Current service information
Privacy in plain words
Museum accounts are active. Promotional forms, payments and the email newsletter are not. Reading the public library does not require an email address.
Museum accounts and saved journeys
Registration stores a username, a cryptographic password hash and the profile creation date. We store your chosen display name, preferred language, self-declared age band (not your date of birth), and whether you have read the book or played the game. Readable passwords are not retained. For minors, the profile form requests a parent or guardian email, kept private and never sent to characters or AI providers. Contact details do not establish guardianship or permission: this pilot sends no verification emails and keeps AI chat blocked for minors. Pending contacts expire 30 days after the last profile save and are deleted on the next profile access; there is not yet an independent scheduled purge. Guardian verification, the rights-request contact channel and legal review must be completed before this flow is opened to minors in production. The service records which museums and records you open, with dates, to resume visits and suggest connected exhibits. Opening a record does not prove it has been read or understood. The journey is private to the account.
Comments and feedback
Comments are stored on the server with your chosen game name, language, page, message and date. They require an account and become public only after editorial review. Feedback stays private to editors and can be sent without an account. Page query parameters are not stored. Do not include passwords or sensitive information. Editors can remove published comments.
Sessions and security
A necessary session cookie keeps you signed in for up to seven days. It is HttpOnly and uses Secure on the public website. The server stores a hash of its token, not the raw cookie. Hashed request identifiers and counters help limit repeated sign-in attempts.
Your controls
Sign out to close the current session. You can delete your visit history from My journey; this keeps the account and username. Deleting the whole account and password recovery by email do not have self-service controls yet. Keep your credentials in a password manager.
Other parts of the website
The game alpha saves progress in your browser. Community demo posts and votes are local to your device, not public posts. The website does not currently accept newsletter or school-information submissions. It does not collect payment details or activate Patron subscriptions. See the plan's current status.
Administration and metrics
Authorised administrators can manage profiles, suspend access, close sessions and grant manual Patron access. These actions and their reasons are logged. Internal products and draft orders are not sales or payments. Umami has been prepared but collection remains disabled until configuration and privacy review are complete. The planned collector counts aggregate views by section without analytics cookies, names, account identifiers or URL parameters; it respects DNT and GPC. Not using analytics cookies does not remove data protection obligations.