Privacy Policy
- Version: 2026-10-16.10
- Effective date: October 16, 2026
- Last updated: November 1, 2026
- This policy is available in Chinese, Japanese, English and Korean. If the versions differ, the Chinese version prevails, unless mandatory law where you live says otherwise.
This policy explains what personal information VRChat Match ("the Platform", "we", "us") collects, how we use it, where it is stored, how long we keep it, and what rights you have. We describe what the website actually does, and we will update this policy when that changes.
1. Who handles your information
VRChat Match is a community platform for VRChat players, created and maintained by an independent developer based in Australia, and run independently, not as a company. The operator decides the purposes and means of processing personal information on the Platform.
- Location: Victoria, Australia
- Contact email for personal information matters: admin@vrchatmatch.com
If applicable law entitles you to the operator's name or postal address, please request it by emailing admin@vrchatmatch.com.
2. What we collect
2.1 Account information
- Email address: used to sign in, receive verification codes and reset your password. It is never shown to other users.
- Password: we only store the result of processing it with the argon2 algorithm. Nobody, including us, can see the original.
- Account records: when you signed up, account status, whether your email is verified, which version of this policy and the Terms of Service you agreed to and when, and when you were last active (updated at most every 10 minutes).
- Discord account (only if you sign in with Discord or link Discord): your Discord user ID and display name. During authorization Discord also tells us your Discord email and whether it is verified; we use it only to check whether the Platform has an account with the same email, and do not store it. We do not obtain or store your Discord sign-in credentials, and do not read your friends or servers. Deleted when you unlink Discord or delete your account; if an account banned for violations is deleted, we keep only a cryptographic hash of the Discord user ID to prevent re-registration.
You can sign in with email and password, or with your Discord account, and you can link Discord in Settings. Accounts registered with Discord only have no email or password; you can add them later in Settings.
2.2 Profile
Apart from your nickname, every profile field is optional:
| Field | Who can see it |
|---|---|
| Nickname, avatar | Everyone (avatar image links open without signing in) |
| Bio, tags, avatar models, devices, spoken languages, MBTI, platforms, home and current country or region, current city, online/offline balance, time zone and usual online hours, relationship goals | Signed-in users |
| Gender, preferred genders | Only you by default; signed-in users can see them if you turn on "public" |
| Birthday (required) | Others never see your date of birth itself; you can choose to show your age, your birthday and star sign, or nothing (the default). We use it to tell whether you are a minor (16–17) or an adult; see section 12 |
| VRChat username | Logged-in users by default; you can change it to only your friends in Settings (you then can't see non-friends' usernames either). Minors and adults never see each other's. People who can see your username can also find you in user search by typing it in full (not by part of it) |
Gender and preferred genders may be sensitive. We only use them for "Partner" matching and the default colour palette. You can leave them empty or clear them at any time.
2.3 Content you post and interactions
- Posts (text, images, videos), comments, likes, reposts;
- World shares, recommendations, ratings and ranking votes;
- Events and sign-ups;
- Relationship charts;
- Follows, friendships and your block list;
- Anonymous ratings between friends: other users cannot see who wrote them, but our database records the author to prevent abuse and handle reports.
If an image contains real-life identity information (for example, a photo of a real person), a moderator may blur it. After that, everyone else (and you) can only see the blurred version. The original can only be seen by moderators, is kept so a mistaken blur can be undone, and is stored until the content it belongs to is deleted or you delete your account. Every time a moderator views an original, it is logged.
2.4 Direct messages
Direct messages are stored on our server and only the two people in the conversation can see them. They are encrypted in transit, but not end-to-end encrypted. When handling a report about a message, an administrator sees that message and up to 20 messages before and after it in the same conversation. In cases involving a threat to someone's safety, the safety of a minor, a hijacked account, or a lawful investigation by an authority with jurisdiction, an administrator may view the whole conversation the reported message is in, but not the reported person's other conversations. Every such view is recorded: who, when and why. We do not spot-check direct messages or look at them for reasons unrelated to safety.
2.5 Information created automatically when you visit
- Sign-in records: the IP address and time of sign-ups, sign-ins (including failed ones and Discord sign-ins), linking and unlinking Discord, password resets and account deletions, used to detect hijacked accounts, prevent abuse and handle reports.
- IP addresses and request records: the server's runtime logs record the IP address, time and address of each request, used to fix problems and fend off attacks.
- Rate limiting: to prevent brute-force attempts and abuse, the server briefly counts requests per IP address in memory.
- Operations statistics: totals such as request counts, error counts and response times, with no IP addresses or personal information.
- Relationship chart view counts: signed-in users are counted by account. Visitors who are not signed in are counted by a random ID in the browser; the server only stores a hash of that ID.
2.6 Contact, reports and appeals
When you email us, report content or appeal, we receive what you provide, any related evidence, our email exchanges and the outcome.
2.7 What we do not collect
- We do not collect payment information (the Platform currently has no paid content).
- We do not use analytics, advertising or third-party tracking tools.
- We do not ask for your real name, phone number or identity documents. Please do not post your address, ID numbers, private phone number or similar information publicly.
3. Why we use your information
| Purpose | Information used |
|---|---|
| Signing up, signing in, resetting passwords | Email, password, verification codes |
| Showing your profile and content | What you fill in and post, within the audience you choose |
| Match recommendations | Tags, avatar models, languages, time zone and online hours, country or region, relationship goals, gender and preferred genders (only for "Partner") |
| Friends, messages, notifications | Friendships, messages, interaction records |
| Security and abuse prevention | IP addresses, sign-in records, request records, reports, soft-deleted content |
| Handling problems and requests | Email exchanges |
| Maintaining and improving the website | Operations statistics (totals, no personal information) |
| Complying with the law | Information the law requires us to process or keep |
Recommendations only make suggestions based on the information above. They are not used to determine your real identity or creditworthiness and do not produce decisions with legal effects on you. We do not use your information for advertising and we do not sell your personal information.
4. Translation
The "Translate" button next to posts, events and bios uses your browser's built-in translation (currently Chrome and Edge on computers). The browser does the translation: the content is not sent to our server, and we do not pass it to any other service. How the browser itself handles it is described by the browser's maker.
5. Cookies and browser storage
| Name | Type | Purpose | Duration |
|---|---|---|---|
access_token | Cookie, readable only by the server | Keeps you signed in | 7 days |
discord_oauth, discord_pending, discord_reauth | Cookie, readable only by the server | Checks the authorization and holds the Discord account waiting for confirmation when you sign in with, link or verify with Discord | 10 minutes |
vrcm-locale | Cookie | Remembers your interface language | 1 year |
vrcm-palette and similar | Browser local storage | Colour palette and light or dark mode, world list view, photo wall settings, how often you use navigation entries | Until you clear your browser data |
vrcm-diagram-client | Browser local storage | Counts relationship chart views when you are not signed in (see 2.5) | Until you clear your browser data |
vrcm-post-draft:* | Browser local storage | Your unpublished post draft (title, body, tags, links to images and videos you uploaded), on this device only | Deleted when you publish, discard the draft or sign out; at most 30 days |
All of these are needed for the website to work. We have no analytics, advertising or third-party tracking cookies. You can clear them in your browser, but after clearing access_token you will need to sign in again.
6. Service providers and sharing
We only give information to others in the following cases:
| Provider | What it does | Information it handles | Location |
|---|---|---|---|
| Alibaba Cloud | Provides our server: the website, database, uploaded images and videos, and backups are all on it | All information the Platform stores | Singapore |
| Resend | Sends verification code emails | Recipient address, verification code and email content | US company, sending from Japan |
| Discord | Sign-in with Discord and linking | The user ID, name and email you agree to share on Discord's authorization page; Discord also learns that you use the Platform | US company |
| VRChat | Getting a world's name, author, supported platforms and cover (fetched by our server); when you add a world, the candidates' thumbnails are loaded by your browser directly from VRChat | None of your account information; VRChat sees your IP address when your browser loads the thumbnails | US company |
In addition:
- Emails sent to admin@vrchatmatch.com are stored on a mail server the operator manages in Australia. That server also checks regularly that the website is working, but it does not read user information.
- When the operator signs in to the server from Australia for maintenance, handling reports or replying to emails, they access the information that is needed.
- We may provide necessary information when the law requires it, or when genuinely necessary to protect the safety of users or others.
- Content you choose to make public can be seen by other users.
- Pages that can be viewed without signing in (the home page, worlds, events, rankings, the app market and the policy pages) are indexed by search engines, and world, event and app covers may appear in image search. Recommendation reasons and comments in the app market can be seen without signing in and may also be indexed. Posts, profiles, messages, relationship charts, disputes and other pages that need sign-in are not indexed.
Other than this, we do not give your personal information to anyone.
7. Where your information is stored and international transfers
The Platform serves users in many countries and regions, so your information is stored and processed outside where you live:
- Singapore: where the server is; all information is mainly stored here;
- Australia: where the operator is; the operator accesses necessary information from here, and emails from users are stored here;
- United States and Japan: when verification emails are sent through Resend.
We take protective measures proportionate to the risk (see section 9). If the law where you live has additional requirements for processing abroad (for example, separate consent or more information), please email us and we will handle it in accordance with the law.
8. How long we keep information
| Information | Retention |
|---|---|
| Accounts, profiles, posts, messages, etc. | While the account exists; after it is closed, see section 11 |
| Posts and comments you delete | Hidden from others immediately; a deletion record stays in the database for handling reports and disputes |
| Access logs (including IP addresses) | Cleared each time the website is updated, usually within a few days; not archived elsewhere |
| Sign-in records (including IP addresses) | 90 days; records an administrator preserves while handling a report are kept for 1 more year after the report is closed |
| Administrator access records | Long-term, to keep track of administrators viewing sign-in records, messages and account information |
| IP counts for rate limiting | Only in memory, expire after a few minutes |
| Verification codes | Only a hash is stored; it stops working when it expires |
| Operations statistics | No personal information; per-minute details for 48 hours, hourly totals for 90 days, daily totals long-term |
| Reports and their outcomes | 3 years after they are handled, for handling disputes and preventing repeat violations; kept for as long as a resulting permanent ban is in force |
| Originals of images blurred by a moderator | Until the content they belong to is deleted or the uploader deletes their account; only moderators can see them |
| Backups | One per day, the last 7 days kept |
9. Security
- The whole site uses HTTPS;
- Passwords are stored after argon2 processing, and verification codes only as hashes;
- The sign-in cookie can only be read by the server;
- The server only opens the ports it needs, and only the operator has administrative access;
- Daily backups, with the last 7 days kept.
No online service can guarantee complete security. Please keep your password safe and avoid revealing private details in public.
10. Your rights
Depending on the law where you live, you may have the right to:
- know how we handle your personal information;
- access or get a copy of your personal information;
- correct inaccurate information;
- delete your personal information or delete your account (you can do this yourself on the "Settings" page; see section 11);
- withdraw consent;
- restrict or object to certain processing where the law provides;
- move your personal information to another service where applicable;
- ask us to explain our processing rules;
- complain to a data protection authority.
You can edit or clear most profile information yourself on the "My profile" and "Settings" pages. For other requests, email admin@vrchatmatch.com from your registered email address. To prevent misuse, we may need to confirm that you own the account. We will respond promptly as required by law, and explain if we cannot fulfil a request.
11. Closing your account
You can delete your account at any time on the "Settings" page. Enter your current password and the confirmation word and the account is deleted immediately; this can't be undone. If you can't sign in, email admin@vrchatmatch.com from your registered email address and we will delete it for you.
After deletion:
- Deleted: your profile (every field, including avatar, birthday, gender, tags and VRChat username), posts with their images and videos, comments, likes, reposts, events you organised (ones that haven't ended are cancelled first and attendees are notified), event sign-ups, follows, friendships, your block list, notifications, relationship charts, anonymous ratings between friends (ones you wrote and ones written about you), and your world recommendations, ratings and ranking votes. For posts and comments, only an empty deletion record stays in the database.
- Kept: messages you sent (they are also the other person's chat history) and worlds you added stay, shown as "Deleted user" with no avatar, and nobody can message you any more. Reports and their outcomes are also kept for handling disputes.
- Account record: only an ID number remains; your email, password, consent records and so on are all cleared. You can sign up again with the same email right away. If a banned account is deleted, we keep a hash of its email address to stop it signing up again. The hash does not reveal the address, but it can still be matched to the same address, so we still protect it as personal information.
- Sign-in records: not deleted immediately; they are removed when the period in section 8 ends, so that security problems from before the deletion can still be handled.
- Backups: data in backups is removed within 7 days, together with old backups.
We cannot delete content that others have already screenshotted, reposted or saved separately.
12. Minors
You must be at least 16 to sign up, and users under 18 need permission from a parent or guardian first.
Your date of birth is required in your profile. Based on it, we place users in two groups: minors (16–17) and adults.
- You only appear in matches and search results for people in your own group.
- People in different groups cannot add each other as friends or exchange direct messages. Existing friendships and conversations between the groups are kept, but no new messages can be sent.
- Minors cannot choose "Partner" as a relationship goal and can only exchange direct messages with friends.
You move to the adult group automatically on your 18th birthday. You can correct your date of birth yourself, but changing it from a minor to an adult age requires emailing admin@vrchatmatch.com so we can check it first.
If you are a parent or guardian and believe your child signed up or provided personal information without your permission, please email admin@vrchatmatch.com and we will act quickly.
13. Security incidents
If a security incident may harm personal information, we will investigate, contain and remedy it as quickly as possible. Where the law requires, we will notify affected users and the relevant authorities, explaining what information is involved, the possible impact, what we have done, and how you can protect yourself.
When handling reports, hijacked accounts or other security problems, an administrator may view the sign-in records of the users involved. They must link a report or give a reason first, and every view is recorded. Where needed, an administrator may preserve the relevant sign-in records until the report is closed (see section 8).
Administrators can also view users' account information (email address, date of birth and account status) in the admin panel, to handle reports, check ages and deal with account problems. Every view is recorded.
We only provide information relevant to a specific matter when an authority with jurisdiction makes a lawful request. We do not give other users' IP addresses, sign-in records or messages to ordinary users or other third parties who ask for them.
14. Future paid features
The Platform is currently free and does not collect payment information. If we add paid features, we will update this policy before collecting any payment information, explaining the payment provider, the information involved and how long it is kept.
15. Changes to this policy
We will update this policy when features, providers or laws change. For major changes, we will ask you to read and agree again the next time you open the website. For wording changes, we only update this page.
16. Contact us
If you have any questions about this policy or your personal information, email admin@vrchatmatch.com. You can also complain to the data protection authority where you live.
Anonymous publishing hides your site identity from ordinary users. The server retains the account association. Administrators may view the author after providing a reason and confirming their password; each view is logged. An anonymous plaintiff remains anonymous in comments and replies within that dispute. The defendant’s game ID stays public; other participants cannot choose anonymity. Do not disclose other people’s identifying information in text or images.