← Back to the museum

Privacy policy

Last updated 20 September 2026

In short: there are no accounts, ads, cookies or third-party trackers. We count aggregate visits by country, browser family, desktop/mobile and primary browser language without identifying a visitor. With permission, a random ID also enables play statistics. Leaderboard posts are always optional.

Who we are

The Endless Museum is an independent personal project run by Edward Bonnett. Questions or requests about this policy: [email protected].

Data stored on your device

The game keeps its memory in browser storage on your device - settings, the halls you have visited, your travel journal and atlas, unlocked music, video, model and architecture discoveries, achievements, best times, cached museum content, your statistics choice, your display name if you choose one, and a cryptographic keypair used to sign leaderboard entries. If you permit enhanced play statistics, it also stores a random ID. Clearing this site's data removes all of it.

Basic visit counts

We count homepage arrivals and loaded game visits separately. Loaded visits are counted by country, broad browser family, desktop/mobile and primary browser language (the first language your browser asks for, reduced to its base code such as "en" or "de") to understand basic compatibility and reach. We also count referring website domains, traffic sources and channels, and campaign labels supplied in links (source, medium, campaign, post/content, term, campaign ID, platform and referral code). Campaign/post totals retain their source and medium. Recognised click parameters identify a platform only; their unique IDs are discarded. Full referring URLs, search engine queries and article routes are not collected. These aggregate counts contain no visitor ID, browser version or route. We also count how often each museum room (a Wikipedia article title) is entered at the start of a visit and walked into through a doorway, and the total time spent in it while the page is visible, as daily totals per title. Those room totals are sent in occasional batches that carry no visitor ID, order, timestamp or path, so they cannot be joined back into a route. To improve the game we also keep anonymous daily tallies of play events: doorways that failed to open (and in which room), how long it took to reach a first doorway, runs started, finished or abandoned by mode (and the room they were abandoned in), use of the docent, door scan, reader and gallery wings, media played, a once-per-visit frame-rate sample by device class and quality setting, load time, and whether this statistics choice was shown. These are counts per day only, with no visitor ID, order or path. When a visit ends we also store one anonymous summary of it: the room it started in, the room it ended in, how many different rooms were seen, how long the visit lasted and the hour of day it ended, and whether the visit saw this statistics choice. A random code held only in the page's memory lets a later update of the same visit replace its earlier snapshot; it is not stored in your browser and does not identify you across visits. The summary carries no visitor ID or path, and is not linked to any other record. The country code, browser category, device class and base language are added directly to separate daily totals, and to hour-bucketed counts of how many visits shared the same coarse country, device, browser family, language and traffic-label combination so we can compare channels; no raw IP address, user-agent, language header or event-level record is kept, and these counts contain no visitor ID. Each anonymous visit summary and the anonymous engagement totals (such as how many runs reached a first doorway) are also counted once per coarse device class, country code and base language so we can compare, for example, phones with desktops or one country with another. These per-segment totals are day-level counts with no visitor ID, order or route.

The existing fixed campaign-channel totals remain available for comparison. With enhanced statistics enabled, run starts and finishes are also totalled by that channel. Referral and campaign labels last only for the current page visit.

Returning-player statistics

A random ID permits us to count new, returning and daily-active players, active session time, run starts and finishes (including mode and difficulty), and daily-challenge participation. Active session time counts only while the museum page is visible; time spent in a hidden or background tab is excluded. Our server hashes the ID before storing it. Duration reports are immediately added to a daily total and are not retained as event-level or per-player records. Opting in also permits short, URL-stripped crash messages. Graphics failures may include resource counts, rendering resolution, quality setting, browser family, build identifier and recovery timing, plus up to four recent resource samples. A random per-incident code pairs a failure with its recovery; it does not identify a player across incidents. These technical reports contain no article titles, routes or stored player ID, are limited to 200 per day, and expire after 30 days. Enhanced statistics also include short doorway diagnostics: the first 20 doorway approaches in a run, their source and destination article titles, their order and relative times, time waiting for loading or preparation, and whether the visitor crossed, walked away, paused, hid the tab or ended the run. Reports include browser family, device class and graphics quality. A random code exists only in page memory to update a report; no multiplayer name, position, IP address or stored player ID is saved with it. The private dashboard shows when a report arrived. Reports are capped at 200 per day and deleted after 30 days. A missing final update does not prove that a visitor quit. This is pseudonymous rather than personally identifying, and is never used for profiling. The hashed device record expires after 400 days without activity. Anonymous daily aggregate totals may be retained indefinitely.

Whether we ask first depends on where you are connecting from. Visitors in the European Economic Area, the United Kingdom, Switzerland, Brazil and Canada (and anyone whose location we cannot determine) are asked before the ID is created, and nothing is stored until you choose. Elsewhere these statistics are enabled by default on your first visit on the basis of our legitimate interest in understanding how the museum is used, and no ID exists until that first visit is counted. In every region you can change the setting at any time in Settings → Accessibility → "Enhanced play statistics". Turning it off deletes the browser ID. Your region is judged from the country your connection appears to come from, so a VPN may place you in a different group.

Shared lobby and private parties

By default, the museum joins a shared lobby when multiplayer is available. Other visitors who can see your room can see an automatically assigned anonymous visitor name, the room you are in, and your live in-game position. Shared presence connects automatically during free roam and races. Racers see others doing the same course in a separate race group; private parties are temporarily unavailable. This multiplayer information is kept temporarily in server memory to run the session; it is not saved as a multiplayer history. Disconnected sessions are held for up to 30 seconds for reconnection.

Leaderboards

If you post a time to a race leaderboard, we store your chosen display name, your time, the replay of that run (the rooms you passed through and your movement, used to verify the time), and the anonymous public key that signed it. Leaderboard entries are public by nature. To have an entry removed, email [email protected] with the display name and course.

Server logs

Like almost every web service, our server briefly processes IP addresses to deliver pages and to protect against abuse. IP addresses are not stored with play statistics.

Services your browser talks to directly

The museum is built live from public sources. As with any website, each service your browser fetches from sees your IP address and the resource requested:

These requests reveal your IP address and the requested resource, but we do not use them for advertising or cross-site tracking.

What we never do

Your rights

Because nearly all data lives in your own browser, you can view or erase it yourself at any time by clearing this site's data. For anything held on our server - a leaderboard entry, or the anonymous aggregates - email [email protected] and we will help, including erasure where we can still connect the data to you. You may ask for access, correction, deletion, restriction or a copy, or object to processing. You may also complain to the UK Information Commissioner or your local data-protection authority.

Why we process data

Aggregate visit totals and security measures are used for our legitimate interests in improving, checking compatibility and protecting the service. Enhanced play statistics rely on your consent where the law requires it, and on the same legitimate interests elsewhere, with an opt-out always available. Leaderboard data is processed only when you choose to submit it.

Changes

If this policy changes, the new version will appear at this address with an updated date.