photos, videos, screenshots and PDF files you send as proof, including live videos for stat tests | To check that you really did it. Reviewed automatically by AI. Files you upload, instead of taking them live in the app, may also be checked by a person. |
| Body scan photos (front, sides, back, face) | To make your 3D avatar. Sent to our avatar providers. |
| Your actions, habits, streaks, stats, skills and test results | The core of the app — your character. |
| Health and fitness data (with your permission) | Steps, workouts, sleep, active energy, exercise minutes, flights or floors climbed, distances walked, run, cycled or swum, and mindful minutes — read from Apple Health on iPhone or Health Connect on Android, to count physical effort. Read only — we never write to them. |
| Phone time (optional, only on phones that can measure it) | How long you use your phone each day, and on what kind of apps (for example games, social or learning). It is worked out on your phone; only which days earned a reward reaches our servers — never your minutes or the apps you used. |
| Accounts you connect — GitHub, Twitch, Google Calendar, X and Duolingo (optional) | See Connecting other services below. We read a few numbers about your own account and treat them as evidence. We never receive your password. |
| Advertising requests, if you send one | The company name, website, ad line and email you type, linked to your account, so we can answer you and run the ad. |
| An account identifier, and your Apple ID if you choose to link it | To keep your character attached to you. |
What we do not collect
- We do not collect your address, phone number or payment card details.
- We do not build face-recognition templates or any biometric identifier from your scans.
- We never look through your photo library. We only see a photo or file you choose to send.
- We do not track you across other apps or websites, and we do not sell your data. Ever.
- Ads are never aimed at you, and advertisers receive nothing about you (see Ads on skill cards).
Who can see your details
Other players never see your name, email, age, sex, height or "About you" details. The person who runs Virtual Me (today, the developer) can see them in a private admin screen, together with your stats, proofs and avatar scans. They are used only to run the app: answering you, approving proofs that need a person, giving out avatar scans, and keeping the game fair.
Fair play
Every night, an AI looks over each account's recent activity — stats and how fast they climbed, actions and their titles, proofs and stat tests — to spot signs of cheating. It is given no names, emails or account IDs. When something looks wrong, it flags the account for a person to look at. If an account is put on hold, its stats stop climbing until the stat tests are taken again, and a note that this happened stays with the account on our side.
Ads on skill cards
Some skill cards have up to three spaces where a business that teaches that skill can show a plain ad: a name, one line and a link. Ads are not aimed at you — everyone who opens that card sees the same ones. We count how many times an ad is tapped, not who tapped it, and advertisers receive nothing about you. Advertisers are not part of Virtual Me, and you never have to use or pay one to prove a skill.
Who processes your data
We use a small number of providers to run the app. They process data on our behalf and only for the purposes below.
| Provider | What they receive |
|---|---|
| Google Firebase and Google Cloud | Host the database, file storage, sign-in and our servers. Your account data and proof files are stored here. Google's AI (Gemini, run inside our Google Cloud project) watches proof videos to check them. |
| Anthropic | Checks photo, screenshot and PDF proofs, reads the actions you write, turns each day's activity counts into stat rewards, and runs the nightly fair-play check (without names or emails). |
| fal.ai, Tripo and Meshy | Turn your body scan photos into a 3D avatar: fal draws the character, Tripo builds the 3D model, Meshy adds the skeleton so it can move. Receive the scan photos and what is made from them. |
| Expo | Delivers app updates. Receives basic device and app-version information. |
| Services you connect (GitHub, Twitch, Google, X, Duolingo) | GitHub, Twitch, Google and X receive a login request from you and, if you approve, give us read access to the counts described below. For Duolingo we read your public profile. They receive nothing else from us. |
Connecting other services
Connecting is optional, and nothing is connected until you choose it. GitHub, Twitch, Google Calendar and X are connected by logging in and approving on that service's own screen. Duolingo has no login, so you put a short code in your Duolingo name once, which shows the account is yours.
- What we read: only numbers about your own account. GitHub: which days you code. Twitch: which days you stream. Google Calendar: how many events you have each day and how long they last — never what they say. X: your follower count, how many posts you make and how many reactions they get, about once a week — we never keep or use what your posts say. Duolingo: your public streak and XP. We do not read your messages, your feed, your friends, or other people's accounts.
- What we store: your username on that service, the access token it gives us (so we can read those numbers again later), and the numbers themselves. Tokens are kept on our server, never on other people's devices, and are used for nothing else.
- What we never do: post, message, follow, like, or change anything on your behalf; sell or share this data; or use it to advertise to you.
- Disconnecting: tap Disconnect in the app's Connected apps screen at any time. That deletes the token on our side at once. You can also remove Virtual Me's access from that service's own settings (for example Google's "Third-party apps" page, X's "Connected apps" page, GitHub's "Applications" page or Twitch's "Connections" page). For Duolingo, take the code out of your name.
- Data from Google: our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
Connecting a game
When you scan a game's QR code, you choose to share a read-only snapshot of your character — your stats, active perks, proven skills, connected app names, avatar files, and your height and avatar body measurements if you provided a height. Your name, email and age are not shared. Nothing is shared until you scan a code, the code expires after five minutes, and a game can never write back to your account or sign in as you.
How long we keep it
Your character data and avatars are kept while your account exists, because the whole point is a record that lasts. Proof files are kept so a reward can always be traced back to its evidence. Advertising requests are kept as a record of what was asked and agreed. If you ask us to delete your account, all of it goes.
Deleting your data
Email privacy@virtualmeorigins.com from the address linked to your account, or include your account ID from the app's Settings screen, and we will delete your account, avatars, proof files and stats within 30 days and confirm when it is done.
Your rights
Depending on where you live, you may have the right to access, correct, export or delete your data, and to object to how it is processed. Email us and we will help. You can also withdraw a permission at any time in your phone's settings — for example, revoking camera or health access.
Security
Data is transmitted over encrypted connections and stored on Google Cloud infrastructure with access rules that restrict each account's data to that account. No system is perfect, and we will tell affected users promptly if a breach ever occurs.
Testing releases
This app is currently distributed to a small number of invited testers through Apple TestFlight and Google Play internal testing. Test builds may change often and may contain features that are incomplete.
Changes to this policy
If we change what we collect or who processes it — including before we connect a new service — we will update this page and change the date at the top.