Depthray privacy policy

Last updated 4 November 2026 (the browser engine, and where a web video was left). This policy covers the Depthray app for Meta Quest and PICO headsets, published by Woodford XR, the trading name of Sean Gilleece, a sole trader. The terms of use are a separate page.

简体中文版本：Depthray 隐私政策（简体中文）。

The short version

Depthray has no account of its own, no analytics, no crash reporting and no advertising, and Woodford XR keeps no database of its users. The app does collect and process a small amount of personal data, all of it listed below. It collects two things: your Meta user ID on Meta Quest, and your purchase and entitlement record with the store, both used only to check that you own the app. It also processes, without collecting, the details of the servers you add, which stay on your headset and which Woodford XR never receives; and whatever you put in a problem report, if you choose to send one. Since version 1.1 the app has a web browser. What you browse, your favourites, history and cookies stay on the headset. You can ask for anything Woodford XR holds about you to be deleted by writing to support@woodfordxr.com.

The data the app collects, the data it processes, and why

Depthray collects two items of personal data, your Meta user ID and your purchase and entitlement record, and processes a few more that never leave your headset. Each is listed here with what it is used for.

• Your Meta user ID (Meta Quest). Collected. The Meta Horizon platform identifies the Meta account signed in to the headset by its user ID. Depthray collects it, through Meta's Platform SDK, each time it starts, and uses it for one purpose: to check that your account is entitled to the app. It is not shown, not written to the log, not stored by Woodford XR and not sent anywhere but to Meta.
• Your purchase and entitlement record (Meta Quest and PICO). Collected. The app collects this from the store: it asks whether your account owns Depthray and whether it has bought the one in app purchase that unlocks the app after the free trial, and it opens the store's own checkout when you choose to buy. This is used only to unlock the app. The app stores the answer (unlocked or not, and how much of the trial is used) in its private storage on the headset, and nowhere else. Woodford XR never receives it, and never sees your payment details, which stay with the store.
• Your servers and settings. Processed on the headset, not collected. The servers and shares you add, their passwords and access tokens, your settings and your playback history. The app on your headset uses these to play your files and resume them. They are kept on the headset only: Woodford XR never receives, sees or stores your passwords or tokens, and has no way to reach them. They leave the headset only to the server they belong to, when the app signs in to it.
• The web pages you open. Processed on the headset, not collected. The browser keeps your favourites, history, cookies and what sites store, in its own storage on the headset. Woodford XR never receives any of it. The sites you visit see what any browser shows them, under their own privacy policies.
• A problem report, if you send one. Collected only when you press Send. Your message, the headset model, the app version, the app's log and your email address if you give one, used only to look into the problem and to reply. This is the only data that reaches Woodford XR.

None of this is sold, shared for advertising or used to build a profile of you.

What stays on your headset

Depthray keeps, in its own private storage on the headset: the media servers and network shares you add, with their passwords and access tokens encrypted under the headset's own key store; your settings; and your playback history, so a film can resume where you left it. For the last fifty videos played from a web address, a direct link or a page video handed to Depthray's player, it keeps only a hash of the address and the position, never the address itself, so those resume too. None of this is sent to Woodford XR or to anyone else, and Woodford XR has no access to it: your passwords and tokens go only from your headset to the server they belong to, and they are never written to the log or put in a problem report. Removing a server in the app deletes its details, and uninstalling the app deletes all of it. The browser's favourites, history, site icons, cookies and site data are kept there too. Settings > Web has Clear cookies and site data, which signs you out of every site in Depthray including YouTube, and Clear web history. Favourites go when you remove them.

What the app connects to

• Your own servers. When you add an SMB share, a DLNA server, an Emby, Jellyfin or Plex server, or a WebDAV server, Depthray connects to that server to list and stream your files. Those connections carry your credentials for that server and nothing else. On a home network many of these servers use plain http; the app tells you when an address you enter is not encrypted. Find servers for SMB listens for servers announcing themselves on your local network; it sends nothing about you.
• Emby Connect and plex.tv. If you choose to sign in to Emby or Plex with your account, Depthray contacts Emby's or Plex's own sign in service, which is how those services hand a player the list of your servers and the tokens to reach them. Those services have their own privacy policies. Depthray sends them only what their sign in needs.
• The store you bought it from. On Meta Quest the app checks with the Meta Horizon platform that your account is entitled to the app, and uses the same platform for the one in app purchase that unlocks it after the free trial. For this it uses your Meta user ID and your purchase record for the app, as set out above, and for nothing else. On PICO headsets the app checks with the PICO platform in the same way that your account is entitled to the app, and uses the same platform for the purchase; it asks the platform for no user ID and keeps nothing of the exchange. The stores' own policies cover the download and the purchase.
• The websites you open in the browser. The app connects to whatever address you type or follow, as any browser does. The browser is Mozilla's GeckoView engine, and sites see a standard Firefox browser, not the headset or the app; with Desktop sites on they see Firefox on a Linux computer. A site that plays protected video is given the headset's Widevine DRM identity. Requests from pages for the camera, the microphone or your location are refused, and downloads are not offered. The app also fetches a small icon from each site you save as a favourite.
• YouTube. YouTube opens in the browser as YouTube's own website. Signing in is Google's own page, in the browser like any other site; the app never sees your Google password or account and reads nothing of it. What YouTube collects while it is open is Google's, under Google's privacy policy. Sign out of YouTube in Settings clears its cookies.
• Browser safety services. To warn you before a dangerous site and to check that sites' certificates have not been revoked, the browser engine downloads lists from Mozilla and from Google Safe Browsing. When an address you open matches a list, only a short fragment of a hash of that address is sent to Google to confirm it, never the address itself. Certificate checks may also ask the authority that issued a site's certificate. None of this carries anything about you or your account.

Apart from these, the only network use is a problem report you send yourself, described below. There is no telemetry, and nothing is sent to Woodford XR.

Hands, eyes and cameras

Hand tracking, where you have allowed it, is used only to aim the pointer and to detect a pinch. Eye tracking, on headsets that have it and where you turn it on, is used for pointing only: where you are looking becomes where the pointer is, frame by frame, and that is all. The app never stores gaze data, never sends it anywhere, and writes none of it to its log or to a problem report, so there is no moment at which it starts to store or transfer it. The passthrough view is composed by the headset's own system; the app never receives the camera image. The app never asks for the microphone. None of this is recorded, stored or transmitted.

The log and Report a problem

Depthray keeps a plain text log of what it did in its own private storage on the headset, which goes with the uninstall. The log names no file you played, only the file type (".mkv"); the servers you added are named in it, and so is the site, not the page, of what you open in the browser. Clear history in the app empties it, and it leaves the headset only inside a report you send. The Report a problem row in About asks you what happened and, if you want a reply, for your email address. When you press Send, the app sends your message, the headset model, the app version, the last performance line and that log to Woodford XR. Nothing is sent until you press Send, and a copy of what was sent stays on your headset in Download/Depthray/reports so you can read it.

The report travels over an encrypted connection to a small relay run by Woodford XR on Cloudflare, which passes it to Resend, an email delivery service, which delivers it to Woodford XR's support mailbox at Namecheap. Those three providers handle the report only to carry it and are the only third parties that see it. The log can name the servers you added, and the report carries your email address only if you typed one. A report is kept in the support mailbox while the problem is looked into and deleted after; if you gave an address it is used only to reply about that report.

Children

Depthray is for users aged 13 and over, and is not directed at children.

Requests from authorities

Woodford XR holds no data about Depthray's users beyond the problem reports they chose to send, so it has little it could produce. Any request from a public authority is reviewed for its legal basis, refused or challenged if it lacks one, answered with no more than the law requires, and recorded.

Your rights and deleting your data

To ask for your data to be deleted, write to support@woodfordxr.com with the subject "Delete my data", from the email address you gave in a report or with enough detail to find it. Woodford XR will delete every problem report and message it holds from you and confirm by reply within 30 days. The same address takes requests for a copy of what is held about you or to have it corrected.

The two items the app collects. The copy of your purchase and entitlement record on your headset is deleted when you uninstall the app, and your Meta user ID is never stored by the app or by Woodford XR, so there is nothing of it to delete; the originals of both are held by Meta or PICO, as set out below. To have anything Woodford XR holds about you deleted, or to be told that it holds nothing, write to support@woodfordxr.com as above and you will have an answer within 30 days.

Data on your headset is in your hands. Clear history in the app empties the playback history and the log, removing a server deletes its details, and uninstalling the app deletes everything Depthray stored, the trial and unlock record included. The copies of reports you sent, in the Download folder, are ordinary files you can delete yourself.

Data held by the store. Your Meta or PICO account, user ID and purchase history are held by Meta or PICO, not by Woodford XR, which has no copy to delete. To have those deleted, use the privacy settings of your Meta or PICO account. If you write to Woodford XR about them, it will tell you where to ask.

Changes

If this policy changes, the new version is published at this address with a new date. It will not start collecting data without saying so here.

Contact

Write to support@woodfordxr.com, or see the support page.