PRIVACY NOTE

WHAT WE COLLECT

Room Pass: if you create one, we collect your full name, email, creation date, and the version and time of the rules you accepted. A secure, HTTP-only cookie holds a random profile ID so this browser can retrieve the pass.

Public contributions: a corkboard post contains the finished photo, your Room Pass name, message, and posting time. Room Request Box and Rewind Web submissions may contain the text, title, design choices, and other content you submit. These contributions are meant to be public.

Room Club: if you join, we collect your email and may collect the optional name and city you provide, along with the signup source (which form you used), signup time, and the version and time of the signup language you accepted. We also receive delivery, opening, click, bounce, complaint, and unsubscribe events from our email provider.

Private requests and technical data: the private form stores your email, request type, details, status, and time. Servers may also receive IP address, browser/device information, requested URL, and security or error logs as part of ordinary delivery and abuse prevention.

PUBLIC MEANS PUBLIC

Your Room Pass name—not the email—is displayed with a corkboard post. Other submitted public content can also be copied or reshared by visitors. Do not upload a child's photo, another person's image without permission, contact information, confidential material, or anything sensitive. Deleting the Room Pass from the controls below also deletes corkboard posts and images tied to that browser. For other public submissions, lost cookies, or content someone else copied, use the private removal form.

Mixtape share links contain the selected mix and title in the URL. A recipient email or note entered into your own mail app is handled by that app and is not sent to Rewind Room.

WHY WE USE INFORMATION

We use it to provide the feature you request, recognize your Room Pass, publish and moderate submissions, send Room Club mail you asked for, remember privacy choices, keep the service secure, respond to requests, comply with law, and improve the room with consented analytics. Depending on where you live, the legal basis is your consent, performance of a requested service, legitimate interests in security and service improvement that do not override your rights, or a legal obligation. You can withdraw email or analytics consent at any time without affecting earlier lawful use.

COOKIES, LOCAL STORAGE + ANALYTICS

The secure Room Pass cookie contains only a random profile ID—not your name or email—so this browser can retrieve the profile stored on Cloudflare. The site also uses browser storage on your own device for privacy choices, local game and feature settings, notes, downloads, Paint images, wallpaper, unpublished homepage drafts, and a random, non-account ID for the “buddies in the room” counter. Browser-only drafts, images, and preferences stay on that device unless a feature clearly asks you to publish them. The presence ID remains until site data is cleared; its server-side check-in expires after roughly 35 seconds of inactivity.

Product analytics and Microsoft Clarity are off unless you select “OK, HELP OUT.” If you consent, the browser creates random visitor and session IDs and sends events such as page views, feature names, and time spent. Clarity may process page rendering, clicks, scrolling, device details, and session replay. Advertising storage remains denied. Declining does not limit the room, and the Clarity script is not loaded. You can change the choice at any time in the controls below. Learn more in the Microsoft Privacy Statement.

WHERE SERVER-SIDE DATA LIVES + WHO RECEIVES IT

The live service does not use a production database hosted on the operator's personal computer. Cloudflare hosts the site and its production database: Room Pass, signup, consent, private-request, public-contribution, and approved product-analytics records are stored in Cloudflare D1; finished corkboard photos that you choose to publish are stored in Cloudflare R2 object storage. Registration records are available to the operator only through a protected owner dashboard. Cloudflare states that D1 and R2 data are encrypted at rest with AES-256 and that transfers to those services are protected with TLS. See Cloudflare's D1 and R2 security documentation.

Brevo separately stores and processes Room Club contact and delivery information so it can manage and send the emails. A new registration may trigger a private notification to the operator through Brevo, but that notification does not include the visitor's name or email; the details remain in the protected dashboard. Microsoft receives analytics information only after analytics consent. Cloudflare, Brevo, and Microsoft act as service providers for the relevant functions; using them does not remove Rewind Room's responsibility for the processing. Authorized operator access remains possible where needed to administer the service, moderate posts, secure the room, or answer a privacy request.

Media you choose to open may come from providers such as YouTube, Internet Archive, radio streams, or game sites, which process requests under their own notices. We may also disclose information to professional advisers, authorities, or a successor when reasonably necessary and lawful. We do not sell personal information, and we do not use it for cross-context behavioral advertising.

WHERE + HOW LONG

Providers may process information in countries other than yours under their own published transfer terms and safeguards. Applicable law may provide additional protections for an international transfer.

Server-side presence check-ins expire after about 35 seconds. Room Passes and corkboard posts remain until you delete them or we remove them. Room Requests and Rewind Web posts remain public until Rewind Room removes them, including after a private removal request is approved. Room Club subscriber and welcome-log data is removed on unsubscribe; a minimal suppression record remains to honor the opt-out. Consent records, product events, email delivery events, private requests, moderation records, and ordinary security logs currently remain until they are no longer needed for operations, a dispute, security, or a legal duty. Provider backups may take additional time to cycle out.

YOUR CHOICES + RIGHTS

You may ask to access, correct, delete, restrict, or receive a copy of personal information; object to certain uses; withdraw consent; or complain to your local data-protection authority. Rights and exceptions vary by location, and we may verify a request before acting. Unsubscribe from Room Club through any email or the unsubscribe page. If the mailing provider does not confirm removal, the page tells you to retry while the local suppression request remains recorded.

Browser “Do Not Track” signals are not standardized. We honor Global Privacy Control where legally required. Because we do not currently sell or share personal information for cross-context behavioral advertising, the signal does not change current processing.

CHILDREN, SECURITY + CHANGES

The room is intended for adults 18 and older and is not directed to children. Do not submit information if you are under 18. If we learn that anyone under 18 supplied a submission or personal information, we will remove it, including the additional steps required for a child under 13. We use reasonable administrative and technical safeguards, but no internet service can promise absolute security.

We will update the date above when this notice changes and provide additional notice before a material change when required. A change does not retroactively create consent for a new purpose.

CONTACT, REMOVAL + REPORTS

Rewind Room is the service and data controller described in this notice. Use the private form below to contact the operator about privacy, safety, access, deletion, correction, copyright, or content removal. Do not put sensitive documents in the first message.