Privacy Overview

Our Privacy Policy

You can read our full privacy policy here: Privacy Policy.

Cookies

This is a notice about cookies and similar local storage this site uses, not a consent request: the services below are not blocked while you decide. If you would rather they did not run, the most reliable option is a browser extension that blocks them, or declining cookies in your browser settings.

• Google Analytics sets cookies named _ga, _ga_* and _gid to distinguish visitors and sessions. _ga and _ga_* persist up to two years; _gid for 24 hours. Google's opt-out browser add-on stops this without needing to block cookies generally.
• Vercel Web Analytics is cookieless by design; it does not set any.
• Clerk, the sign-in service for the admin page (/admin), sets cookies only on that page, where its sign-in form loads; no other page loads it. They keep a signed-in session working and are strictly necessary for that sign-in. They may be set when the admin page is opened, even without signing in. See Sign-in for the admin area, below.
• This site keeps two things in your browser's own storage, not a cookie: sessionStorage holds the “cluster” footer label for five minutes (see Diagnostics, below), and localStorage remembers, once you dismiss this notice, that you have seen it. Neither is sent anywhere; both stay on your device and can be cleared from your browser's site data settings.

Analytics

The services contained in this section enable the Owner to monitor and analyze web traffic and can be used to keep track of User behavior.

Cloudflare, Inc.

• Personal Data: various types of Data as specified in the privacy policy of the service
• Privacy Policy

Google Analytics (Google LLC)

• Personal Data: Usage Data; various types of Data as specified in the privacy policy of the service
• Privacy Policy

External Content

This type of service allows you to view content hosted on external platforms directly from the pages of this website and interact with them.

This type of service might still collect web traffic data for the pages where the service is installed, even when Users do not use it.

Google LLC

• Personal Data: Usage Data; various types of Data as specified in the privacy policy of the service
• Privacy Policy

Hosting and Infrastructure

This type of service has the purpose of hosting Data and files that enable this website to exist.

Some services among those listed below, if any, may work through geographically distributed servers, making it difficult to determine the actual location where the Personal Data are stored.

Vercel Inc.

• Personal Data: various types of Data as specified in the privacy policy of the service
• Privacy Policy

Diagnostics

This website calls a small diagnostics service of the Owner's own. It reports which Vercel location served a request, so the Owner can tell where and how the site is being delivered. It is a separate deployment from this website, run by the same Owner on the same infrastructure provider.

Every page makes one request to it when it loads, to fill in the “cluster” label at the foot of the page. The debug page makes a few more, to show its diagnostic details. No other page requests anything else.

What the service processes

Answering any web request necessarily involves the following. The service receives it, uses it to compose a reply, and stores it in a Vercel Blob for 60 days, after which it is deleted, unless the Owner receives a valid legal request to keep it for longer. See Retention, below.

• IP address, as seen by the infrastructure provider's network
• Approximate location derived from that address by the provider: country, region, city and city-level coordinates. It is not precise, and no location permission is requested from the browser
• Time zone, as inferred from the same address
• Request headers, including the browser's user agent

The reply is sent to the User's own browser and is displayed there. On the debug page the User can see the whole of it.

Purpose and legal basis

The purpose is operating and diagnosing this website: knowing which edge location answered a request is how the Owner tells a local fault from a general one, including a fault that is no longer happening by the time it is looked into. Under Article 6(1)(f) of the GDPR the legal basis is the Owner's legitimate interest in keeping the site working and diagnosable. The processing is limited to what a web request unavoidably carries, and nothing is combined with anything else or used to build a profile.

The one further use is sanctions compliance. The Owner and the infrastructure provider are both subject to United States sanctions and export-control law, so a request that appears to come from a comprehensively embargoed jurisdiction is refused, with an HTTP 451 page explaining why, before any page is served; the provider may also refuse it independently of the Owner under its own terms. The check reads only the country, and for Ukraine the region, that the provider's edge network infers from the IP address. No list of named individuals is consulted, nothing is decided about the User as a person, and a refused request is stored and deleted on the same 60-day footing as any other.

A third country's law is not in itself a “legal obligation” for the purposes of Article 6(1)(c) of the GDPR, which means obligations under EU or Member State law. The legal basis for this use is therefore again Article 6(1)(f): the Owner's legitimate interest in operating the site, and keeping its hosting, without breaking the law the Owner and its provider are subject to.

Country inferred from an IP address is approximate and can be wrong, and a VPN or a misattributed address can produce the wrong answer. The 451 page says so and gives the same address, so a User who believes access was refused in error can write to [email protected].

Retention

Each request is stored in a Vercel Blob for 60 days, then deleted automatically. The Owner keeps it for longer than that only if required to by a valid legal request, such as a court order or a lawful request from a government authority; no other reason extends it. The infrastructure provider may separately retain operational request logs of its own as the Owner's processor, under its own terms, in the ordinary course of running the servers.

Storage on the User's device

The result of the cluster label's request is kept in the browser's sessionStorage, under the key ll-cluster, for five minutes, so moving between pages does not repeat the request. It never leaves the device and is discarded when the tab is closed. Clearing site data removes it.

The service sets no cookies for ordinary visitors. Cookies are set only when the Owner signs in to administer the site, through Sign in with Vercel; those are strictly necessary for that sign-in and are never set for anyone who does not use it.

Where it runs

The service runs on Vercel's edge network and is answered from the location nearest the User, which for Users in the EU or EEA means an edge location in or near that region. Vercel Inc. is established in the United States and is the Owner's processor for this; transfers outside the EEA are covered by the Standard Contractual Clauses in Vercel's data processing agreement.

• Vercel privacy policy
• Vercel data processing addendum

Rights

Users in the EU or EEA have the right to access, rectify, erase, restrict and object to processing of their personal data, and to data portability. These rights apply to a stored request for as long as its 60-day retention lasts; after that, or once a specific request has already been deleted, there is nothing left of it to act on, except operational logs the infrastructure provider may separately hold as processor, which will be passed on. Requests and objections can be sent to [email protected]. Users also have the right to lodge a complaint with their national data protection supervisory authority.

Sign-in for the admin area

The admin page, at /admin, is a restricted area for the Owner and anyone the Owner authorizes. Signing in to it is handled by Clerk, Inc., an authentication service, through its sign-in servers at clerk.me.shadowdewuff.gay. No other page asks anyone to sign in or loads Clerk.

What is processed

For an account that signs in, Clerk processes:

• The account's email address, and its name if one is set
• One-time sign-in codes sent to that email address, and one-time sign-in links
• The account's organization membership, role and permissions, which decide whether it may see the admin dashboard
• What is needed to keep the account signed in securely: IP address, browser user agent, and sign-in and activity times

Opening /admin without signing in still loads Clerk's sign-in form, so the browser connects to Clerk's servers and Clerk may set its cookies (see Cookies, above). Clerk holds account data only for people who have an account.

A one-time sign-in link carries its code in the address, after __clerk_ticket=. The page removes it from the address bar as it loads, before Google Analytics runs, so the code is not sent to analytics.

Purpose and legal basis

The purpose is keeping the admin area restricted to the accounts allowed to use it. Under Article 6(1)(f) of the GDPR the legal basis is the Owner's legitimate interest in protecting the administration of the site. Nothing collected for sign-in is used for any other purpose.

Retention

Account data is kept for as long as the account exists. The Owner can delete an account at any time, and will on request; Clerk then removes it under its own retention terms. Clerk may separately keep security and operational logs of its own, as the Owner's processor, under its own terms.

Where it runs

Clerk, Inc. is established in the United States and acts as the Owner's processor for sign-in, so sign-in data may be processed in the United States.

• Clerk privacy policy

Rights

The rights described under Diagnostics, above, apply to sign-in data too, for as long as it is held. Requests can be sent to [email protected].