Privacy Policy

Last updated 26 July 2026

N30NREC is a free, open source, fan-run game server. It is not a business, it sells nothing, and it has no interest in your data beyond making the game work. This page explains exactly what we store, why we store it, and how to make us delete it.

Who runs this

N30NREC is maintained by a volunteer community, and its source code is public at github.com/djdevin/recflare. This policy covers the N30NREC game servers and this website. It is a fan project, not affiliated with, endorsed by, or connected to Rec Room Inc.

Because the server code is open source, anyone can read exactly how the data described below is handled, and anyone can run their own separate copy of N30NREC. This policy applies only to the servers we operate. If you play on someone else's instance, their operator is responsible for your data, not us.

What we collect

Almost all of it is data you create by playing. We do not buy data about you from anyone, and we do not combine what's here with data from other services.

Your account

• Your username, display name, profile picture, pronoun and identity settings, bio, and the date the account was created.
• An email address and phone number only if you choose to add them. Neither is required to play, and neither is used for marketing.

How you sign in

You can sign in with an account from the platform you play on, or with a password. Whichever you use, we store the minimum needed to recognise you next time.

• Steam. Your SteamID64, so the account can be matched to the right player. Steam signs the login ticket the game sends us, and we check that signature on our own servers — nothing about you is sent to Steam to do it.
• Meta. The user ID Meta issues for you for this app, and the display name attached to it. This is an app-scoped ID: it identifies you within N30NREC and is not your Meta account identity anywhere else. To confirm a sign-in is genuine, and that the account is entitled to the app, we send the token your headset gives us to Meta for verification — so Meta learns that a sign-in to N30NREC happened. We don't receive your Meta email address, friends list or profile beyond the ID and display name, and we don't ask Meta for them.
• A password on this website. Stored only as a salted PBKDF2 hash. We never store the password itself and cannot read it.

Linking a platform account is how you log in — we don't use it to look you up on that platform, post anything there, or match you to advertising.

Device and technical data

• The time of your most recent sign-in.
• A device identifier the game client generates for each installation, and the kind of device it is — a PC or a headset, for example.
• The IP address the account was created from, and the IP address of your most recent sign-in.
• Session tokens. Refresh tokens are stored only as a one-way hash and are single-use.
• Ordinary server request logs, held by our hosting provider, which include IP addresses, timestamps and the requests made.

What you make and do in game

• Photos you take in game, and their details: who took them, the room they were taken in, and any players tagged.
• Rooms and subrooms you create, inventions you build, and clubs you own or join.
• Chat messages you send and the conversations they belong to, so they can be delivered and read later.
• Your relationships with other players — friends, invites and blocks — and your interactions with rooms, such as favourites and cheers.
• Your in-game economy: token balance, inventory, outfits and gifts received.
• Your presence — which room instance you are currently in — so friends can find you and join. Presence records expire automatically on their own.
• Your player settings and preferences.

Why we use it

• To run the game. Nearly everything above exists so the world can be reassembled the next time you log in — your avatar, your rooms, your inventory, your photos, your conversations.
• To sign you in. Your platform identity, password hash and session tokens are what prove an account is yours and stop anyone else using it.
• To let players find each other. Presence, friend lists and public feeds — including the photo slideshow on this website's front page, which shows public in-game photos along with the username of the player who took each one.
• To keep the server usable. IP addresses, device identifiers and logs are used to investigate abuse, ban evasion and bugs, and to limit how many accounts can be created from one place. This is the only reason we keep them.
• To contact you, if you asked us to. An email address you add is used for account recovery and account notices, nothing else.

We do not use your data for advertising or profiling, we do not sell or rent it, and we do not share it for anyone else's marketing. There are no advertising SDKs, analytics SDKs or tracking pixels in the game client or on this website.

Who else sees it

• Other players. Some of what you create is public by design: your username, display name, profile picture, bio, the rooms you publish, photos you make public, and messages you send to the people you send them to.
• Our hosting provider. The servers, databases, file storage and logs run on Cloudflare, which processes this data on our behalf in order to host the service.
• Meta, when you sign in with a Meta account. We send Meta the sign-in token from your headset so it can be verified, which tells Meta that a N30NREC sign-in took place. That exchange is governed by Meta's own privacy policy. Signing in with Steam involves no such call.
• Nobody else — except where we're required by law to disclose something, or where it's necessary to investigate a serious safety issue or abuse of the service.

Our community Discord server and our GitHub repository are run by Discord and GitHub under their own privacy policies. Anything you post there is covered by their terms, not this one.

Cookies

This website sets one cookie, rf_token, which holds your sign-in session. It is strictly necessary to stay signed in, it is not readable by page scripts, and it is cleared when you sign out. We set no advertising or analytics cookies. The game client itself uses no cookies.

How long we keep it

Account and game data is kept for as long as your account exists, so your progress is there when you come back. Presence records expire within minutes. Session tokens expire on their own schedule. Server logs are retained for a short period and then age out automatically. When you ask us to delete your account, we delete it as described below.

Deleting your data

You can ask us to delete your account and the data we hold about you at any time, from anywhere in the world. There is no charge for this, and you don't need to give a reason. Contact us by any of these routes:

• Email — privacy@recflare.net.
• Discord — ask a moderator in our Discord server.
• GitHub — open an issue on the project repo. Don't post personal details in a public issue; your username is enough for us to find you.

Tell us your N30NREC username, and be ready to prove the account is yours — normally by signing in to it, or by sending the request from the email address on the account. We ask because otherwise anyone could delete anyone else's account. We'll confirm when it's done, and we aim to complete every request within 30 days.

Deleting your account removes:

• Your account record — username, display name, profile picture, bio, email, phone number and password hash.
• The link between the account and your Steam or Meta identity, and the stored IP addresses and device identifier.
• Your session and refresh tokens, ending any active sign-in.
• Your photos, rooms, inventions, inventory, settings and presence.

Two honest limits. Messages you sent live in shared conversations, so copies already delivered to other players may remain in their message history, no longer attached to an account. And routine server logs and backups age out on their own timers rather than being edited, so a record of a request may persist for a short period after deletion. Beyond those, if there's ever a reason we can't complete a deletion request, we'll tell you what it is.

You can also change or correct most of your details yourself, either in game or on the account page of this website, and you can ask us for a copy of the data we hold about you using the same contact routes above.

Security

All traffic between the game client, this website and our servers is encrypted in transit. Passwords are stored only as salted hashes and refresh tokens only as one-way hashes, so a copy of our database would not reveal either. Access to the production data is limited to the maintainers who operate the service. No system is perfectly secure, and we won't pretend otherwise — but this is a hobby server, so please don't reuse a password here that you use anywhere important.

Children

N30NREC is not directed at children under 13, and we don't knowingly collect data from them. If you believe a child under 13 has created an account, contact us using any of the routes above and we will delete the account and its data.

Changes to this policy

If this policy changes we'll update the date at the top of this page, and the change will be visible in the project's public commit history. Significant changes will be announced in our Discord server.

Contact

Questions about this policy, or about any data we hold:

• Email — privacy@recflare.net.
• Discord — ask a moderator in our Discord server.
• GitHub — open an issue on the project repo. Don't post personal details in a public issue; your username is enough for us to find you.