Privacy Policy

1. Summary

• We collect information you provide, information created through gameplay, technical and usage information, and information received when you connect or use third-party content.
• Some data stays only in your browser or device. Other data is sent to Local Robot or a service provider so that we can operate accounts, multiplayer features, cloud saves, music recognition, maps, artificial-intelligence features, forms, purchases, support, and security.
• Some optional features request precise location, microphone, camera, screen, or system-audio permission. The feature-specific details below explain whether the resulting content is uploaded or processed locally.
• Names, profiles, artwork, reviews, scores, houses, activity, and other contributions you choose to make public or multiplayer-visible may be seen by other people.
• We use Meta advertising tools. Depending on their configuration, they may support campaign measurement, audience building, ad optimization, and retargeting. This can constitute targeted advertising or “sharing” under applicable privacy laws. We do not sell personal data for money or use it to make automated decisions that have legal or similarly significant effects.
• You can use our contact form to ask questions or submit a privacy request.

This summary is an overview. The rest of this Policy provides important details.

2. Information We Collect

In this Policy, “personal data” means information that identifies, relates to, describes, or could reasonably be linked with a person or household. It can include direct identifiers and pseudonymous identifiers such as account, cookie, device, session, client, and hashed network identifiers.

Account, identity, age, and profile information

When you register or manage an account, we may collect:

• first and last name, email address, username, display name, and account identifiers;
• date of birth, which we use to enforce the 18+ account requirement and may also use for birthday, zodiac, horoscope, or similar game features;
• password and authentication information, activation or reset tokens, login records, and account status;
• profile and character choices, such as flower, robot, mascot, avatar, house, body, heart, and color selections; and
• preferences, consent choices, and communications settings.

Passwords are processed to create and authenticate your account and are treated as security-sensitive information. You are responsible for using a unique password and keeping it confidential. Do not send us your password through a contact form or support message.

Gameplay, multiplayer, and service information

When you play or use a Service, we may collect or create:

• player, browser-client, session, and game identifiers;
• game state, saves, choices, actions, timestamps, current room or area, in-game position, presence, emotes, match or session activity, and interactions with other players or non-player characters;
• scores, initials, leaderboards, achievements, missions, passport events, rewards, inventory, virtual currency, transaction history, items, abilities, progress, and arcade or expedition results;
• houses, interiors, layouts, decorations, colors, gardens, plants, pets or tanks, virtual mail and deliveries, social connections, likes, and relationship state;
• video selections and playback state, track identifiers, tempo submissions, music-recognition results, and other media-related game state;
• feature settings, accessibility choices, sound preferences, onboarding status, and other saved preferences; and
• errors, render status, diagnostic events, rate-limit events, suspected abuse, and records used to secure or troubleshoot the Services.

Some of this information is associated with your account. Guest games may instead associate it with a cookie, browser-client identifier, email address, submitted initials, network identifier, or temporary session.

Content, creations, uploads, and public contributions

We collect content you submit or create through the Services, which may include:

• pixel art, titles, layouts, reviews, ratings, likes, display names, profile content, game initials, and other contributions;
• BloomBeat project titles, lyrics, note and timing data, project files, backing audio files, original filenames, rendered audio, previews, and render diagnostics;
• forms, survey responses, messages, documents, images, audio, and other files you upload;
• D&D campaign, party, character, player-name, narrative, custom-action, and choice data; and
• text, URLs, contact-card information, Wi-Fi network information, or other values you choose to enter into tools such as our QR generator or web crawler.

Do not include confidential, sensitive, or unnecessary personal information in public content, game names, QR codes, crawl targets, AI prompts, artwork, lyrics, reviews, or uploads. Only submit content that you have the right to use and disclose.

Location information

Location-based features may request precise latitude and longitude, location accuracy, timestamps, distance from a venue or game target, route endpoints, current route state, check-in or scan location, and a derived zone or eligibility result. Examples include check-ins and scans, location-assisted music games, and Castle Control gameplay. Some features may request continuing location updates while the feature remains active.

Precise location is collected only after a browser or device permission request or another clear affirmative action. You can refuse or revoke location permission in your browser or device settings, but the affected feature may not work. Revoking permission stops future device access; it does not automatically delete location already processed or stored. See Your Privacy Rights and Choices to request deletion.

We may also infer an approximate area from an IP address for security, localization, or diagnostics. Approximate network location is different from GPS-level precise location.

Microphone, audio, camera, screen, and system-audio information

• Music recognition: Alligator vs. Music may record a short ambient-audio sample after you grant microphone permission. The sample can incidentally contain voices or background conversations. It is sent to Local Robot and ACRCloud for song identification. We do not use these samples to identify a speaker or create a voiceprint.
• VAP Camera: after you grant camera permission, the current VAP Camera feature processes the camera frame in your browser and lets you download the resulting image to your device. The feature does not upload the camera image to Local Robot. If you later upload or share the image through another feature, that separate action is covered by the rules for that feature.
• Vinyl Record Bar BPM analysis: an optional, user-initiated analyzer may request screen or tab capture with system audio. It disables the video track and analyzes audio locally in your browser. It does not record or upload raw screen images, video, or audio. It may send derived information such as BPM, confidence, activity, and a track or YouTube identifier to Local Robot.
• BloomBeat: backing tracks and project audio that you intentionally upload are sent to Local Robot and, when rendering is requested, to our rendering service.

You can stop future camera, microphone, screen, or system-audio access through the relevant in-feature control or your browser or operating-system permission settings.

Connected feeds and third-party content

If you connect a Goodreads or Letterboxd feed, select a YouTube video, request music identification, use a map, or use another third-party-powered feature, we may receive, retrieve, display, or store information such as:

• a feed URL, account or profile name contained in that feed, book or movie titles, review text, ratings, shelves, watch dates, likes, images, and links;
• video, track, album, artist, recording, or content identifiers and associated metadata;
• map, route, location, and direction results;
• QR-code image results; and
• AI-generated game responses and music-recognition results.

Information imported from a public feed remains subject to the original provider’s settings and terms. Disconnecting a feed stops future imports and may remove the connected feed record, but copies already displayed, liked, cached, or incorporated into other records may require a separate deletion request.

Purchases and transaction information

If we offer a paid product or service, we or our payment provider may collect your name, email, billing or shipping address, order details, amount, currency, transaction status, and limited payment-method information. A payment provider generally receives and processes the full payment-card or payment-account details needed to complete the transaction. Local Robot receives the information needed to fulfill the purchase, keep business and tax records, prevent fraud, and provide support. The payment provider’s own privacy notice also applies to its processing.

Forms, communications, support, surveys, and mailing lists

We collect the information you provide when you contact us, submit a form, report a problem, respond to a survey, subscribe to a mailing list, request support, or otherwise communicate with us. This may include your name, email address, message, attachments, response history, and communication preferences. Marketing emails include a way to unsubscribe. Unsubscribing from marketing does not prevent necessary account, transaction, security, or service messages.

Device, network, log, analytics, and attribution information

When you visit or use the Services, we and the providers that support them may automatically receive:

• IP address, including an IP address that may be truncated or represented by a hash in our first-party source logs, and IP addresses retained in security, check-in, scan, hosting, or server logs;
• browser, device, and operating-system type and version; user-agent string and hash; language; time zone; screen size; and device capabilities;
• date and time, requested page or endpoint, referring page, landing page, top-level page URL, navigation and interaction events, session duration, links or features used, and error information;
• complete URLs and query parameters, which may include campaign parameters and advertising click identifiers such as UTM values, gclid, or fbclid;
• cookie, visit, session, account, and browser-client identifiers; Do Not Track status; and
• rate-limit, authentication, fraud-prevention, security, and diagnostic information.

These identifiers can be linkable even when they do not directly contain your name. Do not place passwords, access tokens, health information, or other sensitive information in a URL or query string.

Advertising, conversion, and audience information

With consent where required, we use Meta Business Tools, which may include Meta Pixel, Conversions API, and Custom Audiences, to advertise Local Robot services on Facebook, Instagram, and other Meta services. Depending on our configuration and your interaction with the Services, Local Robot and Meta may collect or receive:

• IP address, user-agent and device information, Meta or browser cookies and identifiers, and advertising or campaign identifiers such as fbclid;
• page URL, referring page, date and time, page views, button clicks, and other website interactions;
• registration, lead, purchase, or other conversion events and related transaction or campaign values; and
• contact or customer identifiers, such as an email address or telephone number, which may be normalized or hashed before being used for audience matching. Hashing does not make the information anonymous when Meta can match it to an account.

Not every Meta tool is necessarily active at the same time, and not every category listed above is sent in every configuration.

We use this information to attribute and measure ad performance and understand ad frequency and reach and, where configured, to create or match advertising audiences, exclude existing users from campaigns, retarget people who interacted with Local Robot, optimize delivery, and show ads to people who may be interested in our Services. Meta may combine information received through its Business Tools with activity from Meta services and other businesses to personalize ads, subject to Meta’s Privacy Policy and applicable settings. Meta can receive Business Tools data even if a visitor is not signed into, or does not have, a Meta account.

Information stored on your device

The Services use cookies, local storage, session storage, browser databases, and similar technologies to store login state, session and client identifiers, local saves, D&D campaigns, settings, onboarding progress, sound choices, game preferences, and other feature state. Local-only data generally remains until the Service overwrites it or you clear your browser data. Clearing browser data, using private-browsing mode, changing browser profiles, or changing devices can permanently erase local saves and settings. Deleting server-side account data does not necessarily remove information stored on your own device.

Information from other people and public sources

We may receive information from another user, a connected public feed, a service provider, a payment provider, a public event or content source, a security or fraud-prevention source, or a person who contacts us about you. If you provide personal data about someone else, you must have authority to do so and should give them this Policy when appropriate.

Sensitive personal data

Precise geolocation is treated as sensitive personal data under Rhode Island law and certain other laws. A short ambient-audio sample may incidentally capture a voice, and uploaded content or free-form text could reveal sensitive facts that we did not request. We do not use audio to identify a person biometrically, and we do not ask you to submit racial or ethnic origin, religious beliefs, health information, sexual orientation, citizenship or immigration status, genetic information, government identifiers, or account passwords through gameplay or free-form content. Please do not provide those details unless a specific Service clearly requests them for a stated, lawful reason.

3. How Specific Game Features Use Data

Azalea Island

Azalea Island uses account and game data to provide a persistent world and synchronize multiplayer features. Depending on the features you use, server-side records may include your profile and display choices, house and interior, artwork, inventory, virtual wallet and transactions, missions and passport activity, scores, expeditions, gardens, pets, mail and deliveries, social connections, likes, imported reviews, creative work, progress, and recent multiplayer presence. Other players may see your display name, avatar or colors, house, artwork, public reviews or ratings, likes, leaderboard or game-event information, in-world presence, movement, emotes, media choices, and other content designed to be shared.

BloomBeat

BloomBeat stores projects, project data, lyrics, note and timing data, uploaded backing tracks, renders, previews, and related usage and error information so you can save, edit, and render music. Rendering sends the material needed for the job to our rendering service. Deleting a BloomBeat project is designed to delete its related project rows and files. Deleting a Local Robot user account triggers a BloomBeat-specific deletion process, subject to backup, legal, security, and error-recovery limitations.

Alligator vs. Music

These features may use a short microphone recording and, when requested, precise location to identify music, validate a location-based action, operate the game, prevent abuse, and maintain song, score, activity, or redemption history. Audio is sent through Local Robot to ACRCloud. Local Robot deletes its temporary uploaded copy after the recognition attempt; ACRCloud handles information under its agreement with us and its applicable privacy terms. Recognition results, check-in or scan details, exact location in applicable records, email or profile information, IP address, user-agent information, activity, and game results may remain as described under Retention. A guest feature may store the email used for that feature in a browser cookie for up to 365 days.

Castle Control and maps

Castle Control sends exact location to Local Robot to validate actions and calculate routes. Scout and mission records may store route data and exact current or lost coordinates while the related game state remains active, and those values can also be sent to Mapbox. Claim records may store derived distance or accuracy, and exact scout coordinates are cleared, overwritten, or replaced as game state changes. Ordinary server and security logs may also be created. Mapbox receives normal request information when map resources load.

QR generator

The QR generator sends the complete value you ask it to encode to api.qrserver.com so that service can create the QR image. Depending on what you enter, the value may include a URL, text, contact name, organization, telephone number, email address, Wi-Fi network name, or Wi-Fi password, and it may appear in the request URL. Generated results may be cached briefly to improve performance. Do not use this tool for confidential information, access tokens, private Wi-Fi credentials, or other sensitive data.

Guest games, scores, and multiplayer spaces

Some guest games store three-letter initials and results on a shared leaderboard. Guest multiplayer spaces may keep an opaque client identifier and profile preferences in your browser and briefly send an identifier, mascot or colors, in-game position, emote, and last-seen time to the server to synchronize the space. Live guest presence normally expires quickly, but scores, tempo submissions, security records, and other feature records can last longer.

Public and multiplayer visibility

Information you make public or multiplayer-visible is disclosed to the people who can access that feature. Avoid using a legal name or including contact details or other personal information in a display name, game initials, artwork, review, lyric, house, QR code, or other shared content. Removing an account or contribution may not remove screenshots, copies made by others, de-identified aggregate records, or content that must be retained for safety, dispute, legal, or service-integrity reasons.

4. How We Use Information

We use personal data for the following purposes:

• Provide the Services: create and authenticate accounts; confirm age eligibility; operate websites, forms, games, tools, maps, music recognition, AI responses, uploads, rendering, purchases, and downloads; save progress; and deliver requested content.
• Personalize and synchronize: remember preferences; provide character, birthday, horoscope, media, house, mission, inventory, social, and other game features; and synchronize persistent and multiplayer state.
• Publish or share at your direction: display contributions, profiles, scores, houses, artwork, reviews, likes, events, presence, and other information in public or multiplayer features you choose to use.
• Communicate: respond to questions, provide support, send account or security notices, fulfill requests, and send marketing if you have subscribed or applicable law otherwise permits it.
• Advertise and measure campaigns: attribute visits and conversions, measure reach and performance, and, where configured, create or match audiences, retarget visitors, optimize campaigns, and deliver advertising through Meta and other advertising partners.
• Understand and improve: measure visits and campaign sources, understand feature use, diagnose errors, test and improve performance, develop new features, and conduct internal reporting.
• Protect Local Robot and others: authenticate requests, apply rate limits, prevent cheating, spam, fraud, infringement, misuse, and security incidents, enforce terms, investigate complaints, and maintain service integrity.
• Operate the business: process transactions, maintain records, administer vendors and business relationships, perform accounting and audits, and support a reorganization or business transaction.
• Comply with law: respond to valid legal process, exercise or defend legal claims, fulfill regulatory and tax obligations, and protect rights, safety, and property.
• Use with consent: process precise location, microphone, camera, screen, system audio, marketing preferences, or other information when applicable law requires consent.

Legal bases where European or United Kingdom data-protection law applies

When the GDPR or UK GDPR applies to our processing, our legal bases are:

• Contract: processing needed to provide a Service you requested or take steps at your request before providing it.
• Legitimate interests: operating, securing, supporting, measuring, and improving the Services; preventing abuse; communicating with you; and managing our business, where those interests are not overridden by your rights.
• Consent: processing based on an optional permission or choice, including precise location, device sensors, certain storage technologies, or marketing where consent is required. You may withdraw consent for future processing at any time.
• Legal obligation: processing needed to meet accounting, tax, regulatory, law-enforcement, or other legal duties.
• Legal claims and vital interests: processing needed to establish, exercise, or defend claims or to protect a person’s vital interests where the law permits it.

5. How We Disclose Information

We disclose personal data only as described below, as you direct, or as otherwise permitted or required by law.

Service providers and feature partners

Providers process data to perform services for Local Robot or to provide a feature you choose. Depending on which Services you use, recipients can include:

• website hosting, WordPress, database, storage, backup, content-delivery, security, spam-prevention, form, email, support, analytics, and rendering providers;
• payment processors, shipping or fulfillment providers, and transaction-support providers;
• Meta Platforms, Inc. and its affiliates through Meta Business Tools, which may include Meta Pixel, Conversions API, and Custom Audiences as configured, for campaign measurement, audience matching, ad optimization, and targeted or retargeted advertising on Facebook, Instagram, and related services;
• ACRCloud for music recognition and MusicBrainz for track metadata;
• Mapbox for maps, routes, directions, and location-based game functionality;
• Google/YouTube, including privacy-enhanced YouTube embeds and related metadata services, for video and playback features;
• Goodreads and Letterboxd when you connect, import, link, or display a feed or its content;
• api.qrserver.com for QR-code generation;
• public content and data services used for items such as media, events, weather, game rules, horoscope or tarot content, and images; and
• content-delivery networks and asset providers that deliver fonts, icons, libraries, images, video, or other page resources.

A provider can receive the information needed for its feature as well as ordinary internet-request data such as IP address, browser or device information, timestamp, and referring page. A third-party feature’s own privacy notice may also apply, particularly when you directly connect an account, load an embed, follow a link, or submit information to that provider.

We use WordPress, Gravity Forms, and Advanced Custom Fields to operate website, registration, form, profile, and content functionality. Information submitted through those features is processed in our WordPress environment. The fact that software is installed does not necessarily mean its developer receives your information, but a software or support provider may process information if we authorize access needed to host, secure, troubleshoot, or support the feature.

Other players and the public

We disclose the profile, content, status, and game information designed to be public or multiplayer-visible to other players or visitors. The applicable feature generally indicates when information will be shared. See How Specific Game Features Use Data.

Professional advisers and business administration

We may disclose information to accountants, auditors, attorneys, insurers, banks, and other professional advisers where reasonably necessary for their services, legal compliance, or the establishment, exercise, or defense of claims.

Legal, safety, and security disclosures

We may preserve or disclose information when we reasonably believe it is necessary to comply with law or valid legal process; respond to lawful requests from public authorities; protect the rights, safety, or property of Local Robot, our users, or others; investigate fraud, security issues, infringement, or violations of our terms; or prevent harm.

Business transfers

Information may be disclosed in connection with a financing, audit, merger, acquisition, reorganization, bankruptcy, sale of assets, or similar business transaction. Where required, we will provide notice and require the recipient to handle personal data consistently with applicable law.

At your direction

We disclose information when you ask us to, connect a third-party feature, make content public, interact in a multiplayer space, or otherwise direct the disclosure.

Aggregated or de-identified information

We may use and disclose information that has been aggregated or de-identified so that it cannot reasonably be linked to you. We will not attempt to re-identify data that applicable law requires us to maintain as de-identified.

6. Advertising, Sale, Sharing, and Legally Significant Profiling

Local Robot uses Meta Business Tools and may disclose device, network, cookie, campaign, contact-matching, and website-event information to Meta for campaign measurement and, where configured, audience creation, optimization, and retargeting. Measurement or reporting alone may be excluded from the definition of targeted advertising under some laws. Audience matching, retargeting, and ad selection based on activity over time and across nonaffiliated services can constitute targeted advertising and, under California law, sharing for cross-context behavioral advertising.

As of the effective date of this Policy:

• Local Robot does not sell personal data for money. Because some privacy laws define “sale” more broadly to include certain exchanges for valuable consideration, we treat a Meta or other advertising disclosure as a sale where an applicable law requires that treatment;
• Local Robot may share or process personal data for cross-context behavioral or targeted advertising through Meta as described above;
• Local Robot does not disclose personal data to third parties for their own direct-marketing purposes; and
• Local Robot does not use personal data to profile you in furtherance of decisions that produce legal or similarly significant effects.

You may request to opt out of targeted advertising and any legally defined sale or sharing through our contact form with “Targeted Advertising Opt-Out” at the start of your message. You may also use any functioning cookie-preference control presented on the Services; see our Cookie Policy. An opt-out applies to future covered processing under our control and does not require Meta or another recipient to delete information it lawfully received before the opt-out. Deleting cookies, switching browsers or devices, or using a private-browsing session may require you to renew a browser-specific choice.

7. Cookies, Local Storage, Analytics, and Tracking Choices

We use cookies and similar browser storage for account authentication, security, preferences, local game state, guest identifiers, multiplayer synchronization, remembering a guest email in a feature, visit and campaign-source measurement, and other functionality described in this Policy. For more information, please read our Cookie Policy.

Current first-party visit measurement

Our current first-party entry-source logger can collect landing and referring URLs, complete query parameters, campaign and ad-click values, device and browser attributes, a user or session identifier, and a truncated and hashed representation of the IP address. Its default visit-record retention is approximately 90 days. Its visit cookie lasts approximately 30 minutes, and its linkable session cookie lasts approximately 30 days. These records are pseudonymous, not necessarily anonymous.

Browser controls

You can block or delete cookies and local storage through browser settings. Doing so can sign you out, prevent features from working, and erase local saves, campaigns, preferences, or client identifiers. Device and browser settings also control location, camera, microphone, screen, and system-audio permissions.

Do Not Track and Global Privacy Control

When a browser sends the Do Not Track (DNT: 1) signal, our current first-party entry-source logger is configured not to create its visit record. DNT does not prevent strictly necessary authentication, security, server, or game processing and does not necessarily control Meta or other independent third parties.

Where applicable law requires us to honor a recognized Global Privacy Control (GPC) or similar opt-out preference signal, we treat that signal as a request to opt out of future sale, sharing, or targeted-advertising processing on that browser. You may also use a functioning cookie-preference control presented on the Services or contact us as described above.

Third-party collection over time

Embedded videos, maps, fonts, icons, scripts, images, and other third-party resources may allow their providers to receive IP address, browser information, page or referrer information, identifiers, and interaction data when the resource loads. Depending on the provider and your settings or relationship with it, a third party may be able to recognize your browser over time and across different websites or services. Local Robot does not control a third party’s independent tracking; review that provider’s privacy notice and controls.

8. How Long We Keep Information

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, to provide the requested Service, and for legitimate security, dispute, recordkeeping, and legal needs. Retention depends on the type of data and feature:

• Accounts and persistent game data: generally remain while the account or feature is active and afterward for the period reasonably needed to process deletion, maintain security and service integrity, resolve disputes, comply with law, and complete normal backup cycles. Many Azalea Island records are persistent until the related feature or content is separately deleted or a valid deletion request is completed. Deleting the WordPress user record alone may not delete every custom game record; those records must be separately identified and processed.
• Public and multiplayer contributions: generally remain until you delete them through an available control or we complete a valid deletion request, subject to copies, other users’ records, service integrity, legal exceptions, and de-identification.
• Local browser data: remains until the Service overwrites it or you clear it. Local Robot cannot directly clear data stored only on your device.
• First-party entry-source analytics: visit records are configured for approximately 90 days, with an approximately 30-minute visit cookie and 30-day session cookie.
• Advertising and audience data: advertising events, audience records, campaign reports, and matched identifiers remain according to our advertising-account settings and legitimate campaign, security, recordkeeping, and legal needs. Meta separately retains information under its agreements, settings, and privacy terms.
• Live presence: active guest and multiplayer-presence records typically expire within seconds or minutes, although related game events, scores, security logs, or persistent state may remain longer.
• Selected Azalea Island event records: current technical schedules remove certain nonactive expedition records after about 45 days, mission or passport event records after about 120 days, and arcade results after about 400 days. Other persistent game tables do not all use the same automatic schedule.
• BloomBeat: completed render-job and temporary preview records use short operational schedules, generally ranging from about one hour to one day. Saved projects, backing files, and finished outputs remain until project or account deletion, subject to exceptions.
• Music recognition: Local Robot deletes its temporary uploaded audio copy after the recognition attempt. Recognition results, exact location where applicable, check-in or scan history, activity, email or profile data, IP address, user-agent information, scores, and redemptions may remain until no longer needed or until a valid deletion request is completed. ACRCloud’s handling is governed by its agreement with us and applicable privacy terms. A guest-email cookie may last up to 365 days unless you remove it sooner.
• QR generation: a generated result may be cached for approximately six hours. The external QR provider receives the encoded value under its own retention practices.
• Scores, web-crawl logs, Castle claims, and derived tempo submissions: may remain until they are removed, de-identified, superseded under a feature limit, or no longer reasonably needed. Some leaderboards and feature logs do not currently have a fixed time-based expiration.
• Forms, support, and communications: remain while we handle the request and for a reasonable recordkeeping period afterward.
• Transactions and business records: remain for the periods required by accounting, tax, fraud-prevention, contract, and other applicable laws.
• Security and legal records: remain for as long as reasonably needed to protect the Services, investigate an incident, enforce an agreement, comply with a legal hold, or establish, exercise, or defend legal claims.
• Backups: deleted data may remain temporarily in restricted backups until overwritten through normal cycles, unless law requires longer preservation.

When retention is no longer justified, we delete, securely destroy, or de-identify the information as appropriate. A request to delete a WordPress account may require a separate review of custom game, leaderboard, check-in, scan, location, and activity records. Please use the privacy-request process below so we can identify and address the relevant records.

9. Security and Breach Notices

We use administrative, technical, and physical safeguards designed to protect personal data, taking into account the nature and volume of the information, our size and resources, and the risks of the processing. Measures may include access controls, authentication, transport encryption, logging, backups, minimization, service-provider controls, and procedures for responding to security incidents.

No internet transmission, device, software, or storage system can be guaranteed completely secure. You should use a unique password, protect your account and devices, sign out on shared devices, and tell us promptly if you suspect unauthorized account use.

If a security incident affects personal data, we will investigate and provide notices to affected people, regulators, credit-reporting agencies, or others when and within the time required by applicable law.

10. Your Privacy Rights and Choices

Depending on where you live and subject to applicable exceptions, you may have the right to:

• confirm whether we process your personal data and access it;
• correct inaccurate personal data;
• delete personal data;
• receive a portable copy of personal data you provided or otherwise obtain data portability;
• withdraw consent for future processing;
• opt out of targeted advertising and any processing treated as sale or sharing under applicable law, as well as qualifying automated profiling;
• object to or restrict certain processing where applicable;
• unsubscribe from marketing communications; and
• appeal a denied privacy request where applicable.

How to submit a request

Use our contact form and write “Privacy Request” at the start of your message. Tell us the right you want to exercise, the Local Robot Service involved, your state or country, and the email address, display name, initials, or other identifier associated with the data. To appeal a decision, write “Privacy Appeal” and identify the earlier request and decision.

Do not send a password, complete payment-card number, government identification number, Wi-Fi password, or other sensitive information with your initial request. We may ask for information reasonably necessary to authenticate you and locate the data. If we cannot authenticate a request that requires authentication, we may ask for more information or decline the request as permitted by law.

You may use an authorized agent where applicable. We may request signed permission, proof of the agent’s authority, and direct confirmation from you, except where law provides otherwise. We will not discriminate against you for exercising a privacy right. We may retain a limited record of a request to document compliance and prevent fraud.

Limits and exceptions

Privacy rights are not absolute. We may retain or decline to provide information where permitted or required for security, fraud prevention, another person’s privacy, free expression, legal compliance, tax or transaction records, legal claims, internal uses reasonably aligned with your relationship with us, or another lawful exception. We will explain a denial when required. A deletion request cannot remove data stored only on your device, and removal of public content may not eliminate copies made by other people.

Consent and device permissions

You can withdraw an optional permission through the feature, browser, or device settings and can contact us to withdraw consent where processing depends on consent. Withdrawal does not make earlier lawful processing unlawful. Where Rhode Island law applies to our processing of sensitive data, we will stop future consent-based processing as soon as practicable and no later than 15 days after receiving a valid revocation, except to the extent continued processing is permitted or required by applicable law.

11. Rhode Island Residents

Local Robot LLC is the controller responsible for the processing described in this Policy. Rhode Island’s Data Transparency and Privacy Protection Act provides rights when its applicability requirements are met. To the extent that Act applies to our processing, a Rhode Island resident may:

• confirm whether we process personal data and access that data;
• correct inaccuracies;
• delete personal data provided by or obtained about the resident;
• obtain a portable copy of personal data where technically feasible;
• opt out of targeted advertising, sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects; and
• exercise rights without unlawful discrimination.

As explained above, Local Robot may process personal data for targeted advertising and may disclose it to Meta in a manner treated as sharing or sale under applicable law. Local Robot does not sell personal data for money and does not use personal data for legally significant automated profiling. Where the Act applies, Rhode Island residents may opt out through the methods described above.

We will respond to a valid Rhode Island request without undue delay and, where the Act applies, within 45 days. We may extend that period once by up to 45 additional days when reasonably necessary, and we will explain the extension within the first 45 days. We may authenticate requests where permitted. Rhode Island opt-out requests do not require authentication, although we may deny a request that we reasonably and documentably believe is fraudulent as permitted by law. Responses are free at least once in any 12-month period. We may charge a reasonable fee or decline a request only where permitted, such as for a manifestly unfounded, excessive, or repetitive request.

If we deny a request, you may appeal by using the contact form and writing “Privacy Appeal”. Where the Act applies, we will provide a written appeal decision, including an explanation, within 60 days. If the appeal is denied, you may submit a complaint to the Rhode Island Attorney General’s Office.

Rhode Island treats precise geolocation and certain other information as sensitive data. Where required, we obtain consent before processing sensitive data and provide a way to withdraw it. We use reasonable safeguards appropriate to our size, activities, and the nature of the data, and we provide security-incident notices as required by Rhode Island law.

12. California Residents

The sections above disclose the categories of personal information we collect, the sources, purposes, categories of recipients, retention approach, and whether we sell or share it. To the extent the relevant Services were available and used, those sections also reflect the categories collected during the 12 months preceding this Policy’s effective date. They explain how to review or change account information, submit a request, and understand our response to DNT and GPC signals and third-party collection over time.

If Local Robot is subject to the California Consumer Privacy Act for a particular processing activity, California residents may exercise the access, correction, deletion, portability, and opt-out rights provided by that law through the process in Your Privacy Rights and Choices. Our disclosure of personal information to Meta for cross-context behavioral advertising may constitute “sharing” under California law and, depending on the facts, may fall within California’s broad definition of “sale.” We do not sell personal information for money and do not use or disclose sensitive personal information for purposes that require a right to limit.

California’s “Shine the Light” law concerns disclosures for third parties’ own direct-marketing purposes. Local Robot does not disclose personal information to third parties for their own direct marketing.

Our accounts and interactive games are limited to adults. If you believe content posted by a person under 18 appears in a Local Robot Service, contact us with “Minor Content Removal” at the start of the message and identify the content. Removal may not eliminate copies made by others or information we are legally permitted or required to retain.

13. International Users

Local Robot is based in the United States. We and our providers may process information in the United States and other countries whose privacy laws may differ from those where you live. Such transfers are subject to applicable transfer rules. Where required, we will put an approved transfer mechanism or another lawful basis in place before making a covered transfer.

If the GDPR or UK GDPR applies, you may have rights to access, correction, deletion, restriction, portability, objection, and withdrawal of consent, as well as the right to complain to the data-protection authority for your habitual residence, place of work, or the location of an alleged violation. You can exercise those rights through our contact form. You also have the right to object at any time to processing for direct marketing.

14. Adults Only and Information About Minors

Local Robot account registration and interactive games and tools are intended for people aged 18 and older. A person under 18 may not create an account or use those interactive Services. We do not offer a parental-consent process because the Services are not offered to minors.

Some public pages and guest features can load before a visitor creates an account or passes through the account age check, and they do not all perform a separate age check. They may automatically receive ordinary technical data, and a visitor could submit information despite the age restriction. We do not knowingly seek personal data from anyone under 18. If we learn that a minor provided personal data through a Service, we will take reasonable steps to deactivate any account and delete or de-identify the information, subject to legal, safety, security, and recordkeeping requirements.

If you are under 18, do not use the interactive Services or send us information. If you are a parent or guardian and believe a minor has provided information, use our contact form, write “Minor Privacy” at the start of the message, and identify the relevant Service and information. Do not include unnecessary information about the minor in the initial message.

15. External Links and Third-Party Services

The Services contain links, embeds, imports, and integrations operated by others. Local Robot does not control an independent third party’s privacy, security, content, or terms. This Policy describes the information we send to or receive from those services but does not replace their privacy notices. Review a third party’s terms and privacy information before using its feature or providing data.

16. Changes to This Policy

We may update this Policy to reflect changes in the Services, data practices, providers, or law. We will post the revised Policy and change the “last updated” date above. If a change materially affects how we use previously collected personal data, we will provide additional notice and obtain consent where required by law. We encourage you to review this Policy periodically.

17. Contact Us

Controller:
Local Robot LLC
Providence, Rhode Island, USA

Online contact and privacy-request mechanism:
https://www.localrobot.com/contact/

For a privacy request, write “Privacy Request” at the start of your message. For an appeal, write “Privacy Appeal.” Include enough information for us to identify the relevant account, game, feature, or record, but do not send a password, government identifier, complete payment-card number, Wi-Fi password, or other unnecessary sensitive information.