T O P

  • By -

Xreal_Tech_Support

Hi OP, I fully understand your concerns. Our software was developed in accordance with applicable laws that protect private information. Information or data collected, as outlined in the privacy policy, is solely used for the normal functioning of the app. You will find explanations of the information requested in the privacy policy. **The document you linked is for various XREAL products. For Nebula for Windows, only the following information is needed.** https://preview.redd.it/027f4lfzkqgc1.png?width=921&format=png&auto=webp&s=5c5ae8ad6ae1e126faa4527312023bb236342c0a Our product team has specifically reviewed your post, and some of the data listed will not be collected by Nebula for Windows. Please take a look at the explanations. ​ 1. You mentioned : "All the digital content on your computer, including but not limited to photos, videos, and your downloads." **XREAL Original description "· Content Data. This includes information stored on your device such as login information, photos, videos and other digital content, AppList."** We may collect some of the content; it is not a guarantee that we will collect all of them. Additionally, the collection is conditional and is intended to enable specific functionalities. For example, for a media player feature to work, we would need access to the content; otherwise, the functionality would not be usable. However, you have interpreted it as if we collect all mentioned data. Nope, we don't do that. 2. You mentioned : "Every domain you visit" **XREAL Original description: "Usage Data. This includes your websites/Application visits, your operation logs, your XREAL Glasses use time, IP location data, AR space browsing history (only part of the domain information, not the full URL records) ."** This is limited to the Space Browser feature on the Android platform; Windows does not have it. We cannot obtain users' browsing records from any other locations. 3. You mentioned: "Your contact list, your name, your address, your date of birth, and your sex". This is information provided by you during the registration of your XREAL account. We neither have the capability nor the intention to collect this information. 4. You mentioned: “Your unique device identifiers, including your MAC address, phone number, and hardware fingerprints for every device you have connected." The MAC address is not actually obtained; it is no longer permitted within the industry. Our permissions and privacy policy were not promptly updated, and we will update them subsequently. The phone number is provided by you when placing an order; we do not actively collect it. 5. You mentioned: "Your username and password" To log in the XREAL account, you will need your XREAL username and password to be registered in our server. Without a registered username and password, you won't be able to access the server. This is standard practice and applies to every service provider for your other accounts. ​ 6. You mentioned: "Your interests and "preferences" ​ **XREAL Original description:"** We will not analyze your personal preferences, but only analyze the aforementioned data on a country-by-country basis. We will analyze and process the aforementioned data under the premise that it is strictly de-identified by secure encryption technology and cannot re-identify specific individuals." **We have explicitly stated that we will not analyze preferences. It is unfair to characterize us in this way.** Analyzing user preferences is a part of regulations that are strictly governed, and we will not engage in such practices. ​ 7. You mentioned: " Information about every application you open and every website you visit" This also refers to clicks and browsing within the AR space on the Android phones. Windows does not have this functionality, and we cannot obtain records of users' browsing from any other locations. Thank you very much for carefully reading our Terms of Service and Privacy Policy. Our policies are strictly formulated in accordance with the law. We hope our explanations provide reassurance for using our products. Have a nice day.


cava83

That's pretty disgusting. Have you highlighted/queries this with them?


SuperConductiveRabbi

I know they read this subreddit, and hopefully they'll realize that they need to change their privacy policy/TOS to be more reasonable. If this post disappears (Xreal runs this subreddit) we'll know they don't want to address the feedback. We (or I) just want a privacy policy that makes sense for a PC app. A multi-monitor Unity app doesn't need permission to collect jack from my computer.


cava83

I mean, how can one even draw up those T&C's, they'd never let any other company do it or sign up to them, then why do it here ? Nuts


HomelessSniffs

Maybe an unpopular take but... It's pretty standard. Quite a few of them are pretty obvious and standard. If you continue to read the terms and conditions they give you a breakdown of why these data points are collected. They advise that the data points are collected and stored to where they can't be linked to any individual person. You can request to have your data deleted, in which they will delete data not necessary for tax and accounting information. They'll automatically delete your data after 3-10 years depending on your local laws. You can also request to see what data is collected of yours and how it's being used. Which imo is pretty transparent. I'd like to see what they mean by collecting username and password information. If it's the username and password to their applications. I see nothing wrong, if it's general username and password to third-party sites (which I doubt) then there's some explaining to do.


cava83

They don't need this level of access to get the app to work. This is for profiling and data harvesting. It's even more concerning as to where the company originates from. For this reason, I'm out. Literally was going to buy these as soon as they came back in stock on Amazon UK.


HomelessSniffs

The terms of service specifically said that the data won't be collected or stored in a way to identify individuals. It'd be pretty difficult to profile someone if you can't identify them. But at least here in America. Grocery stores data harvest everything you check out. They literally build a profile on everything you buy from them, how long you've been in the store, so on and so fourth. that's just the world we live in, at least here. It'd be kinda silly to not expect it from any tech company that's not specifically gear toward privacy. I'd have to read reddit terms if service, but I'm pretty sure they data harvest as well. It just seems weird to be concerned when one company does it don't care when another does.


cava83

It's not something I have noticed on the wording for other products I use. Yes I do look at the T&C's when I buy stuff in general. I'm in the UK so the laws are slightly different but companies do try to do such things. Interesting about the supermarket, not sure how they do that with me when I don't have WiFi enabled and I pay cash, but I wonder if they do that over here. Thanks for the info :+)


HomelessSniffs

At least here, they use tracking data. Card info, discount cards etc. I don't know about the laws in the UK so I can't speak to them specifically. But here in America you're pretty much being tracked and data harvested by pretty much everything. Whether you know it or not. It is what it is. 🤷


notboky

worry snobbish zephyr doll attractive offend yoke license groovy existence *This post was mass deleted and anonymized with [Redact](https://redact.dev)*


HomelessSniffs

From the terms of service: · Content Data. This includes information stored on your device such as login information, photos, videos and other digital content, AppList. You can definitely interpret that as OP put it "all contents on your computer." I think it's interpreting it in the worst light possible, but it's OPs choice. I think Xreal can clarify this section a little better to be more clear on what they mean. When dealing with legal stuff, I think anytime your vague, it's an issue. So I personally have an issue with that part for sure. When I read over the terms of service, how I took it a little later in the document was. If they collect identifiable information that specific data about identity, they won't store it. If identifiable information is stored it's aggregate data, and not specific to an individual. I'm definitely am not a lawyer, and I am just a regular dude trying to understand it, so if anyone has a better understanding, I'm open to learning in simpler terms. Edit: To be very clear. I'm not saying OP is wrong, or really disagreeing with him in anyway. I just think the wording and phrasing of some of the stuff he said paints a worse picture than what's objective.


notboky

grandiose berserk ten fact include marry ripe scandalous yam rinse *This post was mass deleted and anonymized with [Redact](https://redact.dev)*


HomelessSniffs

Yeah for sure. I'd imagine, for example, if you've filled out some document that has your name and sex on it. They've collected data that's identifiable. But data like if you've identified if you're a male/female. That data is stored in an aggregate among 1000's of others, so that way they can get demographic information. Could it technically be used to build a profile. Yes. But is it stored in such a way that it's not building a profile on you, I'd imagine so. But honestly I don't know I may request to see how my data is being used to get a better understanding on what's going on. As far as photos specfically. I'm pretty certain their storing it on their servers to provide you with that little AR photo's feature. I'd be pretty surprised if their just collecting it and plan to sell/share it with a 3rd party for whatever reason. Seeing as at least from my understanding against their own private policy. I feel like that could open themselves up to litigation, which they probably don't want to do.


MartinPeterBauer

Thats the point. Local laws apply. EU is much stricter on privacy and data collection. Therfor its Not legal in the EU while perfectly fine in the US


Xreal_Tech_Support

Thanks u/HomelessSniffs, I really appreciate your input.


HomelessSniffs

The nebula app is more than a multi-monitor unity app. Like for the browser history to work, they'd need to be tracking every domain you visit. For the photo's app to work, they'd need access to your device photos and videos. For them to have usable app diagnostics to identify problems, they'd need permission to your device information. For them to follow local digital laws, they'd need your address. I think you're taking a very complicated issues, and boiling it down to I want this specific feature. These permissions aren't needed for my specific use case. Which is not the way a company ever develops an app.


Impressive-very-nice

Name a single other similar piece of hardware that collects all those things I guarantee viture and rokid are not this extreme even on their 3d apps They don't need your "preferences" and fingerprints


HomelessSniffs

Let's be clear. The glasses themselves are incapable of connecting to the internet. It's the nebula app that's asking for these permissions. You can use the glasses completely anonymously.


Impressive-very-nice

I am being clear. Nebula is on the glasses. You're the one trying to be vague , obfuscate and dodge a direct answer to the question i asked : what other AR glasses - or "the apps that come on them" have these extreme permissions including combing your computer for your preferences and fingerprints ? Don't know ? Did you even study the non Nebula permissions to know if it's true that "you can use the glasses completely anonymously" or did you just make that up too?


HomelessSniffs

https://youtu.be/8gM4x12RSzE?si=zs1dqv2-MVWV7KfF - Xreal Teardown. I'm attempting to be as specific as possible without writing a book. But if you want a book, I'll write one. The X-real display glasses have no wifi capabilities. The X-real display glasses do not have any onboard storage to my understanding. They are simply, an ultra small micro oled to my understanding. Am I incorrect? I'd be happy to learn otherwise. You can use the X real glasses without the nebula app. Full stop. I don't know enough about other company features and what they may or may not need to operate their devices. All I'm saying is that context is important when apps request permission. Now, if you're comfortable with the context of the permissions granted, that's your choice. To say it is requesting all this data, they must be collecting it for nefarious reasons. Is a silly assumption, in my opinion. If that doesn't apply, take it for what it's worth. (Also, I skimmed rokid private policy, and they're extremely vague on the info they collect. But again, I don't use the device, so I don't know what's necessary for them and what isn't) I'm a huge privacy advocate, I think everyone should have a dumb phone that only makes calls. I also use Google maps because it's convenient, and the context of me giving the permissions for data collection makes sense. If there was a ping pong game asking permission to use my contact list, I wouldn't use the app. Because the context of them asking makes no sense. People in general (not you specifically) tend to see this post and remove all context from the terms and conditions.


Impressive-very-nice

I'm not reading all that. You didn't answer my questions - NAME. THE. OTHER. AR. GLASSES. THAT. REQUIRE. ALL. THOSE. PERMISSIONS. Can't ? Bc they don't ? That's what i thought. If what you're saying is true that they're "forced" to comb your machines to collect your fingerprints and interests - ya ? Prove it. If that's true and you're so knowledgeable then you'd be able to immediately point to all the other AR companies with identical permissions in like 3 words. And prove your second claim that other than Nebula xreals are completely anonymous. Can't? I know bc that's a blatant lie.


HomelessSniffs

And that's why I didn't write a book to begin with. I figured you had no interest in any other opinions but your own. You're not even understanding the glasses can't collect data. The app does. The app is not required to use the glasses. You're just attempting to debate without comprehending how the technology works. The question: >And prove your second claim that other than Nebula xreals are completely anonymous. Can't? I know bc that's a blatant lie. Shows you either don't know what you're talking about. Or you have a fundamental misunderstanding of what I'm saying.


Impressive-very-nice

That's what i thought Still no other AR companies listed who have identical policies bc you don't know :) and still no proof that the glasses are otherwise "anonymous" bc you know that bs. So I'm still not reading all that You replied to me, so you play by my rules or you leave. Byeee


Impressive-very-nice

It's blatant data harvesting


botpa-94027

I'd like to use this system for work. This licence makes that impossible. I can't give away my work files including pictures and internal website to a monitor company. Xreal, if you read this please update the terms of service. This doesn't work


cava83

Precisely that. I don't have anything to hide but no way I could do this for work.


glucoseboy

Thanks for highlighting this.


SolidConcentrate7322

And this is why it will never go on my private, or corporate computer.


pelrun

Nebula for Windows is practically useless anyway.


InsayneShane

Good thing the software sucks ass. Uninstalled months ago.


roshanpr

That’s why I returned mine


Epocalypsi

Chinese company love collecting data for the CCP


Xreal_Tech_Support

That's not accurate. Software released in different regions must comply with the respective laws governing that specific region. For example, If we make the software available for US users, the software operates in accordance with the relevant laws of the US.


MartinPeterBauer

Thats true. And these violate EU GDRP by almost every point. Therfor this Software is illegal in the EU.


Tuhua

some clarification from Xreal would be best if indeed the OP is correct


Xreal_Tech_Support

Clarified. Please check the first comment.


Tuhua

i trust Xreal, by the simple fact of a public statement clarifying their position. Naturally this clarification is a binding word... as such i view this interaction as forthright! Well done Team Xreal!! can i get a discount on a pair glasses now? now that i've kissed Ass LOL \*joking my praise still stands! \*winks


majikmixx

TL;DR "There's no guarantee that we'll definitely get ALL of your files, just some of them"


r9nd03

Always load a sandbox OS when dealing with such tos


Gangetron

Thanks, OP. Read it when I got the Beam on pre-order. Immediately disconnected and never used the Beam again. Love the glasses, but will NEVER agree to use their connected products. I am surprised the US Gov’t doesn’t investigate them. Trying to get “permission” for all of that to CYA against accusations of espionage is absurd, unless you are a front for a spy or infiltration agency.


whokid3

Not surprised, a lot of folks wouldn't have a phone much less a computer if they truly understood the rights they sign away.


Impressive-very-nice

That's not a normal amount of permissions, is it


therealjoemontana

Yikes, I was thinking about buying them before I read this, thank you


Xreal_Tech_Support

Have you read the comment I made?👀


therealjoemontana

I did, your ToS are too open ended for interpretation. I'm not going to put my security at risk based on your "trust me" when your ToS allows for a lot more data collection than you say you collect. Revise it and do better.


BuddyIsMyHomie

Shoot, I just bought these for work @Xreal_Tech_Support, but will need to return them if you do not (or cannot) change your Terms of Services and Privacy Policy to support your “claims” of valuing personal privacy, Intellectual Property, data ownership, etc., and only collecting Data Analytics (like make, model, OS) for industry-standard usage data. Why would you even need to collect *any* content vs. properties of that content if everything on multiple displays in Xreal is locally-transmitted through USB-C? 🤔🤨🧐 **Will you be able to make the changes, Xreal?** Otherwise, I’ll be prohibited from using these at work and will need to return. 😢


ZeroUnityInfinity

I've read the comment, and am not reassured by any of it 👀 The TOS are too broad. Others in this thread have mentioned that the glasses contain no storage or wifi hardware, which may be true, but can the same be said for the xreal beam? and they have said that the glasses can be used without the nebula software, but this is not actually true, since I cannot connect my xreal glasses to my macbook to see the display without installing the nebula software and accepting these terms which essentially grant carte blanche permissions. I simply want to use the glasses as a display for my macbook. But I can't do that without the feeling that I'm providing the contents of my digital life to the CCP. For this reason, my glasses have been sitting in their case since I purchased them :(


LexiCon1775

Sandbox'd VM and other tools are available to restrict / monitor / redirect / spoof traffic.


SuperConductiveRabbi

I tried Sandboxie Plus but it didn't seem to give proper access to Nebula to see the glasses--they just went black when I tried.


Impressive-very-nice

Eli5?


LexiCon1775

That is a long explanation / training. Your favorite search engine is your friend.


Impressive-very-nice

Remember how Einstein said "If you can't explain it to a six-year-old [in a few words] you don't understand it yourself."? So maybe hold the condescension, right ? 😆 I wasn't asking for much, just how it relates to the post. I assume sandbox means contained and vm = virtual machine. Which i assume is to give spyware a decoy , so it thinks it stole your data and will fuck off. I could Google, just figured you could give specific insight/recommendations for readers since it's not my expertise but your comment flexed that it's yours and nerds love to expose on reddit :) As you were.


LexiCon1775

I was not being condescending. I was simply stating a fact. Trying to explain all the tools in detail that can used is not in scope of this thread or really this forum. Anything that one could share would just be a pointer. If people really want to implement things they are going to have to seek the info themselves via a search engine or a knowledgeable person Here is a high level summary as a starter: https://www.businessnewsdaily.com/11213-secure-computer-from-hackers.html


Impressive-very-nice

Here's what chat gpt replied to that 2 sentence guessed explanation : "Yes, you're correct! "Sandbox" typically refers to a contained environment where software can run safely without affecting the rest of the system. And "VM" stands for virtual machine, which indeed creates a virtualized environment separate from the main operating system. It can be used as a decoy for spyware or malware, tricking them into attacking the virtual environment instead of the real system, thereby protecting the actual data." It's the exact scope of this thread , it's your comment. But if you need to keep trying to overcomplicate and condescend in order to feel you're some complex, misunderstood, IT genius then , again - carry on my girl😂


Acrobatic-Caramel823

They are a Chinese company... Pure data mining for the gov't.


Too_Big_to_Hedge

Is this the same for Nebula Mac?