Privacy at BassRoam

Who is responsible for your data?

BassRoam is a personal hobby project operated by Peter Thielen in the Netherlands. Peter Thielen is the controller responsible for the personal data processed through BassRoam.

The current BassRoam pilot is intended for adults and takes place at 18+ events.

For privacy questions or requests, contact privacy@bassroam.com.

Why we process this data

We process the personal data needed to operate the BassRoam experience and evaluate the experience based on our legitimate interests.

This includes keeping each Roamies Journey working, remembering the browser state needed for unlocking, passing on and returning, completing Roamie-to-Roamie encounters, optionally adding a city to a completed check-in or encounter, and using limited first-party observations to understand whether participants can successfully use the experience.

We have assessed these interests against participants’ privacy rights and deliberately limit the information we collect. BassRoam avoids more intrusive identification methods such as participant accounts, browser fingerprinting, continuous location tracking and IP-based participant identity.

Optional check-in and encounter location was specifically reassessed under our legitimate interests framework. Browser permission is an additional control over access to location, not the legal basis for this processing.

When you contact us about a privacy request, we process the information needed to respond to that request and comply with our data-protection obligations.

Your check-ins

When you check in, we store the name or nickname used, your optional message, and the time of your check-in. These become part of that Roamie’s Journey and may be visible to other participants who unlock its story by checking in. If you choose a vibe, we also store it with that check-in and show it in the Journey.

Before check-in, a Roamie’s page may show limited aggregate story facts. Participant names, messages and detailed Journey history remain locked until the viewing browser has participated in that Roamie.

Choose a nickname you’re happy to share, and leave private details out of your message.

Reporting Journey content

Participants can report user-entered nicknames or messages for internal review. Reports use fixed reasons without free-text explanations. We do not intentionally store a snapshot of the reported content. We may redact content or hide a Journey moment. Redaction removes the selected stored nickname or message while preserving the Journey entry. Hiding removes the moment from the public Journey and permanently erases both nickname and message. The underlying check-in record, including its time and browser identifier, remains stored. Erasure applies to the active CheckIn record; it does not guarantee removal from backups, previously viewed pages or unrelated records. Report and moderation-action metadata follow the pilot retention policy below, with earlier deletion where no longer needed.

BassRoam does not intentionally store reporter identity as part of a report. Reports are not guaranteed anonymous. Reporting requests may still involve existing browser cookies and credentials, and infrastructure request metadata. We use Resend only to send a generic operational moderation notification, without Journey content, report reasons, participant identifiers, report counts or affected-entry counts.

Optional check-in and Crossed Paths location

After a successful check-in or Crossed Paths encounter, BassRoam may automatically request browser location to add the city to the participating Roamies’ stories. Location enrichment is optional. Refusing location access does not prevent or undo your check-in or encounter, or stop normal participation. A later successful check-in or encounter may try again.

Your browser or operating system controls location permission. It may reuse an earlier permission without showing another prompt. BassRoam does not store a preference saying that you granted or denied permission.

We use your precise location temporarily to determine the city. Your browser supplies coordinates, accuracy and the time the location was acquired. After validation, we send the precise coordinates to Geoapify, our reverse-geocoding provider, to find the city. We do not intentionally include your nickname, message or browser identifier in that request.

BassRoam stores only a coarse city-level location snapshot: the city, country code, representative city coordinates returned by Geoapify, the city-level granularity and the source, Geoapify. Each check-in has its own optional location snapshot. An encounter has one shared optional location snapshot for both Roamies. That representative map position is not your browser’s precise coordinates. BassRoam does not intentionally retain the precise browser measurement as part of the check-in or encounter or participant record. This is not a precise GPS history.

BassRoam does not continuously track your location. Each eligible check-in or encounter can make a one-shot location request; there is no continuously updated current location, and a missing city is not copied from an earlier check-in or encounter.

When this succeeds, the submitting success page shows “Location added: <city>”. Location history is not currently displayed in the Journey or share cards. Country and representative map coordinates are not displayed publicly.

Remembering your browser

We put a random, persistent browser identifier in a cookie and store it alongside your check-ins. It helps us remember that you’ve unlocked a Roamie’s story, enforce the rule that someone else must check in before you can check in again, recognise a return to a Roamie, and distinguish participating browsers in limited activity metrics.

Opening a valid Roamie page can create this identifier before you check in. Invalid or nonexistent Roamie requests do not create a persistent browser identifier. The same identifier may be reused across different Roamies for these functions and pilot metrics; it does not establish a verified real-world identity.

This identifier is pseudonymous, not anonymous. It is not an account and does not identify you as a verified person. A different browser or cleared cookies can look like a new participant.

After a successful check-in, a protected cookie may also remember your chosen nickname for that specific Roamie and browser identifier. This reduces repeated input and keeps future check-ins to that Roamie consistent.

Your nickname is not automatically reused for other Roamies. If the nickname cookie is missing or unreadable, we may recover the nickname from your most recent check-in to the same Roamie using the same browser identifier, provided that check-in is not hidden and its nickname has not been redacted. A remembered nickname is checked against that stored check-in; an old cookie cannot automatically restore a hidden or redacted nickname. Remembering a nickname does not create an account or a verified identity.

Crossed Paths

When you choose “Meet another Roamie”, a short-lived cookie remembers the starting Roamie, a random meeting attempt identifier, and the browser identifier that started it. Scanning a different Roamie through NFC within five minutes completes the encounter only with the matching browser identifier.

We store which two Roamies met, when they met, and the meeting identifier. Completed encounters appear as Crossed Paths moments in the Roamies’ Journeys after you’ve unlocked the story you’re viewing. They are separate from people’s check-ins. If a Roamie's Born moment is automatically derived from its first encounter, it uses that encounter's location, if available. This does not create a separate check-in or location snapshot.

Learning from BassRoam

We record limited product events: public Roamie page opens, check-in attempts, meeting attempts started, share starts and successful share handoffs. Each event records the Roamie, event type, and time.

We may also record that location acquisition was attempted, permission was denied, location was unavailable, or city resolution failed. These observations contain no coordinates, accuracy, acquisition timestamp, city or country, protected enrichment credential, provider response or browser error text. They use the same pseudonymous browser identifier as check-ins, so they are not anonymous. They help us understand whether optional location enrichment is working.

We also use aggregate counts of stored check-in locations, including city and country counts, to evaluate whether optional city enrichment is useful and technically reliable enough for the limited pilot. These summaries are only available to the operator, do not show individual location histories, and do not use your precise browser coordinates. Encounter locations are not included in these summaries.

Page opens and check-in attempts also store the same browser identifier used for check-ins, so we can measure progress from an initial open to participation. This helps us understand how page opens and attempts lead to completed check-ins over time. Meeting starts use the attempt identifier, without a browser identifier, so we can tell whether they completed. No replacement tracking identifier is used.

Share observations record only the Roamie, event type, and time. A successful share handoff means the browser completed native sharing, copied share text, or accepted an image download; it does not mean you posted publicly.

Share observations do not include a browser identifier, share destination, share text, image contents, or participant names or messages.

Share-card images are generated locally in your browser and are not stored server-side by BassRoam. Once you export or share a copy, that copy is outside BassRoam’s control.

Completed check-ins and encounters are the actual Journey records, rather than extra copies recorded as telemetry. Together, these records help us understand whether people can open a Roamie, check in, pass it on, and continue its Journey.

Keeping BassRoam working

We use operational application logs for debugging, reliability, and investigating security and browser-state isolation problems. These are separate from the product events used to improve BassRoam and are not Journey records.

Application logging is enabled. Application Insights is disabled.

Browser-state diagnostics may record whether browser recognition, remembered nicknames and participation restrictions worked, and whether an operation succeeded. Logs may use Roamie references and limited pseudonymous browser references scoped to individual Roamies. These references can change after an application restart and do not disclose the raw browser identifier. They are pseudonymous, not anonymous, and do not identify a verified person or use browser fingerprinting.

These diagnostics do not log names or nicknames, message text, the raw browser identifier or device credential, cookie contents, the public Roamie token, or request bodies. They do not use IP addresses as participant identity.

Separate location diagnostics record only limited reasons for configuration, preparation, validation or provider failures. They intentionally exclude location measurements and places, browser identifiers, check-in references, protected enrichment credentials, API keys, request URLs, provider responses and exception details. This does not guarantee what separate hosting, platform or provider logs contain.

Hosting and platform access logs are configured separately and may contain IP addresses, request URLs, or other request metadata. The exclusions above apply to our browser-state diagnostics, not to those separate logs.

Cookies that make it work

• __Host-Roamie.Device: a protected random persistent browser identifier, set to last 365 days.
• Roamie.Nicknames: a protected collection of nicknames for individual Roamies, tied to the browser identifier and set to last 365 days after a successful check-in. Older entries may be removed to keep the cookie small.
• Roamie.PendingEncounter: the pending meeting cookie, set to last five minutes and cleared when the encounter completes.
• __Host-Roamie.Nfc: a protected session cookie tied to the existing browser identifier. It holds permission for up to ten scanned Roamies, each valid for 60 minutes from scanning, and remembers whether its check-in permission has been used. The cookie has no persistent expiry; browsers may restore session cookies.

These cookies support BassRoam’s functionality and limited product learning.

The site also uses protected framework cookies to protect form submissions and carry temporary messages and state between pages, including Roamie references and browser identifiers where needed.

After an eligible check-in or encounter, protected temporary state also carries short-lived authority to add a city to that check-in or encounter for the matching browser. It contains no location measurement and does not remember browser permission. BassRoam does not store the precise measurement in cookies or browser storage.

BassRoam does not use advertising cookies or cross-site tracking cookies.

Internal NFC provisioning is restricted to operators and uses protected temporary provisioning credentials, separate from public NFC scan authorization. Its authorization deadline is 24 hours from the start; batch progress does not extend it. Recovery information, which may include NFC serial evidence and provisioning credentials, is stored in the browser tab's sessionStorage. Cross-tab coordination uses localStorage. Successful final completion removes the relevant recovery entry, but intermediate, interrupted or cancelled states and some coordination information can remain. Clearing browser data and restoring tabs or sessions can affect how long this information remains.

Check-in drafts on your browser

When you edit a check-in, we save its nickname, message and optional vibe in this browser's localStorage, scoped to the Roamie and a coded reference derived from your existing browser identity. Drafts are not sent to the server until you submit the form. They contain no NFC credentials or location information.

A draft expires 24 hours after the first edit; further edits do not extend that time. Expired drafts are discarded on the next access, rather than removed while the browser is closed. A confirmed successful check-in clears its draft. Failed submissions keep it. Browser storage may be blocked or cleared, and drafts cannot be recovered in another browser or after browser identity changes. LocalStorage is accessible to scripts on this site; it is not a secure vault. You can remove drafts by clearing BassRoam site data.

Service providers and where data is processed

We use a small number of service providers to operate BassRoam. They process personal data on our behalf only as needed to provide their services.

• Microsoft Azure: hosts the BassRoam web application. Its primary hosting region is West Europe in the Netherlands.
• Neon / Databricks: provides the production PostgreSQL database. Its primary database region is AWS Europe (London) in the United Kingdom.
• Geoapify / KEPTAGO LTD: reverse-geocodes precise coordinates sent by BassRoam to determine the city. We use its EU API endpoint. Its published privacy and data-processing materials describe limited request retention, with longer retention in exceptional cases; this is not a guarantee of zero coordinate retention.
• Resend / Plus Five Five, Inc.: sends operational moderation notification emails to the BassRoam operator. These notifications do not contain Journey messages, nicknames, report reasons or participant identifiers. Resend processes email delivery information and stores email data in the United States, subject to its published Data Processing Addendum and applicable international transfer safeguards.
• Mijndomein / Soverin: provides the email service used for BassRoam privacy and contact email.

These providers may use their own subprocessors for hosting, support and operational services.

Some processing may therefore take place outside the European Economic Area. Where this happens, we rely on the legal safeguards that apply to the transfer, such as an adequacy decision or contractual safeguards where required.

How long we keep data

Submitted check-ins and Journey entries are retained for the lifetime of their Roamie. Submitted Journey content does not expire automatically. Deleting a Roamie through the supported deletion workflow removes its associated Journey records. Earlier justified erasure, redaction or hiding remains possible.

Product events and report and moderation-action metadata are retained for the duration of the pilot and for no longer than 12 months after the pilot ends. After that period, they are deleted or anonymized where appropriate. We delete data earlier when it is no longer necessary. The pilot has no predetermined end date. At pilot completion, the operator records the end date and schedules retention review and deletion according to each category's retention rules.

Stored coarse check-in and encounter locations follow the retention and deletion of their parent check-in or encounter. Geoapify’s own request handling and retention are separate from BassRoam’s stored check-in and encounter records.

The pilot operator follows a documented manual deletion and retention procedure, including review of backups and exports under our control. Scheduled automatic cleanup is not implemented. Removing the browser identifier alone does not anonymize a record if its nickname or message can still identify someone.

Production application logs are configured to be retained for 14 days. Application Insights is disabled. No export through App Service Diagnostic Settings was configured at the time of verification. These observations do not establish whether other Azure platform, access or provider logs are collected or how long those separate logs are retained. Restarting the application changes future diagnostic references but does not delete logs already stored.

Privacy and general contact correspondence is retained as needed during the pilot. Mailboxes are reviewed and cleaned up after the pilot ends. Minimal privacy-request or complaint records may be retained longer only where justified by accountability or legal obligations.

Your privacy rights

Depending on the circumstances, you may have the right to ask us for access to your personal data, to correct or delete it, to restrict how it is used, or to object to processing based on your particular situation.

Because BassRoam relies on legitimate interests for the product processing described on this page, you can object to that processing based on your particular situation. We will then assess whether the processing should stop.

To make a privacy request or object to how your data is used, email privacy@bassroam.com.

BassRoam deliberately does not use participant accounts or verified identities. We may therefore need enough information to reasonably identify the relevant records, and in some cases we may not be able to link pseudonymous browser records back to you. We will not ask for more identifying information than reasonably necessary to handle your request.

Requests can cover access to, correction or deletion of stored coarse check-in or encounter location, nickname or message correction or removal, and browser linkage and related product events where appropriate. Server-side changes cannot remotely clear cookies already stored in your browser, including a remembered nickname. You may also need to clear BassRoam site data in each relevant browser; this resets browser identity and Journey unlock state.

You can change or revoke location permission in your browser or operating system for future location access. This does not automatically delete a location already stored with a check-in or encounter; you can include it in a privacy request.

You also have the right to submit a complaint to the Dutch privacy regulator, the Autoriteit Persoonsgegevens.

What we don’t use

BassRoam does not use browser fingerprinting, participant accounts, IP addresses as participant identity, cross-site tracking or third-party advertising analytics.

We do not use your data for profiling or automated decision-making that produces legal or similarly significant effects.

How to reach us

For privacy questions, requests or objections, contact privacy@bassroam.com.

For general questions, contact contact@bassroam.com.