Privacy Policy

Last updated 18 September 2026

Rec Room Legacy is a free, open source, fan-run game server. It is not a business, it sells nothing, and it has no interest in your data beyond making the game work. This page explains exactly what we store, why we store it, who else ever sees it, and how to make us delete it.

Who runs this

Rec Room Legacy is maintained by a volunteer community. This policy covers the Rec Room Legacy game servers and this website, and applies to every platform the game runs on. It is a fan project, not affiliated with, endorsed by, or connected to Rec Room Inc. or Meta.

Because the server code is open source, anyone can read exactly how the data described below is handled, and anyone can run their own separate copy of Rec Room Legacy. This policy applies only to the servers we operate. If you play on someone else's instance, their operator is responsible for your data, not us.

What the terms mean

Meta's Developer Data Use Policy sorts data into categories, and we are required to explain our handling of each. In plain terms, for this game:

• Developer User Data — everything you give us or create by playing: your account, your rooms and photos, your messages, your inventory. This is the great majority of what follows, and we are the ones who hold it.
• Meta Horizon User Data — what Meta's platform hands us when you sign in on a headset. For us that is one thing: the app-scoped user ID Meta issues for you. We do not request or receive your Meta email address, profile picture, username or friends list.
• Device User Data — sensor data from the headset itself: microphone audio, where your head and hands are, and (on headsets that have them) face and eye tracking. See Data from your headset, which is the short and unusually good part of this policy.
• User Data — Meta's umbrella term for the two categories above together.

What we collect

Almost all of it is data you create by playing. We do not buy data about you from anyone, and we do not combine what's here with data from other services.

Your account

• Your username, display name, profile picture, banner, pronoun and identity settings, bio, and the date the account was created.
• An email address and phone number only if you choose to add them. Neither is required to play, and neither is used for marketing.
• Your date of birth, if you give one, and whether the account is marked as a junior account. See Children.

How you sign in

You can sign in with an account from the platform you play on, or with a password. Whichever you use, we store the minimum needed to recognise you next time.

• Meta. The user ID Meta issues for you for this app. It is app-scoped: it identifies you within Rec Room Legacy and is not your Meta account identity anywhere else. To confirm a sign-in is genuine we send Meta the login token your headset produced, and Meta answers only valid or not valid — so Meta learns that a Rec Room Legacy sign-in happened. We do not receive, request or store your Meta email address, profile picture, username or friends list.
• Steam. Your SteamID64, so the account can be matched to the right player. Steam signs the login ticket the game sends us and we check that signature on our own servers — nothing about you is sent to Steam to do it.
• A password on this website. Stored only as a salted PBKDF2 hash. We never store the password itself and cannot read it.

We never ask for your Meta password, and never will. The password option above is a Rec Room Legacy password, used only on this site. If anything ever asks you for your Meta credentials in order to play Rec Room Legacy, it is not us. Linking a platform account is how you log in — we don't use it to look you up on that platform, post anything there, or match you to advertising.

Sign-in tokens and app secrets are treated as secrets: they are never shared, sold or passed to anyone outside the providers listed under Who else sees it who need them to run the service.

Data from your headset

This is the category people most want a straight answer about, so here it is.

• Your voice. When you talk in game, your microphone audio goes to the multiplayer service that carries it to the other players in the room. It is live, it is not recorded, and no copy of it reaches our servers or our database. There is no voice-to-text: the client has a speech transcription feature and it is switched off on this server.
• Where your head and hands are. Your headset and controller positions are sent through the same multiplayer service so other players see your avatar move. They are used to draw you in the moment and are not stored, logged or analysed.
• Face, eye and camera data — none. The game does not ask for camera access, eye tracking or face tracking, and no such data is sent to us. We could not analyse your expressions or your gaze if we wanted to; we never receive them.

We do not send any headset sensor data to Meta's advertising, analytics or business tools. We do not use any of it to work out who you are, and we do not link it to an advertising profile, because we run no advertising at all.

Device and technical data

• The time of your most recent sign-in, and the game build you last played on.
• A device identifier the game client generates for each installation, and the kind of device it is — a PC or a headset, for example.
• The IP address the account was created from, and the IP address of your most recent sign-in.
• Session tokens. Refresh tokens are stored only as a one-way hash and are single-use.
• Ordinary server request logs, held by our hosting provider, which include IP addresses, timestamps and the requests made.

What you make and do in game

• Photos you take in game, and their details: who took them, the room they were taken in, and any players tagged.
• Rooms and subrooms you create — including their saved contents and version history — inventions you build, and clubs you own or join.
• Chat messages you send and the conversations they belong to, so they can be delivered and read later.
• Your relationships with other players — friends, invites and blocks — and your interactions with rooms, such as favourites, comments and cheers.
• Your in-game economy: token balance, inventory, outfits, equipment and gifts received.
• Your presence — which room instance you are currently in — so friends can find you and join. Presence records expire automatically within minutes.
• Your player settings, preferences and progression, and your scores on in-game leaderboards.

Safety, reports and diagnostics

• Moderation records. If you report another player, or are reported, we keep the report, who made it, and any moderator action taken — warnings, timeouts and bans — so that moderation is consistent and appealable.
• Bug reports. If you submit one from in game we store what you wrote, your account, the game build, and any attachment the client sends with it, such as a screenshot or a log file.
• Crash and error logs. The client can send diagnostic logs when something goes wrong. These are stored with your account ID and the game build so a fault can be traced to a version.

Telemetry we throw away

The game client batches up analytics events and posts them to the server, because that is what it was built to do. There is no analytics backend behind this server: those requests are acknowledged and the contents are discarded, not stored and not forwarded. The same is true of the client's AI features — no request from this server reaches an AI model, and nothing you say or type is sent to one.

Why we use it

Everything we do with your data falls into one of three purposes, and we do not use it for anything outside them:

• To run and maintain the game. Nearly everything above exists so the world can be reassembled the next time you log in — your avatar, your rooms, your inventory, your photos, your conversations — and so that players can find each other. This includes the public feeds, such as the photo slideshow on this website's front page, which shows public in-game photos along with the username of the player who took each one.
• To keep it working and keep it safe. IP addresses, device identifiers, logs, bug reports and moderation records are used to investigate abuse, ban evasion, cheating and bugs, and to limit how many accounts can be created from one place. Aggregate counts — how many people are online, how a build performs — are only ever looked at in the aggregate, with no attempt to single anyone out.
• To comply with the law. Where we are legally required to retain or disclose something.

An email address you add is used for account recovery and account notices, and nothing else. We will not email you marketing, because we have nothing to market.

What we never do

Some of these are our own choices and some are obligations we are held to as a developer on Meta's platform. Either way they are commitments, not aspirations:

• We never sell, rent, license or lend your data, and we never let anyone else do so. This is not something a disclosure could ever make acceptable, and it is not on the table.
• We never use your data for advertising or marketing, ours or anyone else's. There are no advertising SDKs, analytics SDKs or tracking pixels in the game client or on this website.
• We never profile or discriminate on the basis of race, ethnicity, colour, national origin, religion, age, sex, sexual orientation, gender identity, family status, disability, or medical or genetic condition.
• We never use your data for surveillance — that is, gathering information about people, groups, places or events for law enforcement, national security or intelligence purposes.
• We never try to work out who you really are. No facial recognition, no gait or body identification, no AI applied to your data to attach a real-world identity to an account.
• We never re-identify, de-anonymise, unscramble, decrypt or reverse engineer data that has been aggregated or anonymised, and we never combine your data with outside data sources to learn more about you.
• We never scrape. No bots, crawlers or scrapers are used to collect data about players.
• We never touch the Advertising ID. The game does not read it, store it, or use it for anything — see below.

Advertising ID

Your headset provides a resettable Advertising ID for apps that show advertising. Rec Room Legacy does not collect, store, transmit or use it in any form. We show no ads, so there is nothing for it to do here, and we never use any other permanent device identifier as a substitute for it.

Who else sees it

• Other players. Some of what you create is public by design: your username, display name, profile picture, bio, the rooms you publish, photos you make public, and messages you send to the people you send them to.
• Cloudflare — our hosting provider. The servers, databases, file storage and request logs all run on Cloudflare, which processes this data on our behalf in order to host the service.
• Photon — the multiplayer service. It carries the live session: voice, avatar movement and in-room events between the players in a room. It handles this traffic in the moment so that a session can happen; we do not record it.
• Meta, when you sign in with a Meta account, for the token check described above — which tells Meta that a Rec Room Legacy sign-in took place. That exchange is governed by Meta's own privacy policy. Signing in with Steam involves no equivalent call.
• Nobody else — except where we are required by law to disclose something, or where it is necessary to investigate a serious safety issue or abuse of the service. If we are ever legally compelled to hand something over, we keep a record of it.

The providers above are service providers: they are permitted to use your data only to provide their service to us, never for their own purposes, and they are required to keep it secure and confidential and to stop using it when we stop using them. We share your data with anyone else only where you have expressly asked us to.

Our community Discord server and our source repository are run by Discord and GitHub under their own privacy policies. Anything you post there is covered by their terms, not this one.

Where your data is stored

Our database is hosted in Australia, and files and logs are stored on Cloudflare's global network. If you play from outside those places — which most people do — your data is transferred internationally in order to give you the game. Where the law requires a safeguard for that transfer, such as the UK and EU standard contractual clauses, we rely on the ones our providers have in place and on the terms we are bound to as a developer on Meta's platform.

Cookies

This website sets one cookie, rf_token, which holds your sign-in session. It is strictly necessary to stay signed in, it is not readable by page scripts, and it is cleared when you sign out. We set no advertising or analytics cookies. The game client itself uses no cookies.

How long we keep it

Account and game data is kept for as long as your account exists, so your progress is there when you come back. Presence records expire within minutes. Session tokens expire on their own schedule. Server logs are retained for a short period and then age out automatically.

We delete your data, without undue delay, whenever any of these is true:

• You ask us to.
• You delete your account, or no longer have one.
• We no longer need it to run the game or provide the service.
• Meta asks us to delete it, or the law requires us to.

Deleting or correcting your data

You can ask us to correct or delete the data we hold about you at any time, from anywhere in the world. There is no charge for this, and you don't need to give a reason. The quickest way is the data-request form, which needs no account and works everywhere. Or contact us by any of these routes:

• The data-request form — reclegacy data request. No account needed, nothing to install, works from anywhere in the world. This is the route to use if you are not sure which to pick.
• Email — privacy@reclegacy.top.
• Discord — ask a moderator in our Discord server. Note this needs a Discord account, and Discord is not reachable in every country — the form above needs neither.

Tell us your Rec Room Legacy username, and be ready to prove the account is yours — normally by signing in to it, or by sending the request from the email address on the account. We ask because otherwise anyone could delete anyone else's account. We'll confirm when it's done, and we aim to complete every request within 30 days.

Deleting your account removes:

• Your account record — username, display name, profile picture, bio, email, phone number, date of birth and password hash.
• The link between the account and your Meta or Steam identity, and the stored IP addresses and device identifier.
• Your session and refresh tokens, ending any active sign-in.
• Your photos, rooms, inventions, inventory, settings, progression and presence.

Two honest limits. Messages you sent live in shared conversations, so copies already delivered to other players may remain in their message history, no longer attached to an account. And routine server logs and backups age out on their own timers rather than being edited, so a record of a request may persist for a short period after deletion. Beyond those, if there's ever a reason we can't complete a deletion request, we'll tell you what it is.

You can change or correct most of your details yourself in game, and you can ask us for a copy of the data we hold about you using the same contact routes above.

Your rights

Depending on where you live you may have specific legal rights over your data. We honour these for everyone, wherever they live, rather than checking your region first:

• To know what we hold about you and get a copy of it.
• To have it corrected if it's wrong.
• To have it deleted.
• To object to or restrict how we use it.
• To take it elsewhere in a portable form.

Where the UK or EU GDPR applies, our legal bases are: performance of a contract for the data needed to give you an account and run the game; legitimate interests for keeping the service secure, investigating abuse and fixing faults; consent for anything you choose to add, such as an email address; and legal obligation where the law requires us to keep or disclose something. You can withdraw consent at any time, and you have the right to complain to your national data protection authority.

Where California law applies: we do not sell or share personal information, and we have not done so in the past twelve months. We will never discriminate against you for exercising any of the rights above.

Children

Rec Room Legacy is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has created an account, contact us using any of the routes above and we will delete the account and its data promptly.

The game has a junior account state, inherited from the original game, which restricts voice chat and room chat for younger players. A parent or guardian can contact us using the routes above to ask about an account, to have it set to junior, or to have it and its data removed.

Security

We maintain safeguards intended to meet or exceed what is reasonable for data of this kind, and to prevent unauthorised access, loss, alteration or disclosure. All traffic between the game client, this website and our servers is encrypted in transit. Passwords are stored only as salted hashes and refresh tokens only as one-way hashes, so a copy of our database would not reveal either. Access to production data is limited to the maintainers who operate the service.

No system is perfectly secure, and we won't pretend otherwise — this is a hobby server, so please don't reuse a password here that you use anywhere important. If something does go wrong and your data is affected, we will act on it immediately and notify the people and authorities we are required to, including Meta where their platform is involved.

Reporting a security problem

If you find a security vulnerability in the game, this website or our servers, please tell us and we will fix it. Use any of the contact routes below — for anything sensitive, email is best, and please don't post the details publicly until it's resolved. We will acknowledge your report and address confirmed problems promptly. We are grateful for these and will never pursue anyone for reporting one in good faith.

Changes to this policy

If this policy changes we'll update the date at the top of this page, and the change will be visible in the project's public commit history. Significant changes will be announced in our Discord server.

Contact

Questions about this policy, a request about your data, or a security report:

• The data-request form — reclegacy data request. No account needed, nothing to install, works from anywhere in the world. This is the route to use if you are not sure which to pick.
• Email — privacy@reclegacy.top.
• Discord — ask a moderator in our Discord server. Note this needs a Discord account, and Discord is not reachable in every country — the form above needs neither.