Privacy Policy

1. Introduction

ES Designs (“we,” “us,” or “our”) operates the website esdesigns.org and develops compliance planning, accessibility audit, document remediation, and training tools for higher education. We also develop applications for the Meta Quest platform. This privacy policy explains how each of our applications handles user data.

This policy applies to the following applications:

• Vantura — A 360 video platform for higher education and CTE, made up of a Quest app and an instructor web portal
• Elliptical Explorer — A VR fitness and exploration game
• Anatomy & Physiology Lab — An immersive VR educational experience

These applications differ significantly in how they handle data. Elliptical Explorer and Anatomy & Physiology Lab run entirely offline and collect nothing. Vantura is an account-based service that a school uses to deliver its own video to its own students, so it necessarily stores account and usage information. Each is described separately below. We never sell personal information, and we never use it for advertising.

2. Vantura

Vantura lets faculty upload 360 videos they have filmed and deliver them to Quest headsets their institution already owns. It requires an account, and it communicates with our servers. This section describes exactly what that involves.

Signing in to the Vantura portal or the Quest app requires an ES Designs account. We store your email address, an account identifier, and your role (student, instructor, or administrator). Authentication is handled by Supabase. We do not store your password; it is held by our authentication provider in hashed form and is never visible to us.

Instructors create classes, and students join them with a short join code. We store which classes exist, who teaches them, who is enrolled, and when they enrolled. This is what determines which videos a given headset is allowed to download.

When a headset is paired to an account, the Vantura app reports information about that headset so an instructor can confirm a cart is ready before class:

• A device identifier generated by the app
• The headset model (for example, “Oculus Quest 3”)
• The installed app version
• Available free storage space on the headset
• Which lesson videos are currently downloaded, their size, and when they downloaded

We do not collect headset serial numbers, advertising identifiers, or any Meta account information.

When a video is watched in the Vantura app, we record a session containing which video was watched, the class it belongs to, when viewing started and ended, how long it was actually playing, the headset model, and the app version. Time spent paused is excluded from the recorded duration.

This activity is tied to the signed-in account, and an instructor can see it for their own class. It exists so faculty can tell whether students completed an assigned lesson. It is not used for profiling, advertising, or any purpose beyond reporting to the instructor and the institution.

Videos uploaded by faculty are stored in Cloudflare R2 object storage, along with a title, description, and technical details such as duration, resolution, and codec. Access is granted through short-lived signed links issued only to accounts enrolled in the relevant class. The institution owns this content; we host and deliver it on the institution’s behalf.

Vantura is download-first, so lessons play without a network connection. Downloaded video files and a copy of the class lesson list are stored in the app’s private storage on the headset, along with the sign-in tokens that keep you logged in. Signing out or uninstalling the app removes them from the device.

3. Elliptical Explorer and Anatomy & Physiology Lab

These two applications collect no personal information. They require no account, login, registration, or email address, they make no network requests, and they do not communicate with any external server, API, or third-party service.

This app stores game progress data locally on your device using Unity’s PlayerPrefs system. This includes:

• Lifetime calories burned and distance traveled
• Level unlock status and mission completion progress
• Best times and accuracy scores per level and difficulty

This data is stored entirely on your Meta Quest device and is never transmitted to any server or third party.

This app stores quiz progress in session memory only. No data is written to your device’s storage. When you close the app, all session data is cleared automatically.

4. Information We Do Not Collect

For full transparency, none of our applications collect any of the following:

• Location or GPS data
• Financial or payment information (billing, where applicable, is handled by our payment processor and never reaches our servers)
• Advertising identifiers, or any data used for advertising
• Social media data
• Microphone or camera recordings
• Eye, face, or body tracking data, or any other biometric data
• Contacts, calendars, or files outside the application

We do not sell personal information, and we do not share it with third parties for their own marketing purposes.

5. Device Permissions

Our apps request certain VR hardware permissions solely for functionality, not for data collection. Sensor data is processed locally in real time and is never recorded, stored, or transmitted.

• VR Head Tracking — Required to display 360 video, so the view follows where you look. Processed locally in real time.
• Hand Tracking — Lets you operate the menus with your hands instead of controllers. Processed locally; hand data is never recorded or transmitted.
• Network Access — Used to sign in, download assigned lesson videos, and report class readiness and viewing activity as described above.

• VR Head Tracking — Detects physical movement on exercise equipment to drive in-game locomotion. Processed locally in real-time.
• Spatial Anchors — Used for VR environment alignment and persistence. Data stays on your device.
• Scene Understanding — Enables awareness of your physical space for safe play boundaries. Processed locally.

• Hand Tracking — Enables natural hand interactions with 3D anatomy models and UI elements. Processed locally.
• Eye Tracking — Used for gaze-based interaction with educational content. Processed locally; gaze data is never recorded or transmitted.
• Passthrough — Blends the real-world environment with virtual content for mixed-reality experiences. Video data never leaves the device.

6. Student Data and Institutional Use

When an institution uses Vantura with enrolled students, the account, enrollment, and viewing records described in Section 2 may constitute education records under the Family Educational Rights and Privacy Act (FERPA) and comparable state laws.

The institution controls those records. We process them only to provide the service to that institution, under its direction. We do not use student data to build advertising profiles, to train machine learning models, or for any purpose other than operating Vantura for the school. An institution may request export or deletion of its data at any time, and we will act on that request.

Institutions that require a written data protection agreement or student data privacy addendum should contact us using the details below.

7. Third-Party Services

Elliptical Explorer and Anatomy & Physiology Lab use no third-party services of any kind.

Vantura relies on the following providers to operate:

• Supabase — Authentication, database, and application logic
• Cloudflare R2 — Storage and delivery of uploaded video files
• Cloudflare Turnstile — Bot protection on portal sign-in
• Vercel — Hosting for the instructor web portal

These providers process data on our behalf in order to run the service. They are not permitted to use it for their own purposes.

Our Quest applications are distributed through the Meta Horizon Store. The Meta platform itself may collect certain data as part of its operating system and store services, such as app install events and platform telemetry. That collection is controlled by Meta, not by our applications. Please refer to Meta’s Privacy Policy for details on their data practices.

8. Children’s Privacy

Our applications are intended for higher education, career and technical education, and adult users, and are not directed at children under 13. We do not knowingly collect personal information from children under 13.

Elliptical Explorer and Anatomy & Physiology Lab collect no personal information from any user, so no child-specific data is at risk. For Vantura, accounts are created by or on behalf of an institution for its enrolled learners. If you believe a child under 13 has created a Vantura account, contact us and we will delete it.

9. Data Retention

• Vantura — Account, class, enrollment, headset, and viewing records are retained while the account or institutional subscription is active. Uploaded videos are retained until deleted by the institution. On request, we delete an account or an institution’s data; deletion is completed within 30 days. Downloaded video on a headset is removed when the user signs out or the app is uninstalled.
• Elliptical Explorer — Local game progress remains on your device until you uninstall the app or clear its data through your Meta Quest device settings.
• Anatomy & Physiology Lab — No data is retained. All session data is cleared when the application closes.

10. Data Security

Elliptical Explorer and Anatomy & Physiology Lab operate entirely offline with no network communication, so there is no risk of interception or server breach. Local data is protected by the Meta Quest platform’s built-in device-level security.

For Vantura, all traffic between the app, the portal, and our servers is encrypted in transit using HTTPS, and stored data is encrypted at rest by our hosting providers. Access to class content is enforced at the database level, so an account can only reach videos for classes it teaches or is enrolled in. Video links are short-lived and individually signed rather than publicly accessible. No system is perfectly secure, but we design for least privilege and keep the amount of personal data we hold small.

11. Your Choices and Rights

You may request access to the personal information we hold about you, request a correction, or request deletion. Contact us using the details below and we will respond within 30 days.

If you use Vantura through your school, your school administers your account. We may direct requests about student records to your institution, since it controls those records.

You can stop all data collection by Vantura at any time by signing out of the app, which also removes downloaded lessons from the headset.

12. Changes to This Policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated revision date at the top. Continued use of our applications after changes are posted constitutes acceptance of the updated policy.

13. Contact Us

If you have any questions or concerns about this privacy policy or our data practices, please contact ES Designs:

• Website: esdesigns.org
• Email: privacy@esdesigns.org