Privacy policy

Last updated 11 September 2026

Who we are

The Endless Museum is an independent personal project run by Edward Bonnett. Questions or requests about this policy: [email protected].

Data stored on your device

The game keeps its memory in browser storage on your device - settings, the halls you have visited, your travel journal and atlas, unlocked music, video, model and architecture discoveries, achievements, best times, cached museum content, your statistics choice, your display name if you choose one, and a cryptographic keypair used to sign leaderboard entries. If you permit enhanced play statistics, it also stores a random ID. Clearing this site's data removes all of it.

Basic visit counts

We count homepage arrivals and loaded game visits separately. Loaded visits are counted by country, broad browser family and desktop/mobile to understand basic compatibility and reach. We also count referring website domains, traffic sources and channels, and campaign labels supplied in links (source, medium, campaign, post/content, term, campaign ID, platform and referral code). Campaign/post totals retain their source and medium. Recognised click parameters identify a platform only; their unique IDs are discarded. Full referring URLs, search engine queries and article routes are not collected. These aggregate counts contain no visitor ID, browser version or route. We also count how often each museum room (a Wikipedia article title) is entered at the start of a visit and walked into through a doorway, as daily totals per title. Those room totals are sent in occasional batches that carry no visitor ID, order, timestamp or path, so they cannot be joined back into a route. The country code and browser category are added directly to separate daily totals, and to hour-bucketed counts of how many visits shared the same coarse country, device, browser family and traffic-label combination so we can compare channels; no raw IP address, user-agent or event-level record is kept, and these counts contain no visitor ID.

The existing fixed campaign-channel totals remain available for comparison. With enhanced statistics enabled, run starts and finishes are also totalled by that channel. Referral and campaign labels last only for the current page visit.

Returning-player statistics

If you agree, a random ID permits us to count new, returning and daily-active players, active session time, run starts and finishes (including mode and difficulty), and daily-challenge participation. Active session time counts only while the museum page is visible; time spent in a hidden or background tab is excluded. Our server hashes the ID before storing it. Duration reports are immediately added to a daily total and are not retained as event-level or per-player records. Opting in also permits short, URL-stripped crash messages. Graphics failures may include resource counts, rendering resolution, quality setting, browser family, build identifier and recovery timing, plus up to four recent resource samples. A random per-incident code pairs a failure with its recovery; it does not identify a player across incidents. These technical reports contain no article titles, routes or stored player ID, are limited to 200 per day, and expire after 30 days. This is pseudonymous rather than personally identifying, and is never used for profiling. The hashed device record expires after 400 days without activity. Anonymous daily aggregate totals may be retained indefinitely.

You can change your choice in Settings → Accessibility → "Enhanced play statistics". Turning it off deletes the browser ID.

Leaderboards

If you post a time to a race leaderboard, we store your chosen display name, your time, the replay of that run (the rooms you passed through and your movement, used to verify the time), and the anonymous public key that signed it. Leaderboard entries are public by nature. To have an entry removed, email [email protected] with the display name and course.

Server logs

Like almost every web service, our server briefly processes IP addresses to deliver pages and to protect against abuse. IP addresses are not stored with play statistics.

Services your browser talks to directly

The museum is built live from public sources. As with any website, each service your browser fetches from sees your IP address and the resource requested:

• Wikimedia - article text, images and media (the articles requested are the rooms you visit).
• Open-Meteo - live weather for the place an article describes. Your own location is never requested or used.
• CARTO, OpenFreeMap and AWS Open Data - map and terrain tiles for geographic exhibits.
• Google Fonts - interface typefaces.

These requests reveal your IP address and the requested resource, but we do not use them for advertising or cross-site tracking.

What we never do

• No advertising, and no advertising or analytics networks.
• No sale of personal data.
• No profiling, and no tracking across other sites.
• No collection of precise real-world location; basic counts use only a country code.

Your rights

Because nearly all data lives in your own browser, you can view or erase it yourself at any time by clearing this site's data. For anything held on our server - a leaderboard entry, or the anonymous aggregates - email [email protected] and we will help, including erasure where we can still connect the data to you. You may ask for access, correction, deletion, restriction or a copy, or object to processing. You may also complain to the UK Information Commissioner or your local data-protection authority.

Why we process data

Aggregate visit totals and security measures are used for our legitimate interests in improving, checking compatibility and protecting the service. Enhanced play statistics rely on your consent. Leaderboard data is processed only when you choose to submit it.

Changes

If this policy changes, the new version will appear at this address with an updated date.