THAUMATURGYSet the scene. Run the game.

Privacy

What Thaumaturgy stores, where it lives, who can see it, and how to delete your account and every message in it.

Thaumaturgy is made by Beckham Enterprises. This page says what the app stores, where, and how to get rid of it. Short version: nothing is collected that the app doesn't need to work, nothing is sold, and you can delete your account yourself from inside the app. The terms cover the rest of the arrangement.

Without an account

Everything you build — environments, boards, scenes, the environment you had up — is saved in your browser's local storage on your own device. It never leaves that device. Sounds you add under Your own sounds are kept in this browser too, and without an account they are never uploaded anywhere. A picture of your own needs an account, because there is nowhere else to keep it.

With an account

  • Your email address — used to send you sign-in links and to identify your account. Nothing else is sent to it.
  • Your synced data — the environments, boards, scenes and the environment you had up, so they follow you between devices. Stored on Cloudflare's D1 database.
  • A session cookie (th_session) that keeps you signed in on that device for thirty days. It's HttpOnly, secure and first-party; there are no advertising or third-party cookies.

Sign-in links are single-use and expire after thirty minutes. Those emails, and our replies to anything you send us, go out through Resend from beckhamenterprises.com.

Asking for a sign-in link runs a Cloudflare Turnstile check. This is there so nobody can use the form to send unwanted mail to other people's addresses. Turnstile is privacy-preserving by design: it sets no tracking cookie and doesn't profile you, and usually passes without you having to do anything.

Your own sounds

Your own sounds holds audio files you choose from your device. Short ones can go on a board or into an environment layer; longer ones play as a background track.

You can also put a picture of your own behind a campaign, an adventure or a scene, from its … menu. It is shrunk in your browser before anything is sent, so the full-size photo never leaves your device.

You get 250 MB, and it covers everything you upload, of every kind, counted together. Going over it removes nothing: everything you have still loads and still plays, and it is the next thing you add that is refused, with the numbers, until you delete something.

Without an account they stay in this browser and nothing is sent to us. Clearing the site’s data removes them.

With an account a copy is stored on our servers when you add it, so your sounds reach your other devices instead of living on one laptop. That copy is private: nobody else can fetch it, it is not listed anywhere, it is not searchable, and no link to it exists. Files that are already compressed we store exactly as you gave them; a large uncompressed file is converted to a smaller format first, and we tell you when that happens. We also keep the name you gave it, its size and length, and a checksum of its contents used to recognize the same file twice.

Your players hear whatever you play. While a broadcast is live, everyone holding your code hears what you are playing — your own sounds exactly as they hear the environment and your boards. A sound you never play is never sent to anybody, and when the broadcast ends there is no way for anyone to fetch the file again. Nothing is ever public, listed or searchable, and nobody can reach your sounds except the people in a game you are running.

Getting rid of them. Delete a sound and both copies go — this browser’s and ours. A picture goes when nothing uses it any more: one picture can be on a campaign and nine scenes, so taking it off one of them leaves the others alone and the file is removed when the last of them stops naming it. Deleting your account takes all of it with it.

What you add is yours and stays yours. We don’t scan your files, match them against any catalog of commercial music, or look at what you store. If you believe something here infringes your copyright, the copyright page says how to tell us.

Listen along

Starting a broadcast needs an account; joining one doesn't. The app draws a six-digit code and keeps the broadcast live in a Cloudflare Durable Object named after that code — one per broadcast, nothing in the database. While it runs, that object holds your account id as the owner, the code, the time it started, the current scene (its name, which layers are on and how they are set, and the file names of the sounds they play) and which board loops are going.

It is all deleted when the broadcast ends: when you end it, ten minutes after your app drops off, or after twelve hours, whichever comes first. Nothing survives it.

Players join with the code and give nothing: no account, no name, no email. Listeners only receive — their devices send nothing into the broadcast — and you are told how many are listening, never who. Fifty at once is the limit. Joins are rate-limited by IP address so nobody can sweep the six-digit codes looking for live games; the address is used for the count and not stored.

Usage counts

To see whether anyone is using the thing, the app records a few anonymous events: a visit (once per browser session), an environment being played (with the environment's name), a board being loaded (with the board's name), a sign-in, a broadcast being started, and a listener pressing play on one. Neither of the last two records the join code. Each event carries the country Cloudflare reports for the request and, if you're signed in, your account id.

A visit also records how you got here:

  • The referring site's host — just google.com or reddit.com, never the full address. A full referring URL can carry what you searched for or the name of a private thread, so only the bare host is kept.
  • A campaign tag, if we put one on a link ourselves (?ref= in the address).
  • A random id kept in your browser, so that several visits from the same browser count as one person instead of several. It is a random string, it is tied to no name, email or address, it is never sent anywhere but here, and clearing your browser data erases it for good.

No IP addresses, no device fingerprints, no cross-site tracking, and nothing that follows you to any other site. Cloudflare Web Analytics also runs on the site; it is cookie-less and doesn't build profiles.

Feedback

If you use the feedback form, the message, its type, the screen you sent it from, your country and your browser's user-agent string are stored, along with your email address if you gave one or were signed in. It's read by a person. A keyed hash of your IP address is stored on the row too — not the address, and not reversible without a secret only we hold. It is there to count how many messages came from one place in the last hour, and it is compared against nothing else.

Reporting a sound stores the same kind of thing: which clip, what you said was wrong, your note, your country, your email address if you gave one, and the same keyed hash of your IP address for the same hourly limit. You don't need an account to report a clip and you never will.

Messages and replies

Anything you send us — feedback or a sound report — becomes a conversation you can read on your messages page, together with whatever we said back. If you were signed in, it's listed there when you sign in. If you weren't, our reply email carries a link that opens that one conversation without an account: the link is a long random string, it opens nothing else, and the page never shows the email address the conversation belongs to.

Replies you write on that page are stored the same way as the message that started it. Nobody but the site owner can read any of it.

Where it lives and who can see it

Everything runs on Cloudflare (Workers, D1, R2) in their global network; Cloudflare keeps ordinary request logs as any host does. Only the site owner can see account and feedback data. Nothing is sold, shared with advertisers, or used to train anything.

Deleting your account and data

In the app, sign in and press Delete my account in the footer. It removes your email, your synced environments, boards, scenes and the environment you had up, any sounds and pictures you uploaded, and your sessions from our servers immediately and signs you out. Every message in your conversations is deleted with it. Usage events, your feedback and any sounds you reported lose their link to your account and their email address, so what's left keeps nothing that identifies you — a report of a bad clip stays, because the clip is still wrong and that is how it gets fixed, but it stops being yours. The IP hash on those rows stays; it is not an address and points at nobody. Anything saved in a browser stays on that device until you clear the site's data. If you can't sign in to do it, send a note through the feedback form from the address on the account and we'll delete it for you.

Deleting one campaign

Deleting a campaign is not the same as deleting your account, and it is not immediate on purpose — it is the one thing here you can undo. For three days it stays in your account, marked as being deleted, with a Restore button; nothing has been removed and restoring puts it straight back. We email the address on the account to tell you it is happening, so a campaign deleted by mistake does not quietly run out its three days while you are not looking. After three days it leaves your account and stops appearing on your devices, and a copy of that campaign and its scenes is held on our servers for thirty days from the deletion in case you ask for it back. After thirty days it is erased for good. The copy holds only that campaign and its scenes; your boards and environments are never part of it, because deleting a campaign never deletes them. Deleting your account is still immediate and takes any retained campaign with it.

Children

The app has no ads and collects nothing beyond what's listed above, but it isn't directed at children under 13 and doesn't knowingly keep accounts for them.

Changes

If this page changes in a way that matters, the change and its date will be noted here.

2026-10-26 — added Your own sounds. Audio you add is now kept in your account when you are signed in, and the people in a broadcast hear what you play. Until today the page said your own tracks never left your browser; that was true of the feature as it then was.

2026-10-23 — added the Listen along section, and said plainly that a keyed hash of your IP address is kept with feedback and sound reports.

Last updated 2026-10-26. Questions: use the feedback form in the app.

Updated 1 November 2026