Current service information

Privacy in plain words

Museum accounts and museum-news preferences are active. Automatic news emails are not configured. Reading the public library does not require an email address.

Museum accounts and saved journeys

Registration stores a username, a cryptographic password hash and the profile creation date. We store your chosen display name, preferred language, self-declared age band (not your date of birth), and whether you have read the book or played the game. Readable passwords are not retained. For minors, the profile form requests a parent or guardian email, kept private and never sent to characters or AI providers. Contact details do not establish guardianship or permission: this pilot sends no verification emails and keeps AI chat blocked for minors. Pending contacts expire 30 days after the last profile save and are deleted on the next profile access; there is not yet an independent scheduled purge. Guardian verification, the rights-request contact channel and legal review must be completed before this flow is opened to minors in production. The service records which museums and records you open, with dates, to resume visits and suggest connected exhibits. Opening a record does not prove it has been read or understood. The journey is private to the account.

Comments and feedback

Comments are stored on the server with your chosen game name, language, page, message and date. They require an account and become public only after editorial review. Feedback can be sent without an account and requires a contact email so we can reply. The email is stored separately from the message and can only be viewed by administrators; it is not published, sent to characters or used for marketing. The feedback message remains private to editors. If you are under 18, ask a parent or guardian to send it. Public comments do not require this additional email. Page query parameters are not stored. Do not include passwords or sensitive information. Editors can remove published comments.

Sessions and security

A necessary session cookie keeps you signed in for up to seven days. It is HttpOnly and uses Secure on the public website. The server stores a hash of its token, not the raw cookie. Hashed request identifiers and counters help limit repeated sign-in attempts.

Your controls

Sign out to close the current session. You can delete your visit history from My journey; this keeps the account and username. Deleting the whole account and password recovery by email do not have self-service controls yet. Keep your credentials in a password manager.

Other parts of the website

The game alpha saves progress in your browser. Community demo posts and votes are local to your device, not public posts. Museum-news preferences can be saved in your account; school-information submissions remain inactive. It does not collect payment details or activate Patron subscriptions. See the plan's current status.

Administration and metrics

Authorised administrators can manage profiles, suspend access, close sessions and grant manual Patron access. These actions and their reasons are logged. Internal products and draft orders are not sales or payments. Internal metrics and Umami are active. Internal metrics count page views and clicks to Amazon; Umami collects views grouped by section. These traffic collectors do not use analytics cookies or store names, account identifiers or URL parameters. Visitors’ IP addresses and browser details are not sent to Umami. Both respect DNT and GPC signals and exclude private pages. Activity counts do not represent unique visitors. Not using analytics cookies does not remove data protection obligations.

Private showcases and group visits

Your showcase stores selected exhibits, their order and your notes. Only your account can read it. Remove items or clear notes yourself; resetting visit history does not erase the showcase. Do not enter sensitive information.

Group visits store the host, museum, participants, teams, questions and answers. Other members see generated aliases, never participant emails or account names. Do not put children’s names or personal information in questions. Educational organisers may self-declare their affiliation; this is not institutional verification. Invitations expire when the host closes the activity or its duration ends (at most two hours). Expiry blocks access; it does not automatically erase the records. A final retention policy remains to be defined.

An invitation code is held temporarily in the tab during sign-in, removed on joining or discarded after two hours. Showcases and groups are excluded from analytics collectors. Audio uses browser speech synthesis, without microphone access or recording; the voice service depends on the device.

Character conversations and external AI

Do not send personal information about yourself or others: full names, email addresses, phone numbers, addresses, passwords, payment details or health information. Do not include confidential information. Answers are generated through OpenRouter and an AI provider, not entirely on our own server.

The default free NVIDIA Nemotron 3 Ultra model logs conversations for security and to improve NVIDIA products and services. Explicit acceptance is required before sending messages. Your question and documentary context are sent; the Prehistory chat includes recent messages from that same conversation. We do not add your profile name or nickname to this free model. You can decline and continue visiting the museum without this chat.

Other models retain provider no-collection and zero-retention routing filters. Provider errors never trigger a silent model change or relaxation of these conditions. Tracekeepers retains your account history for 30 days; you can delete it in the chat. This does not erase external provider logs or change their retention periods. Acceptance does not guarantee detecting or removing all personal data you type. AI conversations for minors remain blocked in this pilot pending verified guardian authorisation.

NVIDIA Nemotron · OpenRouter · NVIDIA Privacy · OpenRouter Privacy

Museum ratings and news preferences

If you have an account, we store your exhibit preferences and visit ratings with that account. They are private; the administration dashboard shows aggregate counts and averages, not individual ratings.

Adults can choose to subscribe to news from a particular museum using their own private email address. We store the museum, language, consent version and date, and the interests they select. A parent or guardian email from the profile is never added automatically. You can cancel each subscription from My account: news and ratings; cancelling removes that subscription’s email without deleting the account.

Interest in a book or comic is a separate preference: it is not an order, a payment commitment or permission to send email by itself. Automatic museum-news emails are not currently configured.

Free museum access · Project status