Model Explorer Privacy Policy
Model Explorer is provided by Ngô Đình Dũ (“we”, “us”). This policy explains how the web app and its Meta Horizon Store and Google Play packages handle information.
Information stored on your device
Models you import, previews, inspection state, settings, workflows, personal memory, a selected knowledge folder, and other app state are stored in browser or app storage on your device. A Gemini API key is stored locally only if you choose to add one. If you sign in (see Accounts below), your browser also keeps a sign-in cookie for api.0xr.space and a short hint — your account number and a masked form of your email address, its first character and domain — so the app can show that you are signed in; a share link you make while signed out keeps its owner key on the device until you add the link to an account. You can remove this information by deleting models in the app, signing out, clearing Model Explorer site data, or uninstalling the app.
Optional model sharing
Imported model files remain on your device by default. When you explicitly choose Share inspection, Model Explorer uploads the selected model files and a sanitized inspection manifest to the Model Explorer service at 0xr.space. The manifest can include display metadata, scale, render style, open or selected parts, explosion settings, and section or clipping settings. It excludes local file-system paths, device anchors, physical placement matrices, analytics data, and previous share identifiers.
Anyone with the public-by-link URL can download that shared inspection. Ordinary unlisted links and uploaded copies expire automatically 30 days after creation.
When a share creates a new link, Model Explorer’s server can also create an owner key for it. The key is stored on your device and the server keeps only a one-way hash of it, so that you can later add the link to an account; once you do, the hash is discarded and the server records the link as belonging to that account. From any device signed in to that account you can remove the link from Nearby or delete it before it expires. A deleted link stops working at once. So that the same link cannot be put back up, the server keeps a small record of it — the link’s identifier, when it was deleted and would have expired, and the names of its files, not their contents — until the date it would have expired. A copy that someone’s browser or our content delivery network has already cached may remain available for a while.
Optional Nearby models
Model Explorer requests device location permission only when you open Nearby or explicitly confirm a share that is set to appear in Nearby. After Home finishes loading, it may use an approximate network region derived by our hosting provider from the request IP to prepare Nearby results in temporary page memory; this does not display kilometer distance or trigger a device-location prompt. Nearby attempts device location at most once per browser session after you open it. Before transmission, latitude and longitude are rounded to three decimal places, approximately neighborhood or 100-meter precision. We use that coarsened location to calculate approximate distance and do not return stored coordinates in Nearby results. If device location is unavailable or not allowed, Nearby uses the prepared network-region results. Model Explorer does not store the raw IP in model discovery metadata.
For a location-listed share, hosting-provider city, region, and country labels may be attached only when its coarse network coordinates are reasonably consistent with the device location. VPN or mobile-network mismatches are discarded. Public results may show these approximate labels but never expose the underlying stored coordinates.
Location-listed models, their coarsened location, and their public links expire automatically 30 days after creation. You can turn off “List in Nearby” before creating a share to create an unlisted 30-day link without a location request. After you enable Nearby, the coarsened search location is stored on your device until you revoke location permission or clear Model Explorer site data. While Model Explorer is open, it checks about every 15 seconds for newly listed models, prefers models within 100 km, and may fall back to the nearest worldwide location-listed share. It asks before downloading or displaying a suggestion. These checks stop when the page is closed; Model Explorer does not track movement in the background or require you to travel to a model.
Accounts (optional)
You do not need an account to view models in Model Explorer. An account is needed to download a converted copy, and, in the Model Explorer app for Meta Quest, to add a file of your own from inside a session. Sharing a model of your own as a link does not need one; signing in, before or after, lets you manage the share links you make, from any device. You sign in with your email address and a 6-digit code we email to you, or, on a headset, by scanning a code shown on a phone or computer that is already signed in; that code works once and lasts two minutes.
In the Model Explorer app for Meta Quest you can also press Continue with Meta. The app then asks the Meta Horizon Platform for your Meta user ID for this developer and a one-time proof, and sends both to our server, which checks the proof with Meta. The server stores that user ID and your Meta username (alias), to sign that account in and show its name. An account made this way has no email address. Model Explorer does not ask Meta for your email, friends, presence, profile photo or any other Meta data, does not post anything to Meta, and does not use the Meta user ID for ads, tracking or analytics or share it with anyone. If you are already signed in, Continue with Meta adds Meta to that account; it never merges two accounts.
If you sign in, Model Explorer’s server, which the developer operates in Vietnam, stores: your email address; an account number; when the account was created and last signed in; each signed-in session, with a device label taken from a fixed list (for example “Meta Quest 3 · Quest Browser”, never your browser’s full details), how it was signed in, and when it was created, last used, and will expire; the time you accepted this policy and its version (its effective date); and which share links the account owns. The server keeps only a one-way hash of your sign-in cookie, never the cookie itself.
We use this information only to sign you in, to show and sign out your signed-in devices, and to let you manage your links: list them, remove them from Nearby, or delete them. While you are signed in, a second cookie, set by our server and unreadable by the page, lets the usage and error events the app sends to our own server (which buttons were used, which imports failed and why) carry your account’s number, never your email address, so that we can tell which problems an account ran into and fix them; those events are not shared. Signing out removes that cookie. We email your address only the codes you ask for, never marketing.
Codes are emailed through Resend, an email delivery service in the United States, which receives your address and the message only to deliver the code. A code expires after 10 minutes. To prevent abuse, the server keeps short-lived counts of code requests per address and network, and remembers for up to 30 days which networks have signed in to an address. Sign-in, sign-out, link, and account-deletion events are written to our server logs with the request’s IP address and browser information, but without your email address, codes, or account number.
A session ends after 30 days without use, and at most 90 days after you signed in on that device; you can sign out any device sooner in Settings → Account. Clearing Model Explorer site data or uninstalling the app signs that device out of the app but does not delete the account. The account database is backed up nightly and the 14 most recent backups are kept, so information you delete can remain in a backup until 14 newer backups have replaced it, normally about two weeks.
You can delete your account at any time, in either of two ways: in the app, Settings → Account → Delete account; or, without the app, at https://0xr.space/delete-account/. Both ask for a code sent to the account’s email address; an account made with Continue with Meta, which has no email address, is deleted in the Quest app with one press within ten minutes of signing in with Meta. Deleting signs out every device; deletes the account and everything stored with it above, including your email address, your Meta user ID and username, and consent record; and deletes every share link the account owns, with its Nearby listing and view count. Models on your own devices are not affected. To delete a share link that no account owns, such as one made while signed out and never added to an account, email the link to dinhdu12@gmail.com.
The account and its sign-ins are removed as soon as you confirm. If a link cannot be removed at that moment, we keep retrying, and deletion is complete within 20 days. This applies to all users, in every region. We refuse a deletion request only when we cannot verify that it comes from the person who controls the account, meaning someone who can receive a code at its email address, or, for a link no account owns, from the person who shared it; if that is why, we tell you so.
Data from Meta (Continue with Meta and purchases)
This section applies only if you press Continue with Meta or buy Model Explorer Plus in the Model Explorer app for Meta Quest. Model Explorer requests these Meta Horizon platform features and nothing else from Meta: User ID, In-App Purchases and Subscriptions.
What we collect: your Meta user ID for this developer (an org-scoped number), a one-time User Proof (nonce), and your Meta username (alias). We do not collect your email address, real name, profile photo, friends, presence or any other Meta data. If you buy Plus, we also collect what is described under Purchases below.
How we use it: the User Proof is sent once to Meta to confirm that the user ID really belongs to the person signed in on the headset, and is then discarded. The user ID identifies your Model Explorer account so that you can sign in again with one press; the username is shown as the account’s name. With that account you can download a converted copy of your own models and manage the share links you create. We do not use Meta data for advertising, tracking, analytics or AI training, do not post anything to Meta, and do not sell or share it with anyone.
Where and how long: the user ID and username are stored on the developer’s server in Vietnam, together with the account information listed under Accounts (optional), until you delete the account or ask us to delete it, and in nightly backups for about two more weeks.
Using both: you can add an email address to an account made with Continue with Meta, or link your Meta account to an account made with email. Either way there is one account: signing in with either reaches it, and it holds the information of both. If each already has its own account, you can merge them once you have proven both are yours: everything moves to one account. The other stays only as an empty record of the merge, with the address it had, and is deleted when you delete your account. You cannot undo a merge yourself. Meta does not give us your email address; we only have one if you type it and confirm the code we send to it. An account with an email address is deleted with a code sent to that address.
Purchases: Model Explorer Plus is a subscription sold through Meta’s checkout in the Quest app. Meta takes the payment; we never see your card or other payment details. When you buy or press Restore purchase, we receive your Meta user ID for this app (an app-scoped number) and a one-time User Proof, and we read from Meta the subscription’s product name, whether it is active or a trial, when the paid period ends, the next renewal, and any cancellation. We use this only to give your account Plus’s larger cloud limits, to end them when the subscription ends, and to stop one purchase being attached to two accounts. We read it again from Meta when a paid period ends. It is stored on the developer’s server in Vietnam with your account until you delete the account, and in nightly backups for about two more weeks. Deleting your account deletes this information but does not cancel the subscription, because billing is Meta’s: cancel it in your Meta account’s subscription settings.
How to delete it: in the Quest app, press Continue with Meta, then Settings → Account → Delete account (it asks nothing more within ten minutes of signing in). Or, without the app, email dinhdu12@gmail.com with the subject “Delete my Model Explorer Meta data” and your Meta username; we delete the account, the stored user ID, username and purchase information, and every share link the account owns within 20 days and reply when it is done.
Analytics
We use Google Analytics and Cloudflare Web Analytics to measure page use, reliability, and feature performance. This may include device and browser information, approximate location derived from network information, online identifiers, release version, import method, model format, file-count and size ranges, XR session state, supported model features, duration, and generalized error codes.
Model Explorer also keeps its own usage log on its server: which features were used and what came of them, for example a model that failed to load or a button that did nothing. When you talk to Zero, the log includes the transcribed text of what you said to Zero and of what Zero answered, and the names of the tools Zero used. Each entry is stored with the request’s IP address, browser information, an identifier for the installation and, if you are signed in, your account. We use this log to find and fix problems and to improve the app; it is not sold or shared, and older entries are deleted as the server’s logs rotate.
Two kinds of event are also kept apart from that log, as a record we can rely on later. When you report a model from its menu, the report (the model, the reason you chose and any words you typed) is kept with the request’s IP address, the country it came from, browser information and, if you are signed in, your account. Where a feature is not offered in your country and the server refuses it, the refusal (which feature, the time) is kept with the same details. Both are kept for up to one year and then deleted, and are used only to handle reports and to show which requests were refused.
Our app analytics do not intentionally send model filenames, file paths, model contents, model identifiers, email addresses, GPS coordinates, free-form model metadata, or free-form error messages. Google and Cloudflare process analytics information under their own terms and privacy policies.
Mixed reality, camera, hands, and microphone
Horizon OS and the browser provide head tracking, hand or controller tracking, spatial information, and passthrough needed to present mixed reality. Model Explorer uses these signals during the active experience and does not retain passthrough camera frames, except the scan frames described next.
Camera access is requested only when you start something that needs it, and what happens to an image depends on which. Codes (QR codes) are read on your device. While the scan view is open, on Home or in mixed reality, the camera’s frames are sent to Model Explorer’s scan server, about as fast as your connection allows, so that it can name the objects in view and draw boxes around them; each frame is read in memory, and a copy is kept as described at the end of this paragraph. Photos and Video captures, which make a 3D model from many pictures, send each picture to the scan server as you take it, so that the model can start as soon as you ask for it; the pictures are also kept on your device. The server keeps a capture’s pictures until its model is built and fetched, or for 30 minutes after the last picture if you do not build one, and then deletes them, apart from that copy. On a headset with a pair of cameras, such as Quest 3, a scan in mixed reality keeps pictures from both cameras with the headset’s and your hands’ positions, and sends them to the scan server to build the model, which deletes them when the job ends. While such a scan runs, small grey pairs from both cameras, with the headset’s position, are also sent to the scan server a few times a second, so that it can measure depth and draw the outline of the room around you; it reads them in memory, keeps the room’s outline only while that scan’s connection is open, and keeps no pictures apart from that copy. In mixed reality, a Scan that reads no code keeps its last frame on your device as a photo and, once the scan server has checked that no phone, laptop, or screen is in the middle of it, sends that photo to Photo → 3D, described below. The shutter in the dock, and asking Zero to look at something, take a single still and send it to Google Gemini to answer that request. While you talk to Zero in mixed reality, and only if you have already allowed the camera, Zero also sends Google Gemini stills of the view in front of you: one as you start to speak, then about one every one and a half seconds until its answer ends, at most eight per answer, so that it can see what you are talking about. It sends none while nobody is talking, and none in VR or on a flat screen; Model Explorer does not keep them. Photo → 3D sends one photo to Model Explorer’s server, which passes it to the service that builds the model — currently a public Hugging Face Space — and deletes that job’s files when the job ends. Since October 18, 2026, the server keeps a copy of that photo and of the model built from it for up to 30 days, on the same terms as the scan copy described at the end of this paragraph. Before anything is built, every Photo → 3D photo is checked automatically for sexual content involving children. Such a photo is refused: it is not built, not passed on, and not kept. From October 18, 2026, every Photo → 3D request, refused or not, leaves a record kept for up to one year: when it happened, what came of it, the check’s scores, fingerprints (hashes) of each photo from which the photo cannot be recovered, its size and type, and the sender’s IP address, app installation identifier, browser description and the site it came from. We keep it so that each case can be traced, repeated attempts recognised, and, where the law requires, reported to the authorities. The pictures themselves are not added to your library; the model they produce, and the small preview image shown on its card, are stored on your device like any other import. Since October 16, 2026, the scan server keeps a copy of what a scan sends it — the camera frames and grey pairs above, with the positions, camera details and depth readings sent with them, and the server’s answers — for up to 30 days, and then deletes it. The copy is stored without your IP address or account. We use it only to test and improve Model Explorer’s scanning (naming objects, depth, the room’s outline and 3D builds), which can include training the models that do this; it is not sold, shared or used for advertising. Because it holds no account or address, we cannot pick out one person’s frames to delete them sooner. If you do not want frames kept, do not open the scan view or Photos and Video capture, and do not use Photo → 3D.
Microphone access is optional and requested only for voice features. When voice or assistant features are active, audio, prompts, and the app or model context needed to answer the request are sent directly from your device to Google Gemini. Do not use these features with information you do not want Google to process.
There are two ways those requests are authorized, and either way the session starts with a short-lived access token that Model Explorer’s server obtains from Google with Zero’s own instructions fixed in it. If you have entered your own Gemini API key, the app sends that key to Model Explorer’s server to obtain the token; the server passes the key to Google and does not store or log it. During the free launch preview, if you have not entered a key, Model Explorer’s server issues a short-lived access token for a single assistant session instead. Issuing that token records your IP address, the time of the request, and an anonymous per-installation identifier, kept for 30 days and used only to prevent abuse and to limit how many free sessions are granted. Those sessions are billed to the developer’s own Google account and are subject to Google’s terms for that account. Your audio, camera stills, and the context sent during a session (such as your saved preferences, what you are looking at or pointing to, what is open, and what has just happened in the app, like a scan photo kept or a model made) travel directly between your device and Google. When Zero hands a longer task to Gemini, such as research or a report, which needs your own key, the task, the information it needs, your key, and Gemini’s answer pass through Model Explorer’s server, which adds Zero’s own instructions and forwards them to Google; the server does not store or log them. The text of what you say to Zero and of its answers is also kept in the usage log described above.
How we use and share information
We use information to provide model import, storage, rendering, sharing, optional accounts and link management, mixed-reality interaction, optional assistant features, reliability measurement, and support. We do not sell personal information or show advertising. Information is shared only with service providers described above, at your direction, or when required for legal or security reasons.
Children
Model Explorer is intended for teens and adults aged 13 and older. It is not directed to children under 13, and we do not knowingly collect their personal information.
Security, international processing, and changes
We use reasonable safeguards, but no storage or transmission system is completely secure. Google, Cloudflare, Resend, and our hosting providers may process information in countries other than yours. Account information is stored on our server in Vietnam, and sign-in emails pass through Resend in the United States. We may update this policy as the app or its providers change; the effective date above identifies the current version.
Application settings, connection information, and user-created application data are stored locally on the user’s device. Except for inspection files that you explicitly share for 30 days, a photo sent to Photo → 3D and the model built from it, a copy of which is kept for up to 30 days without the user’s account or IP address to improve scanning and 3D builds, the record of each Photo → 3D request and of its photos’ check (kept for up to one year with the sender’s IP address and installation identifier, without the photos), camera frames a scan sends to the scan server, a copy of which is kept for up to 30 days without the user’s account or IP address to improve scanning (see Mixed reality, camera, hands, and microphone), the gallery searches you type (see Google Gemini Integration below), the usage log described under analytics above (which includes the transcribed text of conversations with Zero), model reports and refusals of features not offered in the user’s country (kept for up to one year, see analytics above), and, if you choose to sign in, the account information described under Accounts (optional), this information is not collected or centrally stored on servers operated by the developer. We use reasonable technical measures available on the device to protect locally stored information. However, no storage or transmission method can be guaranteed to be completely secure. Users are responsible for protecting access to their device and for keeping their third-party API keys and account credentials secure.
Google Gemini Integration
The application provides an optional AI-assisted feature powered by Google Gemini, a third-party large language model service. The Gemini feature is used when the user starts a voice or assistant request, and to translate gallery searches as described below. Voice and assistant requests work with the user’s own Gemini API key or, during the free launch preview, without one, as described under Mixed reality, camera, hands, and microphone above. When the user makes a voice or assistant request, the audio, text, or camera still the user submits, together with the app or model context needed to answer it, is transmitted directly from the user’s device to Google Gemini for the purpose of generating the requested response. Voice audio, camera stills (including the stills of the user’s view sent while they talk to Zero in mixed reality with the camera already allowed, described above), and the context sent during a session go directly between the user’s device and Google. To start a session, the application obtains a short-lived access token from the developer’s server; when the user has entered their own Gemini API key, the key is sent to that server for this purpose, and the server passes it to Google and does not store or log it. Longer tasks that Zero hands to Gemini on the user’s own key (such as research or a report) are relayed through the developer’s server, which adds Zero’s instructions: the task, the information it needs, the key, and Gemini’s answer pass through that server and are not stored or logged there. The transcribed text of what the user says to Zero and of Zero’s answers is recorded in the app’s usage log on the developer’s server, as described above. That applies to voice and assistant requests. Gallery search works differently: the words the user types into the gallery search are sent to Model Explorer’s server, which looks them up in the gallery and, when they are not in English or find nothing, may send them to Google Gemini, on the developer’s own Google account, to translate them into English keywords. The server writes each search, with the request’s IP address and browser information, to its logs, to see what people look for and to keep the service reliable. The Gemini API key and related configuration may be stored locally on the user’s device. The user can remove this locally stored information through the application’s settings or by clearing the application’s local data. We do not use Meta platform data, Meta account information, device data, user prompts, or generated responses to train any artificial intelligence or machine-learning model. The only submitted content that may be used that way is the copy of scan camera frames, and of Photo → 3D photos and the models built from them, described under Mixed reality, camera, hands, and microphone: kept for up to 30 days, without the user’s account or IP address, only to improve the app’s scanning and 3D builds. We do not sell this data or use it for advertising, profiling, or purposes unrelated to the user’s request. Data submitted to Google Gemini is processed by Google under Google’s applicable terms, privacy policy, and Gemini API data-use terms. Users should review those terms before enabling the feature. Users are not required to enable Google Gemini to use the application’s core features.
Data Deletion
Information stored on your device can be removed by:
Removing an API key or disconnecting an integration from the application’s settings;
Using the application’s clear-data or reset function;
Clearing the application’s storage through the device settings; or
Uninstalling the application.
A share link that belongs to your account can be deleted at any time in Settings → Account, and stops working at once. Your account, together with every link it owns, can be deleted in the app (Settings → Account → Delete account) or at https://0xr.space/delete-account/, as described under Accounts (optional). An account made with Continue with Meta can also be deleted by email, with your Meta username, as described under Data from Meta; deletion is complete within 20 days, for all users in every region. To delete a share link that no account owns, email the link to the contact address below. Removing data from your device does not delete an account or a share link.
Requests concerning data retained by a third-party provider (such as Google for the Gemini API) must be submitted directly to that provider under its applicable privacy policy.
Contact
Ngô Đình Dũ
dinhdu12@gmail.com
https://0xr.space/