@@ -319,10 +311,10 @@ function About({ slides, error }: { slides: Slide[] | null; error: string }) {
{/* Only when it's actually up: when it isn't, people want the status, not the joke. */}
{state === 'online' &&
}
diff --git a/apps/www/src/client/styles.css b/apps/www/src/client/styles.css
index 0de80cb..820ebf3 100644
--- a/apps/www/src/client/styles.css
+++ b/apps/www/src/client/styles.css
@@ -1,14 +1,15 @@
/*
- * RecFlare — a live-service readout.
+ * RecFlare — a poster for a game that's up right now.
*
- * The page's job is to show that this server is actually up and that real people are
- * on it, then get you into the Discord. So the surface is warm-dark (the room the
+ * The page's job is to show that real people are playing on this server, then get you
+ * into the game or the Discord. So the surface is warm-dark (the room the
* screenshots are lit against), and the logo orange (#FE7101) is spent only on actions
* and the brand mark — never as decoration, or it stops reading as "click this". Green
* means one thing throughout, healthy: the server is up, or the change saved.
*
- * Type: Archivo for the nameplate, IBM Plex Sans for prose, IBM Plex Mono for anything
- * the server itself would say (handles, room names, counts, endpoint paths).
+ * Type: Archivo for the nameplate, IBM Plex Sans for everything else. There is
+ * deliberately no monospace anywhere — this is a game, and mono type made the whole
+ * page read like a status dashboard.
*/
:root {
color-scheme: dark light;
@@ -29,7 +30,6 @@
--display: Archivo, system-ui, sans-serif;
--body: 'IBM Plex Sans', system-ui, -apple-system, Segoe UI, Roboto, sans-serif;
- --mono: 'IBM Plex Mono', ui-monospace, SFMono-Regular, Menlo, monospace;
--radius: 10px;
}
@@ -109,9 +109,8 @@ body {
gap: 9px;
font-family: var(--display);
font-weight: 800;
- font-size: 1.05rem;
- letter-spacing: 0.02em;
- text-transform: uppercase;
+ font-size: 1.2rem;
+ letter-spacing: -0.015em;
color: var(--text);
text-decoration: none;
}
@@ -132,9 +131,8 @@ body {
.nav-links a,
.linkish {
- font-family: var(--mono);
- font-size: 0.8rem;
- letter-spacing: 0.02em;
+ font-family: var(--body);
+ font-size: 0.95rem;
color: var(--muted);
text-decoration: none;
}
@@ -345,16 +343,15 @@ body {
opacity: 0.8;
}
-/* Status of the actual server, not decoration — see About. */
+/* Status of the actual server, not decoration — see About. Set in plain sentence
+ case: uppercase mono made a friendly "we're up" read like a monitoring alert. */
.status {
display: inline-flex;
align-items: center;
gap: 9px;
margin: 0;
- font-family: var(--mono);
- font-size: 0.75rem;
- letter-spacing: 0.12em;
- text-transform: uppercase;
+ font-size: 0.95rem;
+ font-weight: 500;
color: var(--muted);
}
@@ -443,8 +440,7 @@ body {
margin: 0 auto;
padding: 24px 20px 40px;
border-top: 1px solid var(--line);
- font-family: var(--mono);
- font-size: 0.75rem;
+ font-size: 0.875rem;
color: var(--muted);
}
@@ -543,10 +539,8 @@ h2 {
margin-bottom: 0;
}
-/* Identity strip on the account page: the account's own record, set in mono. */
.identity .handle {
- font-family: var(--mono);
- font-size: 0.85rem;
+ font-size: 0.9rem;
color: var(--muted);
}
diff --git a/apps/www/src/links.ts b/apps/www/src/links.ts
new file mode 100644
index 0000000..86375ef
--- /dev/null
+++ b/apps/www/src/links.ts
@@ -0,0 +1,34 @@
+/**
+ * Outbound links shared by the React client and the Worker-rendered pages.
+ *
+ * The privacy policy (`privacy.ts`) is rendered server-side while the rest of the site
+ * is a React SPA, so both need the same Discord/GitHub URLs. They live here so a moved
+ * invite or a renamed repo is one edit, not two that can silently drift — the policy
+ * naming a dead contact channel is exactly what VRC.Privacy.4 fails on.
+ */
+
+/** The community Discord — the join instructions and the build both live there. */
+export const DISCORD_INVITE = 'https://discord.gg/HhmMAKhrz'
+
+/** Where the stage's "Download for PC" button goes: the client's release listing. */
+export const DOWNLOAD_URL = 'https://github.com/djdevin/recflare-client/releases'
+
+/** The public source repo, linked from the homepage and footer. */
+export const SOURCE_REPO = 'https://github.com/djdevin/recflare'
+
+/** The repo's licence, behind the footer's "MIT licensed". */
+export const LICENSE_URL = `${SOURCE_REPO}/blob/main/LICENSE`
+
+/** Where a data-deletion or privacy request can be opened without a Discord account. */
+export const ISSUES_URL = `${SOURCE_REPO}/issues/new`
+
+/**
+ * Mailbox for privacy and data-deletion requests, or '' when there isn't one.
+ *
+ * Empty by default on purpose: an address printed here that nobody reads is worse than
+ * no address at all, and Meta re-validates the policy after approval. While it's empty
+ * the policy routes deletion requests through Discord and GitHub issues, both of which
+ * are free and open to anyone in any region — which is what VRC.Privacy.4 asks for. Set
+ * it to a real, monitored mailbox and the policy adds it as the preferred contact.
+ */
+export const PRIVACY_EMAIL: string = 'privacy@recflare.net'
diff --git a/apps/www/src/privacy.ts b/apps/www/src/privacy.ts
new file mode 100644
index 0000000..f6e4edc
--- /dev/null
+++ b/apps/www/src/privacy.ts
@@ -0,0 +1,359 @@
+import { DISCORD_INVITE, ISSUES_URL, PRIVACY_EMAIL, SOURCE_REPO } from './links'
+
+/**
+ * The privacy policy, served on www at `/privacy`.
+ *
+ * Rendered by the Worker rather than by the React SPA on purpose. The Meta Horizon
+ * Store's VRC.Privacy.1 check fetches this URL periodically and looks for a live page
+ * whose text contains "Privacy Policy"; a client-rendered route would answer that fetch
+ * with an empty `
` and could be flagged non-compliant even though a
+ * browser renders it fine. Server-rendering also means the policy survives a JS error
+ * or a blocked script, which is the one page on this site that has to.
+ *
+ * `/privacy` must therefore stay listed in `run_worker_first` in wrangler.jsonc —
+ * without it a top-level navigation is served index.html and never reaches this module.
+ *
+ * The four VRCs this is written against (developers.meta.com/horizon/resources/):
+ * Privacy.1 — the URL is live, public, HTTPS, and owned by the app's team.
+ * Privacy.2 — states what data is processed, collected and stored.
+ * Privacy.3 — states what that data is used for.
+ * Privacy.4 — states how any user, in any region, can request deletion, for free.
+ * Keep the "What we collect" section honest against the schemas it describes
+ * (packages/domain/src/accounts-db.ts and the per-worker migrations) — that section is
+ * the claim Privacy.2 is judged on, and it goes stale the moment a worker stores
+ * something new.
+ *
+ * "How you sign in" describes Meta SSO (PlatformType.Oculus), which the auth worker
+ * still stubs — see the FAKE_OCULUS_CACHED_LOGIN branch in apps/auth/src/auth.app.ts.
+ * When that lands, check the text still matches what the integration actually requests
+ * from Meta: Privacy.2 asks for extra detail about platform features specifically, and
+ * the same disclosure has to agree with the Data Use Checkup filed for the app.
+ */
+
+/** Last substantive revision, shown in the header. Bump when the text changes. */
+const EFFECTIVE_DATE = '26 July 2026'
+
+/** The palette and type of the main site, inlined — this page loads no stylesheet. */
+const STYLES = `
+:root {
+ color-scheme: dark light;
+ --bg: #14100c;
+ --surface: #1e1813;
+ --line: #33291f;
+ --text: #f5ede1;
+ --muted: #a8927c;
+ --accent: #fe7101;
+}
+@media (prefers-color-scheme: light) {
+ :root {
+ --bg: #f7f5f2;
+ --surface: #ffffff;
+ --line: #e2ddd6;
+ --text: #201a14;
+ --muted: #736656;
+ --accent: #e05f00;
+ }
+}
+* { box-sizing: border-box; }
+body {
+ margin: 0;
+ background: var(--bg);
+ color: var(--text);
+ font-family: 'IBM Plex Sans', system-ui, -apple-system, Segoe UI, Roboto, sans-serif;
+ font-size: 1rem;
+ line-height: 1.65;
+ -webkit-font-smoothing: antialiased;
+}
+a { color: var(--accent); }
+.nav {
+ display: flex;
+ justify-content: space-between;
+ align-items: center;
+ gap: 16px;
+ max-width: 760px;
+ margin: 0 auto;
+ padding: 20px;
+ border-bottom: 1px solid var(--line);
+}
+.brand {
+ font-family: Archivo, system-ui, sans-serif;
+ font-weight: 800;
+ font-size: 1.2rem;
+ letter-spacing: -0.015em;
+ color: var(--text);
+ text-decoration: none;
+}
+.nav a.back { color: var(--muted); text-decoration: none; font-size: 0.95rem; }
+.nav a.back:hover { color: var(--text); }
+main { max-width: 760px; margin: 0 auto; padding: 40px 20px 8px; }
+h1 {
+ font-family: Archivo, system-ui, sans-serif;
+ font-weight: 800;
+ font-size: clamp(1.9rem, 4vw, 2.6rem);
+ line-height: 1.1;
+ letter-spacing: -0.03em;
+ margin: 0 0 8px;
+}
+h2 {
+ font-family: Archivo, system-ui, sans-serif;
+ font-weight: 700;
+ font-size: 1.3rem;
+ letter-spacing: -0.02em;
+ margin: 40px 0 10px;
+}
+h3 { font-size: 1rem; font-weight: 600; margin: 24px 0 6px; }
+p, li { max-width: 68ch; }
+.updated { color: var(--muted); font-size: 0.9rem; margin: 0 0 8px; }
+.lede { font-size: 1.075rem; }
+ul { padding-left: 22px; }
+li { margin-bottom: 8px; }
+li > strong { font-weight: 600; }
+.callout {
+ background: var(--surface);
+ border: 1px solid var(--line);
+ border-left: 3px solid var(--accent);
+ border-radius: 10px;
+ padding: 18px 22px;
+ margin: 20px 0;
+}
+.callout p:first-child { margin-top: 0; }
+.callout p:last-child { margin-bottom: 0; }
+footer {
+ max-width: 760px;
+ margin: 0 auto;
+ padding: 24px 20px 48px;
+ border-top: 1px solid var(--line);
+ color: var(--muted);
+ font-size: 0.875rem;
+}
+footer a { color: var(--muted); }
+`
+
+/**
+ * How to reach a human about a privacy or deletion request. Rendered in both the
+ * deletion section and the footer, so the mailbox (when there is one — see
+ * PRIVACY_EMAIL) can't be listed in one place and forgotten in the other.
+ */
+function contactList(): string {
+ const email = PRIVACY_EMAIL
+ ? `
Email — ${PRIVACY_EMAIL} .`
+ : ''
+ return `
+ ${email}
+ Discord — ask a moderator in our Discord server .GitHub — open an issue on the project repo. Don't post personal details in a public issue; your username is enough for us to find you. `
+}
+
+/** The `/privacy` HTML page. Static text — nothing here is interpolated from a request. */
+export function privacyPage(): string {
+ return `
+
+
+
+
+
Privacy Policy — RecFlare
+
+
+
+
+
+
+
+
+
+
+ Privacy Policy
+ Last updated ${EFFECTIVE_DATE}
+
+
+ RecFlare is a free, open source, fan-run game server. It is not a business, it sells
+ nothing, and it has no interest in your data beyond making the game work. This page
+ explains exactly what we store, why we store it, and how to make us delete it.
+
+
+
+
+ The short version. We store your account, the things you make in
+ game (photos, rooms, messages, inventory), and the technical details needed to log
+ you in and keep the server from being abused. We don't sell anything, we run no
+ advertising, and we've integrated no third-party analytics or tracking. Ask us and
+ we'll delete your account and its data, free, wherever you live.
+
+
Who runs this
+
+ RecFlare is maintained by a volunteer community, and its source code is public at
+ github.com/djdevin/recflare .
+ This policy covers the RecFlare game servers and this website. It is a fan project, not
+ affiliated with, endorsed by, or connected to Rec Room Inc.
+
+
+ Because the server code is open source, anyone can read exactly how the data described
+ below is handled, and anyone can run their own separate copy of RecFlare. This policy
+ applies only to the servers we operate. If you play on someone else's instance, their
+ operator is responsible for your data, not us.
+
+
+ What we collect
+
+ Almost all of it is data you create by playing. We do not buy data about you from
+ anyone, and we do not combine what's here with data from other services.
+
+
+ Your account
+
+ Your username, display name, profile picture, pronoun and identity settings, bio, and the date the account was created.
+ An email address and phone number only if you choose to add them . Neither is required to play, and neither is used for marketing.
+
+
+ How you sign in
+
+ You can sign in with an account from the platform you play on, or with a password.
+ Whichever you use, we store the minimum needed to recognise you next time.
+
+
+ Steam. Your SteamID64, so the account can be matched to the right player. Steam signs the login ticket the game sends us, and we check that signature on our own servers — nothing about you is sent to Steam to do it.Meta. The user ID Meta issues for you for this app , and the display name attached to it. This is an app-scoped ID: it identifies you within RecFlare and is not your Meta account identity anywhere else. To confirm a sign-in is genuine, and that the account is entitled to the app, we send the token your headset gives us to Meta for verification — so Meta learns that a sign-in to RecFlare happened. We don't receive your Meta email address, friends list or profile beyond the ID and display name, and we don't ask Meta for them.A password on this website. Stored only as a salted PBKDF2 hash. We never store the password itself and cannot read it.
+
+ Linking a platform account is how you log in — we don't use it to look you up on that
+ platform, post anything there, or match you to advertising.
+
+
+ Device and technical data
+
+ The time of your most recent sign-in.
+ A device identifier the game client generates for each installation, and the kind of device it is — a PC or a headset, for example.
+ The IP address the account was created from, and the IP address of your most recent sign-in.
+ Session tokens. Refresh tokens are stored only as a one-way hash and are single-use.
+ Ordinary server request logs, held by our hosting provider, which include IP addresses, timestamps and the requests made.
+
+
+ What you make and do in game
+
+ Photos you take in game, and their details: who took them, the room they were taken in, and any players tagged.
+ Rooms and subrooms you create, inventions you build, and clubs you own or join.
+ Chat messages you send and the conversations they belong to, so they can be delivered and read later.
+ Your relationships with other players — friends, invites and blocks — and your interactions with rooms, such as favourites and cheers.
+ Your in-game economy: token balance, inventory, outfits and gifts received.
+ Your presence — which room instance you are currently in — so friends can find you and join. Presence records expire automatically on their own.
+ Your player settings and preferences.
+
+
+ Why we use it
+
+ To run the game. Nearly everything above exists so the world can be reassembled the next time you log in — your avatar, your rooms, your inventory, your photos, your conversations.To sign you in. Your platform identity, password hash and session tokens are what prove an account is yours and stop anyone else using it.To let players find each other. Presence, friend lists and public feeds — including the photo slideshow on this website's front page, which shows public in-game photos along with the username of the player who took each one.To keep the server usable. IP addresses, device identifiers and logs are used to investigate abuse, ban evasion and bugs, and to limit how many accounts can be created from one place. This is the only reason we keep them.To contact you, if you asked us to. An email address you add is used for account recovery and account notices, nothing else.
+
+ We do not use your data for advertising or profiling, we do not sell or rent it, and we
+ do not share it for anyone else's marketing. There are no advertising SDKs, analytics
+ SDKs or tracking pixels in the game client or on this website.
+
+
+ Who else sees it
+
+ Other players. Some of what you create is public by design: your username, display name, profile picture, bio, the rooms you publish, photos you make public, and messages you send to the people you send them to.Our hosting provider. The servers, databases, file storage and logs run on Cloudflare, which processes this data on our behalf in order to host the service.Meta, when you sign in with a Meta account. We send Meta the sign-in token from your headset so it can be verified, which tells Meta that a RecFlare sign-in took place. That exchange is governed by Meta's own privacy policy. Signing in with Steam involves no such call.Nobody else — except where we're required by law to disclose something, or where it's necessary to investigate a serious safety issue or abuse of the service.
+
+ Our community Discord server and our GitHub repository are run by Discord and GitHub
+ under their own privacy policies. Anything you post there is covered by their terms,
+ not this one.
+
+
+ Cookies
+
+ This website sets one cookie, rf_token, which holds your sign-in session.
+ It is strictly necessary to stay signed in, it is not readable by page scripts, and it
+ is cleared when you sign out. We set no advertising or analytics cookies. The game
+ client itself uses no cookies.
+
+
+ How long we keep it
+
+ Account and game data is kept for as long as your account exists, so your progress is
+ there when you come back. Presence records expire within minutes. Session tokens expire
+ on their own schedule. Server logs are retained for a short period and then age out
+ automatically. When you ask us to delete your account, we delete it as described below.
+
+
+ Deleting your data
+
+ You can ask us to delete your account and the data we hold about you at any
+ time, from anywhere in the world. There is no charge for this, and you don't
+ need to give a reason. Contact us by any of these routes:
+
+ ${contactList()}
+
+ Tell us your RecFlare username, and be ready to prove the account is yours — normally
+ by signing in to it, or by sending the request from the email address on the account.
+ We ask because otherwise anyone could delete anyone else's account. We'll confirm when
+ it's done, and we aim to complete every request within 30 days.
+
+ Deleting your account removes:
+
+ Your account record — username, display name, profile picture, bio, email, phone number and password hash.
+ The link between the account and your Steam or Meta identity, and the stored IP addresses and device identifier.
+ Your session and refresh tokens, ending any active sign-in.
+ Your photos, rooms, inventions, inventory, settings and presence.
+
+
+ Two honest limits. Messages you sent live in shared conversations, so copies already
+ delivered to other players may remain in their message history, no longer attached to
+ an account. And routine server logs and backups age out on their own timers rather than
+ being edited, so a record of a request may persist for a short period after deletion.
+ Beyond those, if there's ever a reason we can't complete a deletion request, we'll tell
+ you what it is.
+
+
+ You can also change or correct most of your details yourself, either in game or on the
+ account page of this website, and you can ask us for a copy of
+ the data we hold about you using the same contact routes above.
+
+
+ Security
+
+ All traffic between the game client, this website and our servers is encrypted in
+ transit. Passwords are stored only as salted hashes and refresh tokens only as one-way
+ hashes, so a copy of our database would not reveal either. Access to the production
+ data is limited to the maintainers who operate the service. No system is perfectly
+ secure, and we won't pretend otherwise — but this is a hobby server, so please don't
+ reuse a password here that you use anywhere important.
+
+
+ Children
+
+ RecFlare is not directed at children under 13, and we don't knowingly collect data from
+ them. If you believe a child under 13 has created an account, contact us using any of
+ the routes above and we will delete the account and its data.
+
+
+ Changes to this policy
+
+ If this policy changes we'll update the date at the top of this page, and the change
+ will be visible in the project's public commit history. Significant changes will be
+ announced in our Discord server.
+
+
+ Contact
+ Questions about this policy, or about any data we hold:
+ ${contactList()}
+
+
+ RecFlare — a fan project, not affiliated with Rec Room Inc.
+
+
+`
+}
diff --git a/apps/www/src/test/integration/api.test.ts b/apps/www/src/test/integration/api.test.ts
index f85491f..eebcddd 100644
--- a/apps/www/src/test/integration/api.test.ts
+++ b/apps/www/src/test/integration/api.test.ts
@@ -2,6 +2,7 @@ import { SELF } from 'cloudflare:test'
import { expect, it } from 'vitest'
import { DOCUMENTED_SERVICES } from '../../docs'
+import { DISCORD_INVITE, ISSUES_URL, PRIVACY_EMAIL } from '../../links'
it('rejects unauthenticated account reads', async () => {
const res = await SELF.fetch('https://example.com/api/me')
@@ -69,3 +70,31 @@ it('404s a spec proxy for an unknown service (not an open proxy)', async () => {
const res = await SELF.fetch('https://example.com/docs/openapi/evil.json')
expect(res.status).toBe(404)
})
+
+// The privacy policy is what the Meta Horizon Store's VRC.Privacy.1–4 checks are run
+// against, and a reviewer only sees the rendered page — so the four things they look
+// for are pinned here. If a section is renamed, re-read the VRC before loosening the
+// assertion: these strings are the requirement, not incidental copy.
+it('serves the privacy policy as real server-rendered HTML', async () => {
+ const res = await SELF.fetch('https://example.com/privacy')
+ // VRC.Privacy.1 — live, public, no sign-in, and text without JavaScript.
+ expect(res.status).toBe(200)
+ expect(res.headers.get('content-type')).toContain('text/html')
+ const html = await res.text()
+ expect(html).toContain('Privacy Policy')
+
+ // VRC.Privacy.2 — what is collected, VRC.Privacy.3 — what it is used for.
+ expect(html).toContain('What we collect')
+ expect(html).toContain('Why we use it')
+
+ // VRC.Privacy.4 — deletion is explained, free, and open to every region.
+ expect(html).toContain('Deleting your data')
+ expect(html).toMatch(/delete your account[^.]*at any\s+time, from anywhere in the world/)
+ expect(html).toContain('There is no charge for this')
+
+ // A deletion route a reader can actually follow. Discord and GitHub are always
+ // listed; the mailbox only when one is configured (see PRIVACY_EMAIL).
+ expect(html).toContain(DISCORD_INVITE)
+ expect(html).toContain(ISSUES_URL)
+ if (PRIVACY_EMAIL) expect(html).toContain(`mailto:${PRIVACY_EMAIL}`)
+})
diff --git a/apps/www/src/www.app.ts b/apps/www/src/www.app.ts
index 6006834..98daaeb 100644
--- a/apps/www/src/www.app.ts
+++ b/apps/www/src/www.app.ts
@@ -6,6 +6,7 @@ import { withOnError } from '@repo/hono-helpers'
import { NotificationType } from '../../notify/src/notification-types'
import { docsPage, fetchSpec } from './docs'
+import { privacyPage } from './privacy'
import { accountsBase, apiBase, authBase, imgBase, notifyBase, postForm } from './upstream'
import type { Context } from 'hono'
@@ -282,6 +283,12 @@ const app = new Hono
()
return c.json({ success: true, sent: result.sent ?? 0 })
})
+ // ---- Privacy policy -----------------------------------------------------
+ // Server-rendered rather than a SPA route so the page has real text without
+ // JavaScript: the Meta Horizon Store re-fetches this URL to check the policy is
+ // still live, and an empty SPA shell can read as a broken link (see privacy.ts).
+ .get('/privacy', (c) => c.html(privacyPage()))
+
// ---- Aggregated API docs ------------------------------------------------
// `/docs` serves the self-hosted Scalar UI; `/docs/openapi/:service.json` proxies
// each worker's spec same-origin (see docs.ts). The Scalar bundle itself
diff --git a/apps/www/wrangler.jsonc b/apps/www/wrangler.jsonc
index 75a00ce..4ffd299 100644
--- a/apps/www/wrangler.jsonc
+++ b/apps/www/wrangler.jsonc
@@ -17,12 +17,16 @@
// SPA `not_found_handling`, a top-level *navigation* to a non-asset path (browsers
// send `Sec-Fetch-Mode: navigate`) is served index.html WITHOUT invoking the Worker,
// so a browser hitting `/docs` got the homepage. Keep this in sync with the Worker's
- // routes (all under `/api/*` and `/docs*`). `/docs/scalar.standalone.js` is
+ // routes (`/api/*`, `/docs*` and `/privacy`). `/docs/scalar.standalone.js` is
// deliberately excluded so it's served directly as the static asset it is.
+ //
+ // `/privacy` is here for the same reason `/docs` is, and it matters more: the Meta
+ // Horizon Store re-fetches the privacy policy URL to confirm it's live, and dropping
+ // it from this list would serve that fetch the SPA shell instead of the policy.
"assets": {
"binding": "ASSETS",
"not_found_handling": "single-page-application",
- "run_worker_first": ["/api/*", "/docs", "/docs/openapi/*"]
+ "run_worker_first": ["/api/*", "/docs", "/docs/openapi/*", "/privacy"]
},
"upload_source_maps": true,
"observability": {