Skip to main content
VR
VRChem

Privacy Policy

Last updated: August 2026

VRChem is a free educational tool developed by the Neil Garg Lab at UCLA. We are committed to protecting your privacy, collecting only what we need, and being transparent about where it goes.

Information We Collect

Account Information

You may use VRChem anonymously or create an account. If you sign in, we collect your email address for authentication. Anonymous sessions are assigned a temporary identifier and are automatically deleted after a period of inactivity.

Molecule Data

Custom molecules and chemistry files you upload, the customization choices you make (colors, ball-and-stick settings, animation frames, etc.), and the 3D models we generate from them are stored to render and deliver your exports. When you create a share link or VR code, the shared configuration is retrievable by anyone who has the link or code — that is what makes sharing with a classroom work — so treat share links like anything else you hand out. Specific retention windows are described under Data Storage & Security below.

Usage & Analytics

If you accept analytics in the consent banner, we collect data about how the site is used — pages visited, features used, session duration, error reports, general interaction patterns — via Google Analytics 4. Some events include content you typed or provided, such as the molecule name you searched for or the name of a file you uploaded, so we can see which molecules and formats matter to educators. If you decline, no analytics events are sent. We use this data to improve the educational experience; we don’t sell it to advertisers or data brokers.

Site Security (App Check)

We use Google reCAPTCHA Enterprise (via Firebase App Check) to distinguish real visitors from automated abuse traffic. reCAPTCHA collects browser characteristics and interaction signals to compute a risk score; this happens regardless of your analytics-consent choice because it’s required to protect the service from abuse. Use of reCAPTCHA is governed by Google’s Privacy Policy and Terms of Service.

Device Information

We collect basic device information such as browser type, operating system, and screen size to ensure compatibility and optimize performance. WebXR / VR-headset spatial tracking data (head, controller, and — where hand tracking is used — hand pose) is processed on-device by your browser and is never transmitted to our servers.

Cookies & Local Storage

We use a single first-party cookie (vrchem_consent) to remember your analytics choice across visits and across vrchem.net subdomains; this cookie is set whether you accept or decline and is required for the consent banner to function. If you accept analytics, Google Analytics 4 sets its own cookies (_ga, _ga_*) for traffic measurement. If you decline, no analytics cookies are set. We don’t use advertising or third-party tracking cookies. You can revisit your choice anytime via “Cookie settings” in the footer.

We also keep a small amount of data in your browser’s own storage, where it stays on your device and is never transmitted to us: your light/dark theme choice, a short list of molecules you recently viewed (so the search page can offer them back to you), a cache of recent search results, and — in the VR viewer — your controller and comfort settings (hand preference, volume, animation speed, and similar). Clearing your browser’s site data removes all of it.

How We Use Your Information

  • Provide and operate the VRChem service
  • Generate and deliver your molecule exports
  • Analyze usage to improve the educational experience (only if you accepted analytics)
  • Maintain site security and performance

We do not sell your personal information to advertisers or data brokers, and we don’t currently run ads on the site. If we ever introduce ads to help support the service, we will update this policy and re-prompt for consent before any advertising-related data collection begins.

Data Storage & Security

Our services run on Firebase / Google Cloud (account, auth, analytics, file uploads) and Amazon Web Services (the 3D-rendering pipeline that turns your customizations into VR files). All transport is encrypted (HTTPS / TLS), data at rest is encrypted by the provider, and access is gated by least-privilege IAM roles.

We keep your data only as long as it’s needed to provide the service. Successful exports are kept long enough to share with classmates or revisit later (longer for signed-in users than anonymous ones); failed and canceled exports are discarded shortly after, except for a brief diagnostic window. Generated 3D models stay available while the share link is in active use; an idle-cleanup job removes models that haven’t been opened in a long time, while a small set of featured or pinned examples we curate for the galleries is kept indefinitely. Share links expire on their own schedule (roughly six months after their last use). Anonymous accounts and their associated uploads are removed automatically after a period of inactivity. Analytics data (GA4) is retained per Google’s configured retention setting (currently 14 months); aggregated reports may persist longer. Specific retention windows can be tuned over time as we learn how the service is used; the current values can be obtained on request.

Third-Party Services

VRChem relies on the following third-party services. Your interactions with them are also subject to their privacy policies:

  • Firebase / Google Cloud: authentication, data storage, analytics, App Check (reCAPTCHA Enterprise) — Google Privacy Policy
  • Amazon Web Services: the 3D-rendering pipeline that turns your customizations into VR files (Lambda, Step Functions, S3, CloudFront, DynamoDB) — AWS Privacy Notice
  • PubChem (NIH / NCBI): when you search for a molecule by name or CID, your query is sent to PubChem to retrieve structural data — NCBI Policies
  • 3Dmol.js: molecular visualization library, runs in your browser — 3dmol.org
  • Wikipedia: when you open a molecule’s info panel, your browser may look up its article on Wikipedia, which receives the request (including your IP address and the molecule name) — Wikimedia Privacy Policy
  • Iconify: interface icons load from Iconify’s public CDN (or its mirror hosts simplesvg.com / unisvg.com), which receives standard request metadata (IP address, browser type) but none of your molecule, search, or account data — iconify.design
  • jsDelivr: the VR viewer may load open-source library assets from the jsDelivr public CDN, which receives standard request metadata — jsDelivr Privacy Policy

Schools and universities may embed the VR viewer in their own course pages (embedding is limited to academic domains). When you use VRChem inside another site’s page, that site can see that you visited it and may run its own analytics; this policy covers only what VRChem itself collects.

Your Rights

Regardless of where you live, you may:

  • Access your data by emailing the address in Contact below
  • Delete your account and associated data at any time (deleting your account triggers an automatic sweep of your uploads, molecules, short links, and the share links you created)
  • Opt out of analytics by clicking “Cookie settings” in the footer to reopen the consent banner — or by using browser privacy settings / extensions
  • Correct or export your data by emailing us with the account email you used

California residents (CCPA / CPRA)

The categories of personal information we collect are listed under Information We Collect above. We do not sell or share personal information for cross-context behavioral advertising, so a “Do Not Sell or Share My Personal Information” link is not applicable. You have the right to know, delete, correct, and limit use of your personal information; contact us using the address below to exercise those rights.

EU / EEA / UK residents (GDPR / UK GDPR)

Our legal bases for processing are: legitimate interest (site security, fraud prevention), consent (analytics — given via the banner, withdrawable at any time via “Cookie settings”), and contract performance (delivering the exports you request). You have the right to access, rectification, erasure, restriction, portability, and objection. You also have the right to lodge a complaint with your local data-protection supervisory authority.

Children's Privacy

VRChem is designed for educational use. We do not knowingly collect personal information from children under 13 (under 16 in some EU member states) without verifiable parental consent, in line with COPPA / GDPR-K. If you believe a child has provided information without appropriate consent, contact us and we will delete it. Schools and educators using VRChem in the classroom are responsible for obtaining any required parental consent and should sign in with a teacher account rather than have students create individual accounts.

Business Transfers

If VRChem (or substantially all of its assets) is involved in a merger, acquisition, reorganization, financing, sale of assets, or similar transaction — including a transfer from UCLA or the Neil Garg Lab to a successor entity established to operate the service — your information may be transferred as part of that transaction. The recipient will be bound by commitments at least as protective as this Privacy Policy with respect to your information, or we will give you notice and a meaningful opportunity to make choices about your data before it becomes subject to a materially different privacy policy.

Changes to This Policy

We may update this Privacy Policy occasionally. Material changes will be communicated by posting a notice on the site and, when we update the cookie-policy version, by re-prompting visitors via the consent banner.

Contact Us

If you have questions about this Privacy Policy or want to exercise any of the rights listed above, please contact:

lab@vrchem.net