What happens in the factory stays in the factory

Who we are

This policy covers CEO: Chief Extermination Officer – the Meta Quest game and the Android pest app – and this website, ceo.mihalovics.com. Both are made by Mihalovics Labs, which is who “we” means here. Privacy questions go to hello@mihalovics.com.

What the game handles

The game needs a few things to work. All of them stay on your devices or travel only between the devices in your match, over your own local network. The one exception is a player report, explained in the next section:

• Your player name. You type one before a game so the scoreboards know who’s who, and the other players in your match see it. It doesn’t have to be your real name – a nickname works just as well.
• A random player code. The first time you join a match, your device makes up a random code and keeps it, so if your Wi-Fi drops you rejoin with your score. It’s not your phone number, a hardware ID or an advertising ID, and it’s only ever sent to the headset you join.
• The match itself. Where your pest runs, where the CEO’s headset and controllers are, what gets grabbed and who scored what: the devices in a match exchange this so everyone sees the same game, and the headset keeps the scores for the round recaps. It’s game data, used only while you play.
• Finding the match. Your phone asks the local network who holds the 6-digit join code, and that headset answers. There’s no matchmaking service and no server, so nothing goes over the internet.
• Your settings. Options such as volume, vibration, comfort, graphics and language are saved on the device so they’re there next time. On first launch the game reads the device’s language to pick its own.
• The ownership check (Meta Quest). Each time the Quest game starts, it asks the headset’s own Meta software whether your Meta account owns the game – the Meta Horizon Store requires this of the apps it sells. The headset answers on the spot, without the internet, and the game only uses the yes-or-no answer. None of it is sent to us.

Player reports (Meta Quest)

If someone in your match plays unfairly, harasses others or picks an offensive name, the person in the headset can report them – from the Report button in the Meta menu or from the game’s Players page. Meta’s own report form only knows Meta accounts, and the phone players don’t need one, so the game sends these reports to us, through this website:

• What a report holds. The name the player was shown under (and the name they chose, if it was hidden), the reason picked from a list, a short note if one was written, the game version, the time and a random report number. It names no one who sent it: no account, no device ID and no player code.
• The sender’s internet address. Our server keeps the IP address a report came from with the report, so that no one can flood us with reports: one address can send at most 20 an hour.
• Where reports are kept. In Google Cloud Firestore, a Google service that stores them for us as our processor, under Google’s data processing terms. Only we read them, to deal with the player reported.
• How long. Every report, with its address, is deleted automatically within 12 months of arriving.
• Without the internet. A report made while the headset is offline is saved on the headset and sent the next time the game starts. One that still can’t be sent after 30 days is deleted unsent.
• Asking us to delete one. Write to hello@mihalovics.com and we’ll delete reports about you, or ones you sent – “Your rights” explains how we find them.

What the game never does

The game does not:

• collect personal data, or send anything to us or to anyone else while you play – apart from a player report someone chooses to send;
• show ads or use an advertising ID;
• include analytics, crash reporting or any other third-party tracking code;
• use the microphone, the camera, your location, your contacts or the headset’s passthrough view;
• track your eyes, face, body or hands – the headset game is played with the controllers;
• sell or share your data – it has none to sell or share.

App permissions

Besides what the headset needs to run any VR app, the Android pest app and the Meta Quest game (which runs on Android) ask only for:

• Network access. Android calls every network connection “internet”, including the local one the game plays over. The game only ever connects to devices on your own network.
• Wi-Fi state and multicast. So the phones and the headset can find each other on the local network by the join code.
• Vibration (phone). For the buzz when something happens to your pest. You can turn it off in Options.

Where you get the game

• Meta Quest game. The Meta Quest game is sold on the Meta Horizon Store, and its SideQuest page links there. Your account and your download are handled by Meta, under its own privacy policy.
• Paying. The store takes your payment, so the purchase is between you and the store and we never see your card or payment details. Its sales reports may show us some details of a purchase – such as the date, amount, country and, depending on the store and your choices there, your email address – which we use only for support and refunds.
• Android pest app. The pest app, CEO: Pests, is free on Google Play. Google handles your account and the download under its own privacy policy, and gives us statistics such as install counts and crash rates, which we use only to look after the game.

This website

• No tracking. No analytics, no ads, no social media widgets, and no third-party scripts or fonts. Everything is served from our own server – except the trailer, and only once you press play.
• Two small cookies. A session cookie the site needs to run the page, deleted when you close your browser – and, only if you use the EN/HU switch, one that remembers your language for a year. Neither is used to track you.
• The trailer. The trailer is a YouTube video. The page loads nothing from YouTube until you press play; then the video plays in YouTube’s privacy-enhanced mode (youtube-nocookie.com), and Google handles it under its own privacy policy.
• Server logs. Like any web server, ours records basic request details – IP address, time, page and browser – to keep the site running and secure. We don’t combine them with anything else or share them, and we delete them once they’re no longer needed.
• Email. If you write to us, we use your address and message only to reply.
• Links out. Links to the app stores, our studio site and social networks take you to services with their own privacy policies.

Children

The game asks no one for personal data, children included: a player report names the player reported only by the name they typed into the game. Buying the Quest game happens on the store, under its own age rules. If you believe a child has sent us personal data, for example by email, write to us and we’ll delete it.

Your rights

Under data protection laws such as the EU’s GDPR, you can ask what personal data we hold about you, have it corrected or deleted, and object to how it’s used. The game sends us nothing but player reports, so what we could hold about you is limited to a report that names you by your in-game name, purchase details from a store’s sales report, an email you sent us, or our web server logs – write to hello@mihalovics.com and we’ll help. For what a store holds about you, ask the store.

To remove everything the game keeps on a device, uninstall it or clear its app data. You can also complain to your local data protection authority.

Some requests we can’t fully meet. A player report names no one who sent it, so we can find a report you made only by when you sent it and the name it reports – tell us both. Your purchase is recorded by the Meta Horizon Store, not by us, so we can’t delete that record – ask Meta.

Changes to this policy

If the game ever handles data differently – online play, for example – we’ll update this page before that version comes out and change the date at the top.

Contact

Questions or requests about your privacy? Write to Mihalovics Labs at: