Ellipse · VR Player

Privacy Policy

Effective date: November 2, 2026

This policy covers the Android app VR Player (package app.ellipse.vrplayer), published by Ellipse. It explains what stays on your device, what the app's advertising provider collects, and the choices you have. Questions: ellipseapps@gmail.com.

The short version

• Ordinary playback and Google Play purchases do not require an app account. Optional rewarded unlocks use an Ellipse-operated verification service and need no account; versions before October 2026 used Google sign-in through Firebase Authentication. Videos, photos, raw media addresses, browser history, and resume positions are not uploaded to that service.
• The Google Play build sends limited usage events to Google Analytics for Firebase and serves free-version ads through Google AdMob. Active monthly or lifetime Premium removes app ads.
• When the Google Play build crashes, stops responding or freezes for two seconds or more, it sends a crash report to Firebase Crashlytics so the problem can be fixed. File names and web addresses are removed from error messages first, and you can turn crash reports off in Settings → Privacy.
• When you connect to a Jellyfin server, website, stream, or the official YouTube player you choose, that provider receives data directly under its own privacy policy.
• A watch party shares your play position with the devices you invite, on your own network only — no video, no relay, nothing to us.

Data that stays on your device

The following is processed and stored only on your phone, in the app's private storage. None of it is transmitted to Ellipse:

• Photos and videos you grant access to or select — read locally for browsing and playback only.
• Camera frames — used only while the Cardboard QR scanner is open, to read a headset configuration code. Frames are not stored.
• Playback history and resume positions — kept in encrypted app-private storage, excluded from Android backups, clearable in the app.
• In-app browser tabs, history, and website cookies — kept in app-private storage with an encrypted session snapshot; clearable in the app. Website logins and cookies follow each website's own rules and expiry. A page displayed on the flat VR screen uses the same WebView website policies.
• Media-server sign-ins — saved server details, usernames, access tokens, and a random per-server device identifier are encrypted in app-private storage and scoped to the server you chose. A Jellyfin password is used during sign-in and is not retained after the server returns an access token.
• Smooth-playback check — while a video on your phone plays, the app checks on the phone whether it keeps up (dropped frames, timing). When it does not, it may suggest Ellipse Converter, our separate converter app, at most once per video and once every few days. To remember that, it keeps the time of the last suggestion and short one-way codes of the videos it was shown for, never their names or locations. Nothing is sent to Ellipse. Only if you tap Open in Ellipse Converter is that one video handed to the converter on your phone, with Android's one-time read permission; if the converter is not installed, Google Play opens on its page instead. Videos in a private session are never checked for this or remembered.
• Diagnostics — sanitized logs and at most one redacted crash report exist locally. They leave the device only if you explicitly export, copy, or send them. The Google Play build's automatic crash reports are a separate thing, described under Crash reports.

Advertising data (Google AdMob)

The free version shows one banner ad in the launcher and an optional rewarded ad that unlocks both interactive phone and headset VR playback for a video. Ads are provided by Google AdMob (the Google Mobile Ads SDK). When ads are shown or requested, Google automatically collects and shares with its partners:

• IP address, from which an approximate location may be derived;
• App interactions, such as ad impressions, taps, launches, and video-ad interactions;
• Diagnostics, such as SDK performance, hang, launch-time, and energy information;
• Device and other identifiers, including the Android advertising ID and app set ID.

Google uses this data for advertising, analytics, and fraud prevention. This transfer is protected with TLS encryption. See Google's Privacy Policy and how Google uses data in AdMob.

Your choices: in the European Economic Area, the UK, and certain US states, the app shows a consent form before ads and you can reopen it any time from the app's privacy options to change your choice. You can reset or delete your advertising ID in Android settings. Purchasing Premium removes ads entirely, which stops AdMob requests from this app.

Analytics (Google Analytics for Firebase)

The Google Play version reports a small, fixed set of usage events, so we can see which features are used and where people get stuck. Each event records what kind of thing happened — never what you watched:

• that playback started, and whether it was in VR or flat
• for each playback that starts or fails: which of the app's two video engines played it; where in the app it was opened from, as a fixed category (the library, the in-app browser and how it found the video, a link pasted into Open stream, another app, a media server, history, a download, the queue, or "other"); what kind of file or link it was, as a fixed category (such as MP4, MKV, WebM, HLS, DASH, a playlist, an image or audio); and where the video was, as one of six fixed categories (on the phone, on your local network, on a cloud drive, on YouTube, elsewhere on the internet, or unknown). These are worked out on your phone; the address, the website's or server's name, the file name and the title are never sent
• a coarse category when playback fails after automatic recovery (for example, network, decoder, manifest, authentication, or DRM), the player's fixed error code (such as "file not found" or "unrecognized format"), whether the video was on the device or streamed, and for a web link a fixed kind for what it returned (such as "web page", "video", "playlist" or "server error"), but not the error text, the link, or anything the website sent
• how the in-app browser is used, once per visit, both on the phone and for web pages viewed in VR:
  • how the visit started, as a fixed category: the home screen, a typed or shared link, recent streams, coming back from a player, or switching between the phone and VR;
  • how it ended, as a fixed category: played in VR, played flat, downloaded, a video watched on the page itself (one of its videos played with sound for 20 seconds, or went fullscreen), a video found but not used, coming back to videos found earlier without using them, no video found, or just browsing;
  • a coarse time band;
  • counts, each capped at 99, of the pages loaded, the videos the browser found, the times its video list was opened, and the plays and downloads. Detected links that led to a web page instead of a video are counted too, as is a link pasted into Open stream that turns out to be a web page.
  When the browser first finds a video on a page, it also records how the video was found, as a fixed category. When its list of found videos closes, it records only whether a video was picked from it. When the browser finds no video, it records why, as a fixed category: nothing found, copy-protected (DRM), a stream the page keeps to itself, or media the page shows without an address the app can read. The pages, their addresses, the websites' names, page titles and anything typed or searched are never sent
• how long the app took, in milliseconds, to show a video's first picture after you opened it, and that time split into its steps (starting the player, preparing, opening the file, and showing the first picture), with whether that start resumed a saved position and whether it was the first video since the app started; how long it took to open the in-app browser (with the share of its screen updates that were slow) and to show the home screen's list of videos (with whether it had to re-read the whole library); how long it took, in milliseconds, to confirm your unlock after a rewarded ad closed; and, for each VR session, the share of its frames that came late while you watched, and how far the phone's heat protection lowered the picture's detail (not at all, one step or two). This tells us whether the app is getting faster or slower and whether VR keeps up on your phone; these are only timings, shares, yes-or-no flags and a heat step from 0 to 2, never what was opened or watched
• which settings and in-VR menu options are changed: the setting or control, and a coarse new value (on or off, a fixed option, where a slider sits in its range (lowest, low, middle, high or highest), or whether a text field is filled); never what was typed, and nothing about what you watch
• when the smooth-playback check suggests Ellipse Converter: the step reached (shown, opened, not now, or don't suggest again), what raised it (stutter, a video too heavy for the phone's decoders, or AV1 decoded in software), the video's codec family (such as H.264, HEVC or AV1) and a coarse size class (below 4K, 4K, 6K or 8K), which video engine played it, whether it was in VR, and where the tap went (the converter or its Google Play page); never the video's name, location or exact size
• how far into a free VR preview a session reached, as a percentage and a coarse time band
• that the unlock screen appeared, and which option was chosen
• the outcome of a rewarded ad; Premium offer, checkout, and entitlement stages; and, if you choose to answer, one fixed-choice reason for not purchasing
• the Premium product identifier, local currency, and purchase value when Google Analytics automatically records a completed Google Play purchase
• that the app had stopped unexpectedly on its previous run: the kind of exit (crash, native crash, or not responding) and which screen was in front, as a fixed category such as "video in VR", "rewarded ad", or "settings"; never the error itself
• when the app or its picture stops for a while: the kind of stop (the app's screen thread stuck for two seconds or more, a video's picture frozen while it should move, or VR's drawing stalled), which screen was open, as a fixed category such as "video in VR" or "settings", how long (in bands, from one second up), and, for a video, which of the two video engines played it. For a stuck screen thread there is one more fixed word, saying how far the app got in recording where it was stuck for a crash report: recorded, already recorded, nothing to record, a limit reached, no look taken, or failed; never the code the app was running, and nothing about what you were watching

The optional purchase feedback accepts no typed response. Its choices are limited to price, not using VR enough, a missing feature, a technical problem, preferring the ad option, not purchasing today, or skipping the question.

No file names, media titles, folder paths, web addresses, website or server names, page titles, searches, typed feedback, or playback error text are included in any event. Events are grouped by a Firebase installation identifier for this app on this device. Analytics also marks the installation as free or Premium so existing owners can be excluded from Premium campaigns. Analytics data may be associated with the Android advertising ID when permitted by your privacy choices.

We use these events to understand feature use, playback and purchase drop-off, and to measure or build audiences for app-promotion campaigns. When Analytics, AdMob, and Google Ads are linked, audience and conversion data can be shared between those Google services, subject to your consent and Google's eligibility thresholds. Google processes this data under the Google Privacy Policy; see also Firebase privacy and security.

Analytics is present only in the Google Play build. Builds distributed outside Google Play contain no analytics SDK at all.

Rewarded unlocks and verification

Rewarded unlocks need no account. When you ask for one, the app sends our verification service a pseudonymous device key: a one-way hash of the Android ID that Android assigns to this app on your phone. Android keeps that ID when you reinstall the app or clear its data and replaces it on a factory reset; another Android user or profile on the same phone has its own. We use the key only to enforce the weekly limit on rewarded unlocks and to deliver rewards, not to identify you in Analytics, and it is never sent to AdMob.

Versions before October 2026 used Google sign-in instead, which created a Firebase Authentication account: Google/Firebase processed the sign-in identity, email address, profile information supplied by Google, IP address, and authentication tokens. Such an account remains until you delete it (see Retention and deletion). Current versions no longer use it for rewards.

Our Firebase/Google Cloud service receives a hash of the selected media address, the device key (from earlier versions, an account identifier derived from your Google identity), random reward reservation identifiers, server timestamps, and AdMob reward transaction identifiers. A hash is pseudonymous data, not guaranteed anonymous. Raw video addresses, titles, and video contents are not sent. The service enforces a weekly limit on rewarded video unlocks per device and verifies AdMob-signed completion callbacks. Firebase App Check with Play Integrity checks app authenticity.

Each reward covers the current viewing session in both interactive phone and headset VR, with one hour to reopen the same video. Failed or declined ads do not consume completed unlocks; a completed ad may retain a slot while verification is pending.

Purchases

Premium is available as a monthly auto-renewing subscription or a one-time lifetime purchase through Google Play Billing. Google handles payment; Ellipse does not receive payment-card or bank details. Existing lifetime purchases retain their access.

The app retains the signed lifetime receipt locally. Lifetime and subscription purchase tokens are sent over HTTPS to our verification service, which queries Google Play for current access and acknowledgement. Raw tokens are processed for verification and are not written to our database or application logs. For purchases Google has canceled or revoked, including chargebacks, we retain a one-way hash of the purchase token and reversal metadata for as long as needed to prevent the reversed purchase from restoring access. These records contain no email address or payment-card details and are separate from optional rewards accounts. A confirmed lifetime reversal is also stored on the device. Valid lifetime receipts continue to work offline; a temporary verification outage does not remove lifetime access. The app caches a signed subscription entitlement for at most 24 hours, never beyond the verified paid or grace-period expiry. Rebooting requires online subscription verification. Limited infrastructure request metadata may be processed by Google Cloud for security and operation.

When Firebase is linked to Google Play, Analytics can record the product identifier, currency, and purchase value. These records do not include payment-card details. Manage or cancel a subscription from the app's Settings or the Google Play subscription center.

Websites and streams you choose

If you enter a stream URL, browse a website in the in-app browser, or connect to a network share, your device communicates directly with that server. The operator receives ordinary connection data (such as your IP address) and controls any information you submit to it, under its own privacy policy. Connections you make over HTTPS are encrypted in transit. The player can also, only after showing you an explicit confirmation, play a plain HTTP stream you approve — such traffic is not encrypted. Playback credentials are not silently forwarded to unrelated hosts.

If the app offers View page in VR, it displays the website you chose on a flat virtual screen. The page still communicates directly with its operator; it is not copied to an Ellipse server. Protected or DRM-controlled pages may not render.

Jellyfin servers you choose

Jellyfin is an optional connection to a media server selected by you; it is not an Ellipse service. During sign-in, the app sends the server address, username, and password directly to that server. After a successful sign-in, the password is discarded. The returned access token, username, server details, and a stable random device identifier created separately for that server are stored encrypted on your device.

Jellyfin requests identify the app and device with the device model (used as the client device name), the per-server device identifier, and the app version, and authenticated requests include the access token. Searches send the terms you enter to that server. When playback stops, the app can send the media item identifier and playback position so the server can save your resume point. Ellipse does not receive any of this data.

HTTPS connections are encrypted in transit. Because VR Player also supports media servers on a private or local network, you can choose a plain HTTP server; credentials, tokens, searches, and playback updates sent over HTTP are not encrypted in transit. The server operator controls any server-side logs, retention, access, and deletion. Signing out removes that server's saved token and connection from VR Player, but does not delete data held by the server.

YouTube playback

Recognized YouTube video links can open in YouTube's official embedded player. The app does not download or extract the YouTube media stream. When the player loads, YouTube receives connection and player-use data directly to display the video, determine playability and restrictions, and prevent fraud or abuse.

For YouTube embeds, when supported by the installed Android WebView, Media Integrity sends YouTube attested app metadata (the package name, version number, and signing certificate) and a device-attestation token generated by Google Play services. Google states that this integrity data is encrypted, is not shared with third parties, and is deleted after a fixed retention period. Ellipse does not receive this data.

YouTube playback is governed by YouTube's Terms and Google's Privacy Policy.

Watch parties

A watch party is off unless you start or join one. While one is running, your phone exchanges the current play position — and, with devices that have entered the six-digit code the host displays, the title of what is playing — directly with the other devices in the party over your own local network.

No video is transmitted: every device plays its own copy of the file. There is no account, no relay server, no connection outside your network, and nothing reaches Ellipse. The exchange is encrypted with keys agreed for that party alone, the code authenticates both ends of every join, and everything stops when the party ends or the app closes.

Crash reports

The Google Play build uses Firebase Crashlytics, Google's crash-reporting service, so that crashes are found and fixed quickly. When the app crashes, stops responding (Android 11 and later), freezes for two seconds or more, or your phone's graphics driver refuses one of the app's graphics programs, Crashlytics sends a report containing:

• the error type and message and the stack trace — the code that was running. Before the report is handed to Crashlytics, file and folder names, the path and query of web addresses (only the site name is kept), network addresses, email addresses, and sign-in tokens are removed from the error messages;
• for a crash in native code, the state of the crashing code, which can include parts of the memory it was using at that moment;
• the app version, device manufacturer and model, Android version, CPU architecture, memory and storage in use, battery level and whether it is charging, screen orientation, whether the app was in the background, whether the proximity sensor was triggered, and whether the device is rooted;
• a Crashlytics installation identifier and the Firebase installation identifier, used to count how many installations a crash affects;
• fixed labels for what the app was doing: which screen was open, VR or 2D, the player engine (mpv or Media3), whether the video was on the device or streamed — never its address — the last playback error code, the picture quality setting, the phone's thermal state, why a 2D video plays on its engine, which kind of graphics-heavy playback ran last, how long ago it ended and whether it had been cleaned up, whether the device is one of Google's automated test devices, the graphics driver's name and version, and which version of the phone's built-in web viewer (Android System WebView or Chrome) it runs;
• for a freeze of two seconds or more, the code the app was running when it was seen (the names of its functions and their line numbers, never what they were working on), one fixed sentence naming the part of Android it was waiting in, how long the freeze lasted (two to five seconds, five to ten, or longer), which screen was open and which step the app was in (starting, resuming, drawing a frame, handling a touch), and the size of the phone's memory in bands (2, 3, 4, 6, 8, or 12 GB and over);
• the Analytics events described above that were recorded just before the crash, and, for a refused graphics program, the graphics driver's own error log about the app's shader.

Crashlytics also records in Google Analytics for Firebase that a crash happened. The app adds no account identifier, media title, file name or address to a crash report. Google processes crash reports on our behalf; see Firebase privacy and security. Builds distributed outside Google Play contain no crash-reporting SDK.

The app can also keep one local report containing the app version, device model, Android version, and the error. File names, web addresses, network addresses, email addresses, and sign-in tokens are redacted before the report is stored in the app's private files. The app offers it on a later launch so you can read it first; it reaches Ellipse only if you deliberately send it with another app, and copying or sending can also expose it to the app you choose. The Google Play version also records, in the Analytics events above, that a crash happened and which screen was open, unless crash reporting is switched off.

Your choice: the Record and send crash reports switch in Settings → Privacy turns off the local report, Crashlytics and the Analytics record of a crash, and deletes any Crashlytics report that has not been sent yet. You can also delete the stored local report there.

Headset profiles you share

VR headsets carry a QR code holding a viewer profile: the lens measurements their maker published so any Cardboard app can render correctly for that hardware. Most of those codes point at a link-shortening service that is being retired, so scanning one increasingly leads nowhere and the headset cannot be set up.

If you agree when asked, the app sends the maker's profile from a headset you scan so it can be added to the list everyone chooses from. The profile describes the hardware, not you. Nothing else is sent with it: no name you type, no account, no advertising or device identifier, and no information about your phone or your viewing. There is no free-text field. Submissions are held by payload and counted, reviewed by hand, and never published automatically.

This is off unless you turn it on, you are asked at most once, and you can change it at any time in Settings. Turning it off stops all future submissions; a profile already contributed describes a headset model and cannot be traced back to you.

Optional ad-blocking lists

If you turn on EasyList filters in the in-app browser's ad blocking menu, the app downloads the public EasyList and EasyPrivacy lists from easylist.to every few days. Those requests send nothing about you, your browsing or your device beyond what any download reveals (your IP address); the lists stay on your phone, and turning the option off deletes them.

Retention and deletion

Local app data remains until you clear the relevant history or browser data, sign out of a media server, delete a crash report, clear VR Player's Android app data, or uninstall the app. Local media data is separate from optional rewards account records.

Pseudonymous reward and replay-prevention records, including device keys, are scheduled for automatic deletion eight days after their last use; Firestore cleanup is asynchronous and may finish later. This short retention prevents the allowance from being reset and allows delayed rewards to be reconciled.

If an earlier version signed you in with Google for rewards, delete that account from Premium → Rewards account → Delete rewards account, or request deletion at our account deletion page. Firebase sign-in account data is removed on deletion. Account deletion does not cancel Google Play subscriptions or remove lifetime purchases.

Analytics events are retained by Google for 14 months, after which Google deletes them automatically. Crashlytics keeps crash reports, and the installation identifiers attached to them, for 90 days before it starts deleting them; the raw memory snapshot of a native crash is kept only while that crash is being processed. Uninstalling VR Player resets the Firebase installation identifier used to group them. Google and the operators of websites, streams, or media servers you choose control their own retention and deletion. Use their account controls or contact them for data held by those services. Premium users can stop future AdMob requests from VR Player; Android also provides controls to reset or delete the advertising ID.

Children

VR Player is a general-audience app and is not directed at children. It is not intended for users under the age required for ad-supported apps in their region.

Security

Sensitive local data (history, browser session state, media-server access tokens, pairing records, and rewarded unlocks) is stored in app-private storage encrypted with keys held in the Android Keystore, and is excluded from device backups. Rewards account and verification data is processed by the Firebase/Google Cloud services described above.

Changes to this policy

If a future version of the app changes what data is handled — for example a new SDK — this page will be updated before that version ships, with a new effective date. Significant changes will be noted in the app's update notes.

Contact

Ellipse — ellipseapps@gmail.com