Model Explorer Privacy Policy
Model Explorer is provided by Ngô Đình Dũ (“we”, “us”). This policy explains how the web app and its Meta Horizon Store and Google Play packages handle information.
Information stored on your device
Models you import, previews, inspection state, settings, workflows, personal memory, a selected knowledge folder, and other app state are stored in browser or app storage on your device. A Gemini API key is stored locally only if you choose to add one. If you sign in (see Accounts below), your browser also keeps a sign-in cookie for api.0xr.space and a short hint — your account number and a masked form of your email address, its first character and domain — so the app can show that you are signed in; a share link you make while signed out keeps its owner key on the device until you add the link to an account. You can remove this information by deleting models in the app, signing out, clearing Model Explorer site data, or uninstalling the app.
Optional model sharing
Imported model files remain on your device by default. When you explicitly choose Share inspection, Model Explorer uploads the selected model files and a sanitized inspection manifest to the Model Explorer service at 0xr.space. The manifest can include display metadata, scale, render style, open or selected parts, explosion settings, and section or clipping settings. It excludes local file-system paths, device anchors, physical placement matrices, analytics data, and previous share identifiers.
Anyone with the public-by-link URL can download that shared inspection. Ordinary unlisted links and uploaded copies expire automatically 30 days after creation.
When a share creates a new link, Model Explorer’s server can also create an owner key for it. The key is stored on your device and the server keeps only a one-way hash of it, so that you can later add the link to an account; once you do, the hash is discarded and the server records the link as belonging to that account. From any device signed in to that account you can remove the link from Nearby or delete it before it expires. A deleted link stops working at once. So that the same link cannot be put back up, the server keeps a small record of it — the link’s identifier, when it was deleted and would have expired, and the names of its files, not their contents — until the date it would have expired. A copy that someone’s browser or our content delivery network has already cached may remain available for a while.
Optional Nearby models
Model Explorer requests device location permission only when you open Nearby or explicitly confirm a share that is set to appear in Nearby. After Home finishes loading, it may use an approximate network region derived by our hosting provider from the request IP to prepare Nearby results in temporary page memory; this does not display kilometer distance or trigger a device-location prompt. Nearby attempts device location at most once per browser session after you open it. Before transmission, latitude and longitude are rounded to three decimal places, approximately neighborhood or 100-meter precision. We use that coarsened location to calculate approximate distance and do not return stored coordinates in Nearby results. If device location is unavailable or not allowed, Nearby uses the prepared network-region results. Model Explorer does not store the raw IP in model discovery metadata.
For a location-listed share, hosting-provider city, region, and country labels may be attached only when its coarse network coordinates are reasonably consistent with the device location. VPN or mobile-network mismatches are discarded. Public results may show these approximate labels but never expose the underlying stored coordinates.
Location-listed models, their coarsened location, and their public links expire automatically 30 days after creation. You can turn off “List in Nearby” before creating a share to create an unlisted 30-day link without a location request. After you enable Nearby, the coarsened search location is stored on your device until you revoke location permission or clear Model Explorer site data. While Model Explorer is open, it checks about every 15 seconds for newly listed models, prefers models within 100 km, and may fall back to the nearest worldwide location-listed share. It asks before downloading or displaying a suggestion. These checks stop when the page is closed; Model Explorer does not track movement in the background or require you to travel to a model.
Accounts (optional)
You do not need an account to view models in Model Explorer. An account is needed to download a converted copy. Sharing a model of your own as a link does not need one; signing in, before or after, lets you manage the share links you make, from any device. You sign in with your email address and a 6-digit code we email to you, or, on a headset, by scanning a code shown on a phone or computer that is already signed in; that code works once and lasts two minutes.
If you sign in, Model Explorer’s server, which the developer operates in Vietnam, stores: your email address; an account number; when the account was created and last signed in; each signed-in session, with a device label taken from a fixed list (for example “Meta Quest 3 · Quest Browser”, never your browser’s full details), how it was signed in, and when it was created, last used, and will expire; the time you accepted this policy and its version (its effective date); and which share links the account owns. The server keeps only a one-way hash of your sign-in cookie, never the cookie itself.
We use this information only to sign you in, to show and sign out your signed-in devices, and to let you manage your links: list them, remove them from Nearby, or delete them. While you are signed in, a second cookie, set by our server and unreadable by the page, lets the usage and error events the app sends to our own server (which buttons were used, which imports failed and why) carry your account’s number, never your email address, so that we can tell which problems an account ran into and fix them; those events are not shared. Signing out removes that cookie. We email your address only the codes you ask for, never marketing.
Codes are emailed through Resend, an email delivery service in the United States, which receives your address and the message only to deliver the code. A code expires after 10 minutes. To prevent abuse, the server keeps short-lived counts of code requests per address and network, remembers for up to 30 days which networks have signed in to an address, and may ask for a Cloudflare Turnstile check when many codes are requested. Sign-in, sign-out, link, and account-deletion events are written to our server logs with the request’s IP address and browser information, but without your email address, codes, or account number.
A session ends after 30 days without use, and at most 90 days after you signed in on that device; you can sign out any device sooner in Settings → Account. Clearing Model Explorer site data or uninstalling the app signs that device out of the app but does not delete the account. The account database is backed up nightly and the 14 most recent backups are kept, so information you delete can remain in a backup until 14 newer backups have replaced it, normally about two weeks.
You can delete your account at any time, in either of two ways: in the app, Settings → Account → Delete account; or, without the app, at https://0xr.space/delete-account/. Both ask for a code sent to the account’s email address. Deleting signs out every device; deletes the account and everything stored with it above, including your email address and consent record; and deletes every share link the account owns, with its Nearby listing and view count. Models on your own devices are not affected. To delete a share link that no account owns, such as one made while signed out and never added to an account, email the link to dinhdu12@gmail.com.
The account and its sign-ins are removed as soon as you confirm. If a link cannot be removed at that moment, we keep retrying, and deletion is complete within 20 days. This applies to all users, in every region. We refuse a deletion request only when we cannot verify that it comes from the person who controls the account, meaning someone who can receive a code at its email address, or, for a link no account owns, from the person who shared it; if that is why, we tell you so.
Analytics
We use Google Analytics and Cloudflare Web Analytics to measure page use, reliability, and feature performance. This may include device and browser information, approximate location derived from network information, online identifiers, release version, import method, model format, file-count and size ranges, XR session state, supported model features, duration, and generalized error codes.
Model Explorer also keeps its own usage log on its server: which features were used and what came of them, for example a model that failed to load or a button that did nothing. When you talk to Zero, the log includes the transcribed text of what you said to Zero and of what Zero answered, and the names of the tools Zero used. Each entry is stored with the request’s IP address, browser information, an identifier for the installation and, if you are signed in, your account. We use this log to find and fix problems and to improve the app; it is not sold or shared, and older entries are deleted as the server’s logs rotate.
Our app analytics do not intentionally send model filenames, file paths, model contents, model identifiers, email addresses, GPS coordinates, free-form model metadata, or free-form error messages. Google and Cloudflare process analytics information under their own terms and privacy policies.
Mixed reality, camera, hands, and microphone
Horizon OS and the browser provide head tracking, hand or controller tracking, spatial information, and passthrough needed to present mixed reality. Model Explorer uses these signals during the active experience and does not retain passthrough camera frames, except the scan frames described next.
Camera access is requested only when you start something that needs it, and what happens to an image depends on which. Codes (QR codes) are read on your device. While the scan view is open, on Home or in mixed reality, the camera’s frames are sent to Model Explorer’s scan server, about as fast as your connection allows, so that it can name the objects in view and draw boxes around them; each frame is read in memory, and a copy is kept as described at the end of this paragraph. Photos and Video captures, which make a 3D model from many pictures, send each picture to the scan server as you take it, so that the model can start as soon as you ask for it; the pictures are also kept on your device. The server keeps a capture’s pictures until its model is built and fetched, or for 30 minutes after the last picture if you do not build one, and then deletes them, apart from that copy. On a headset with a pair of cameras, such as Quest 3, a scan in mixed reality keeps pictures from both cameras with the headset’s and your hands’ positions, and sends them to the scan server to build the model, which deletes them when the job ends. While such a scan runs, small grey pairs from both cameras, with the headset’s position, are also sent to the scan server a few times a second, so that it can measure depth and draw the outline of the room around you; it reads them in memory, keeps the room’s outline only while that scan’s connection is open, and keeps no pictures apart from that copy. In mixed reality, a Scan that reads no code keeps its last frame on your device as a photo and, once the scan server has checked that no phone, laptop, or screen is in the middle of it, sends that photo to Photo → 3D, described below. The shutter in the dock, and asking Zero to look at something, take a single still and send it to Google Gemini to answer that request. While you talk to Zero in mixed reality, and only if you have already allowed the camera, Zero also sends Google Gemini stills of the view in front of you: one as you start to speak, then about one every one and a half seconds until its answer ends, at most eight per answer, so that it can see what you are talking about. It sends none while nobody is talking, and none in VR or on a flat screen; Model Explorer does not keep them. Photo → 3D sends one photo to Model Explorer’s server, which passes it to the service that builds the model — currently a public Hugging Face Space — and deletes that job’s files when the job ends. Since October 18, 2026, the server keeps a copy of that photo and of the model built from it for up to 30 days, on the same terms as the scan copy described at the end of this paragraph. The pictures themselves are not added to your library; the model they produce, and the small preview image shown on its card, are stored on your device like any other import. Since October 16, 2026, the scan server keeps a copy of what a scan sends it — the camera frames and grey pairs above, with the positions, camera details and depth readings sent with them, and the server’s answers — for up to 30 days, and then deletes it. The copy is stored without your IP address or account. We use it only to test and improve Model Explorer’s scanning (naming objects, depth, the room’s outline and 3D builds), which can include training the models that do this; it is not sold, shared or used for advertising. Because it holds no account or address, we cannot pick out one person’s frames to delete them sooner. If you do not want frames kept, do not open the scan view or Photos and Video capture, and do not use Photo → 3D.
Microphone access is optional and requested only for voice features. When voice or assistant features are active, audio, prompts, and the app or model context needed to answer the request are sent directly from your device to Google Gemini. Do not use these features with information you do not want Google to process.
There are two ways those requests are authorized, and either way the session starts with a short-lived access token that Model Explorer’s server obtains from Google with Zero’s own instructions fixed in it. If you have entered your own Gemini API key, the app sends that key to Model Explorer’s server to obtain the token; the server passes the key to Google and does not store or log it. During the free launch preview, if you have not entered a key, Model Explorer’s server issues a short-lived access token for a single assistant session instead. Issuing that token records your IP address, the time of the request, and an anonymous per-installation identifier, kept for 30 days and used only to prevent abuse and to limit how many free sessions are granted. Those sessions are billed to the developer’s own Google account and are subject to Google’s terms for that account. Your audio, camera stills, and the context sent during a session (such as your saved preferences, what you are looking at or pointing to, what is open, and what has just happened in the app, like a scan photo kept or a model made) travel directly between your device and Google. When Zero hands a longer task to Gemini, such as research or a report, which needs your own key, the task, the information it needs, your key, and Gemini’s answer pass through Model Explorer’s server, which adds Zero’s own instructions and forwards them to Google; the server does not store or log them. The text of what you say to Zero and of its answers is also kept in the usage log described above.
How we use and share information
We use information to provide model import, storage, rendering, sharing, optional accounts and link management, mixed-reality interaction, optional assistant features, reliability measurement, and support. We do not sell personal information or show advertising. Information is shared only with service providers described above, at your direction, or when required for legal or security reasons.
Children
Model Explorer is intended for teens and adults aged 13 and older. It is not directed to children under 13, and we do not knowingly collect their personal information.
Security, international processing, and changes
We use reasonable safeguards, but no storage or transmission system is completely secure. Google, Cloudflare, Resend, and our hosting providers may process information in countries other than yours. Account information is stored on our server in Vietnam, and sign-in emails pass through Resend in the United States. We may update this policy as the app or its providers change; the effective date above identifies the current version.
Application settings, connection information, and user-created application data are stored locally on the user’s device. Except for inspection files that you explicitly share for 30 days, a photo sent to Photo → 3D and the model built from it, a copy of which is kept for up to 30 days without the user’s account or IP address to improve scanning and 3D builds, camera frames a scan sends to the scan server, a copy of which is kept for up to 30 days without the user’s account or IP address to improve scanning (see Mixed reality, camera, hands, and microphone), the gallery searches you type (see Google Gemini Integration below), the usage log described under analytics above (which includes the transcribed text of conversations with Zero), and, if you choose to sign in, the account information described under Accounts (optional), this information is not collected or centrally stored on servers operated by the developer. We use reasonable technical measures available on the device to protect locally stored information. However, no storage or transmission method can be guaranteed to be completely secure. Users are responsible for protecting access to their device and for keeping their third-party API keys and account credentials secure.
Google Gemini Integration
The application provides an optional AI-assisted feature powered by Google Gemini, a third-party large language model service. The Gemini feature is used when the user starts a voice or assistant request, and to translate gallery searches as described below. Voice and assistant requests work with the user’s own Gemini API key or, during the free launch preview, without one, as described under Mixed reality, camera, hands, and microphone above. When the user makes a voice or assistant request, the audio, text, or camera still the user submits, together with the app or model context needed to answer it, is transmitted directly from the user’s device to Google Gemini for the purpose of generating the requested response. Voice audio, camera stills (including the stills of the user’s view sent while they talk to Zero in mixed reality with the camera already allowed, described above), and the context sent during a session go directly between the user’s device and Google. To start a session, the application obtains a short-lived access token from the developer’s server; when the user has entered their own Gemini API key, the key is sent to that server for this purpose, and the server passes it to Google and does not store or log it. Longer tasks that Zero hands to Gemini on the user’s own key (such as research or a report) are relayed through the developer’s server, which adds Zero’s instructions: the task, the information it needs, the key, and Gemini’s answer pass through that server and are not stored or logged there. The transcribed text of what the user says to Zero and of Zero’s answers is recorded in the app’s usage log on the developer’s server, as described above. That applies to voice and assistant requests. Gallery search works differently: the words the user types into the gallery search are sent to Model Explorer’s server, which looks them up in the gallery and, when they are not in English or find nothing, may send them to Google Gemini, on the developer’s own Google account, to translate them into English keywords. The server writes each search, with the request’s IP address and browser information, to its logs, to see what people look for and to keep the service reliable. The Gemini API key and related configuration may be stored locally on the user’s device. The user can remove this locally stored information through the application’s settings or by clearing the application’s local data. We do not use Meta platform data, Meta account information, device data, user prompts, or generated responses to train any artificial intelligence or machine-learning model. The only submitted content that may be used that way is the copy of scan camera frames, and of Photo → 3D photos and the models built from them, described under Mixed reality, camera, hands, and microphone: kept for up to 30 days, without the user’s account or IP address, only to improve the app’s scanning and 3D builds. We do not sell this data or use it for advertising, profiling, or purposes unrelated to the user’s request. Data submitted to Google Gemini is processed by Google under Google’s applicable terms, privacy policy, and Gemini API data-use terms. Users should review those terms before enabling the feature. Users are not required to enable Google Gemini to use the application’s core features.
Data Deletion
Information stored on your device can be removed by:
Removing an API key or disconnecting an integration from the application’s settings;
Using the application’s clear-data or reset function;
Clearing the application’s storage through the device settings; or
Uninstalling the application.
A share link that belongs to your account can be deleted at any time in Settings → Account, and stops working at once. Your account, together with every link it owns, can be deleted in the app (Settings → Account → Delete account) or at https://0xr.space/delete-account/, as described under Accounts (optional); deletion is complete within 20 days, for all users in every region. To delete a share link that no account owns, email the link to the contact address below. Removing data from your device does not delete an account or a share link.
Requests concerning data retained by a third-party provider (such as Google for the Gemini API) must be submitted directly to that provider under its applicable privacy policy.
Contact
Ngô Đình Dũ
dinhdu12@gmail.com
https://0xr.space/