Privacy in the alpha.

Roamlet’s research alpha stores only the records needed to run your guest session and shared harbor. This notice describes the current implementation; the public-release policy is still under review.

Your guest session

A signed session cookie connects this browser to a server-issued guest identity. Authentication records include an internal guest email identifier, creation and expiry times, and session metadata such as IP address and browser user agent. You do not need to provide an email address to play.

Your shared world

Cloudflare D1 holds the world directory and authentication records. A Cloudflare Durable Object stores the harbor’s completed actions, building permissions, decorations, and recent place memories. Recovery snapshots are stored privately in Cloudflare R2. Other people with the invitation can see the shared world; it should not be used to store sensitive information.

Communication and ideas

Quick phrases and emotes are delivered live. The application does not persist those social messages as chat history. If you ask Tavi for a design, your short request can be sent to Cloudflare Workers AI to select an approved catalog item. It is not stored as a personal memory or placed in general application logs. Ready-made designs remain available without a custom prompt.

Reports and postcards

Reports store a reason, room and player identifiers, and a timestamp for operator review. Postcard screenshots are created in your browser and downloaded to your own device; they are not uploaded by the game. Get permission from pictured friends before sharing publicly.

Limits and retention

Guest sessions expire after 30 days unless renewed through use. That is an access window, not an automatic deletion promise: saved world data and recovery snapshots may remain. A self-service deletion and cross-device recovery flow has not yet shipped. Do not put personal or sensitive information into this alpha.

There are no advertising trackers, purchase flows, public profiles, or user file uploads in this release. Cloudflare infrastructure may retain security and operational logs under the account’s settings.

Before wider release

A complete operator contact, retention and deletion process, jurisdiction-specific policy, and audience review are still required before a broader public launch. This alpha notice does not replace that work.