Privacy Policy

Who runs Roamadic

Roamadic is a multiplayer browser game operated by Bug & Bean LLC, a California limited liability company, at [OWNER: postal address for Bug & Bean LLC, which identifies the data controller]. In this policy "we" and "us" mean Bug & Bean LLC. Questions about this policy, or a request about your data, go to [OWNER: contact email address].

Roamadic is the service, served from www.roamadic.app. Glade is the world you walk around in once you are playing, so you will see both names: the service is Roamadic, the park is the glade. This policy covers the whole service.

The short version

You can play without an account. Doing so stores a random device identifier, a count of how many seconds you played today, and the display name you typed, which is shown to the other players in your world. If you choose to create an account, that account is held by our authentication provider rather than by us, and we store only its identifier; that provider is present on every page of this site, not only after you sign in, see below. We do not sell personal data and we do not build advertising profiles.

What we collect, and why

Your display name and colour

You type a display name (2 to 16 characters), pick a colourway, and pick a world on the landing page. All three are saved in your own browser under the local-storage key glade.identity so a return visit skips the form, and your name and colourway are sent to the server when you join a world. Your display name is shown to other players in the same world, above your character. Choose accordingly: a display name is public to everyone you are playing with. Names are filtered and truncated server-side before use.

A device cookie

When you first open a page here we set one cookie, glade_device. It contains a random 32-character identifier and a signature, nothing else: no name, no email, no browsing history. It is HttpOnly, Secure, SameSite=Lax, and has a maximum age of one year. It does three things. It is the subject of your daily play-time budget, so that clearing local storage does not silently reset the daily limit. It is what the server uses to cap how many connections one anonymous device can hold open at once (see the connection limit in the Terms of Service). And it is what the server checks before it will send you the game's 3D models and animations: those are licensed from a third party, so they are served to browsers that have loaded this site rather than to anyone who requests the file directly. That last purpose is why the cookie is now set as soon as you open the landing page, rather than only when you ask to play: the page shows a 3D character before you join anything. Clearing this cookie resets your anonymous daily allowance and your connection identity; a fresh one is issued the next time you open a page here, so nothing stays broken. The same identifier is also used to limit how many asset files one device may request in a given period, which is a bandwidth safeguard and is set far above what playing the game needs. This is the only cookie Roamadic's own server sets. [OWNER: Clerk, our authentication provider, is loaded in your browser on every page of this site, including the game itself, whether or not you ever sign in (see "Who else handles your data" below); confirm what cookies or identifiers Clerk sets for a visitor who has not signed in, and link its policy here].

A short-lived play session token

Joining a world mints a signed token that carries a per-session player id, a numeric handle used by the game's network format, your play-time tier, and your meter subject. It expires 12 hours after it is issued and is not a cookie. The realtime server verifies this token by signature alone, which is why it never has to ask the authentication provider anything while you are playing.

Daily play time

Free play is metered. While you are connected the server adds up your connected seconds in 30-second increments and stores the running total under a key of the form meter:<subject>:<YYYYMMDD>. The subject is d.<device id> if you are anonymous and u.<account id> if you are signed in. The value stored is a number of seconds and nothing else. The day boundary is UTC midnight, chosen because a local-timezone boundary would depend on a value the browser can simply lie about. Each day's counter is deleted automatically 48 hours after it is last written.

The budgets themselves are 20 minutes a day without an account, 60 minutes a day with one, and unmetered on the paid plan.

Accounts, if you create one

Accounts are provided by Clerk. Sign-in and sign-up are rendered by Clerk's own components, and your email address, password, and any other credential you give them are held by Clerk under their privacy policy, not by us. Our own servers consult Clerk in exactly two places: the landing page, and the request that mints a play session. The game itself, the realtime relay, and the simulation loop never consult it at all. What we store from your account is the Clerk user identifier, used as your play-time meter subject and to attach your durable in-game currency balance to you. [OWNER: link Clerk's privacy policy here, and confirm the data-processing terms you have accepted with them].

Payment, if you subscribe

The unlimited plan is sold through Clerk Billing, whose checkout is processed by Stripe. Card details are entered into their checkout, not into Roamadic, and no payment card data reaches or is stored on our servers: this application contains no payment handling code at all. All we ever learn is whether your account currently holds the unlimited plan, which we read from a claim already present in your signed-in session. [OWNER: link the payment processor's privacy policy, and confirm which entity is merchant of record for the subscription].

Gameplay data

While you are in a world, your movement inputs and your character's position are sent to the server, simulated, and broadcast to the other players in that same world, because that is what a shared world is. This data is transient. The server keeps a periodic snapshot of a world so that a server restart does not interrupt play; that snapshot expires one hour after it is last written, and a world with nobody in it therefore disappears on its own. A short-lived record of your chosen name and colour also lives alongside the world you are in so that other players' clients can label your character; it expires two minutes after it is last refreshed.

In-game currency

Playing scored activities awards an in-game currency. For an anonymous player that balance is deliberately temporary and rides the same day-long record as your session. For a signed-in account it is stored durably against your account identifier, as a balance and a creation timestamp, with no expiry, so that it survives between visits. This currency has no monetary value and cannot be exchanged for money.

Your IP address

We use your IP address for one purpose: to limit how many play sessions can be requested from a single address per minute, which is what stops the game's session machinery from being trivially abused. It is used as part of a counter key that expires two minutes after it is written. We do not store your IP address in our diagnostic logs, and we do not use it to profile you. [OWNER: our hosting and infrastructure providers keep their own access logs, which will contain IP addresses; confirm each provider's retention period and state it here].

Diagnostics and error reports

If something breaks in your browser, the game may send an error report. The report contains exactly four fields: your session token (so we know the report is from a real session and not an open write endpoint), a short category, an error message truncated to 200 characters, and up to 8 small key-value pairs, which for a script error are the script file and line number. It never sends the page URL, the contents of your storage, your name, or anything you typed. The client sends at most 5 such reports per page visit, deduplicated, and the server accepts at most 5 per session per minute with a 2KB body limit.

On the server side we record operational events (a failed publish, a lost lease, a slow room) so that a broken room is visible before a player has to report it. Each event stores a severity, a category, a message, optionally the room and the temporary session player id, plus a few scalar values, a build identifier and a region. Event records are kept for 3 days; the aggregate counts derived from them are kept for 7 days. Both are capped in size.

Analytics

The site includes Vercel Analytics (@vercel/analytics), which records page visits along with the page path, the referring page, and attributes derived from your user agent and IP address such as browser, device type, and approximate location; it does not use cookies. [OWNER: link Vercel's privacy policy and confirm which analytics tier you are on, since that determines what it collects and how long it is kept].

Advertising

Advertising is currently switched off. No advertising script loads and no advertising cookie or identifier is set by this site. [OWNER: if advertising is ever re-enabled, this section must be rewritten first: it has to name the ad provider, state that the provider sets its own cookies and identifiers, link its policy, and describe how consent is obtained].

Who else handles your data

We do not sell personal data. The following services process data on our behalf because the game runs on them:

• Vercel, which hosts the site and the game servers, and provides the analytics described above.
• Upstash, which provides the Redis database holding the session, meter, world-state, and diagnostic records described above.
• Clerk, our authentication provider. Its script loads in your browser on every page of this site, including the game itself, whether or not you ever sign in, so that sign-in is available wherever you are. Our own servers consult Clerk only on the landing page and when a play session is minted; the game, the realtime relay, and the simulation loop never do. If you subscribe, Clerk's payment processor Stripe also processes your payment.

The game's 3D assets are stored on our own servers and sent to your browser from there, so your browser never contacts the asset vendor and the vendor does not see you, learn your address, or learn that you played. The 3D library the game runs on is served from this site rather than from a third-party CDN, for the same reason.

[OWNER: confirm this list matches your actual deployment before publishing, and confirm you have a data-processing agreement in place with each named provider, which is required because the service is available to UK and EEA players].

How long we keep things

Every period above except the account currency balance is enforced by the storage layer itself (a Redis expiry) rather than by a cleanup job, so a record that is due to expire does expire on its own. The currency balance is the one record with no expiry, because it is meant to survive between visits; it is removed when you delete your account, which the authentication provider notifies us of so we can delete the durable record we hold against your account identifier.

To be precise about what deleting your account removes, because the honest answer is not “everything, instantly”. When the authentication provider tells us your account is gone, we delete the durable currency balance held against your account identifier, the record of how many connections that account has open, and the play-time counters held against it. What we do not delete is a short-lived session record that may still exist from a session you had open at the time: it holds your display name and colourway, it is keyed by a one-off session identifier rather than by your account, and there is no index from an account back to the sessions it created, so it is left to expire on its own within 24 hours. The same is true of the live state of a world you were playing in when you left, which expires within the hour. We also keep a short operational log entry recording that the deletion happened, which contains your account identifier and expires after three days, because we need to be able to show that we did what you asked.

Your choices

• Play anonymously. No account is required, and an anonymous session identifies a browser, not a person.
• Clear the glade_device cookie and the glade.identity local storage entry from your browser at any time; that removes the identifiers our own server relies on. Your browser may also hold a short-lived glade.reloadedAt session-storage entry (used only to stop a mismatched build from reload-looping; it clears itself when the tab closes) [OWNER: and whatever Clerk, our authentication provider, stores in your browser; confirm what that is and how to clear it, since it loads on every page regardless of whether you sign in].
• Delete your account through your account settings. That removes it at the authentication provider and removes the durable currency balance we hold against your account identifier. Everything else described above is short-lived and expires on its own; see "How long we keep things".
• Ask us what we hold about you, ask for it to be corrected, or ask for it to be deleted, at [OWNER: contact email address].

If you are in the UK or the EEA

The game is available in the UK and the EEA, and data protection law there gives you rights over your personal data: to ask for a copy of it, to have it corrected, to have it erased, to receive it in a portable form, to object to or restrict how it is used, and to complain to your national supervisory authority. To use any of them, write to us at the address in "Who runs Roamadic" above and say what you want; we will deal with it directly rather than through a form.

Being straight with you about the current state: this is a small operation and this section is deliberately short. It does not set out a purpose-by-purpose lawful basis table. What the service actually stores, why, and for how long is described in full in the sections above, and that description is kept accurate to the software. If you want to know the basis we rely on for a particular use, ask and we will tell you.

Children

You must be at least 13 to play. Where you are under the age of majority where you live, a parent or guardian has to agree to the Terms of Service on your behalf, and that includes creating an account or buying a subscription. We do not knowingly collect data from anyone under 13. If you believe a child under 13 has played and left data with us, write to us at the address above and we will delete it.

Changes to this policy

If what the game stores changes, this page changes with it and the date at the top is updated. [OWNER: decide whether material changes will be announced to signed-in players and how].