Privacy

The short version

• No tracking cookies. Nothing on this site follows you between visits or between sites.
• No advertising networks, no data brokers, no profiling.
• No passwords here. Buyers sign in with their itch.io account, and only to download what they bought.
• Clicks on the main buttons and downloads are counted as daily totals, with nothing about who clicked.
• Visitor numbers are counted in aggregate. We can see that a page was viewed. We cannot see who viewed it.
• Nothing is sold or handed to anyone for marketing.

The two cookies

The site sets two cookies, both from the framework it is built on. XSRF-TOKEN stops a third-party site from forging a request in your name. laravel-session keeps your session: it is what remembers that you signed in, and it expires after 30 days without a visit, or when you sign out. Neither holds anything about you, neither is read by anyone else, and neither follows you to other sites. We mention them because a page that claims "no cookies" while setting some is not being straight with you.

The site is also in Spanish. If you open a Spanish page or pick a language with the language links, a locale cookie remembers that choice for a year. It holds only en or es.

What is collected when you visit

Server and network

The site is served through Cloudflare, which sits in front of it as a CDN and protects it from abuse. Like any web server, Cloudflare's network necessarily sees the IP address your request comes from, along with the page you asked for, the time, and the browser's user-agent string. This is how the web works; a site cannot send you a page without knowing where to send it. Cloudflare keeps these logs briefly for security and abuse prevention.

Visitor statistics

We use Cloudflare Web Analytics to count page views. It is deliberately chosen because of what it does not do: it sets no cookies, writes nothing to your browser's storage, and does not build a profile or follow you to other websites. It records the page, the referring page, and coarse technical details such as browser, operating system and country, and reports them as totals.

We rely on our legitimate interest in knowing whether anyone is reading the site. If you would rather not be counted, any content blocker that blocks static.cloudflareinsights.com will stop it, and the site works exactly the same without it.

Page views are also counted by the site itself, as a daily total for each page: the page's address and how many times it was viewed that day, nothing about who viewed it. No IP address, cookie or identifier is stored with it, and visits from known bots are not counted.

Button clicks and downloads

The site counts a few named things itself: clicks on "Get the Bundle", "Start free", the plugin download and "Sign in with itch.io", and each download. Each one adds one to a total for that day. Nothing else is recorded: no IP address, no cookie, no identifier, and no way to tell who clicked.

Search

Google Search Console tells us which search terms show this site in Google's results and how often people click through. That information comes from Google's own search records, not from anything running on this site, and it reaches us only as aggregate counts.

Third parties

Two, and no more than two. Every page loads its typefaces from this site itself, not from a font service.

• Cloudflare serves the site and counts visits, as described above.
• itch.io is where the packs are sold. Links out to it are ordinary links; nothing from itch runs on this site. Once you are on itch.io you are covered by itch.io's privacy policy. If you sign in with it, itch.io shares the details described in "Signing in with itch.io and downloading" above.

Signing in with itch.io and downloading

Paid packs are downloaded from My library after you sign in with itch.io. itch.io then tells this site your itch.io user id, your username, the link to your profile picture and which itch.io projects you own, nothing more: never your email address and never your payment details. The token itch.io gives the site for this is used once and never stored. While you are signed in, the header shows your itch.io avatar, loaded from itch.io.

We keep your itch.io user id, username and the link to your itch.io profile picture, the time you last signed in, the packs you own, and a log of each paid download: the pack, its version, the time, and a one-way hash of your IP address. Each paid file carries a short code made from your itch.io user id, so a file shared online can be traced to the purchase it came from. The code does not contain your name. Free downloads (free packs, the plugin and free themes such as Studded UI) are logged with only the file, its version, the time and the hashed address, plus your account when you are signed in, so My library can tell you when a newer version is out. What the fingerprint is for is on the license page. When the plugin installs or updates a pack in a published game, it also sends that game's place and experience ids, so we know where our packs are used.

So we can see who bought a pack but has not downloaded it yet, the site also asks itch.io, with our own itch.io key, whether each buyer who signed in here bought each paid pack, and when. Only the purchase date is kept, for about ten minutes; your email address and payment details are not kept.

Buying a pack

Purchases happen entirely on itch.io, not here. Your payment details go to itch.io and their payment processor; we never see them. What reaches us is a record that a sale happened, and the email address you chose to associate with it, which is used to deliver the file and to answer you if you write about it. It is not added to a mailing list.

Your rights

If you are in the EU or the UK, the GDPR gives you the right to ask what personal data is held about you, to have it corrected or deleted, and to object to it being processed. In practice this site holds very little that could be tied to you: if you signed in, your itch.io user id, username, the link to your itch.io profile picture, the packs you own and your download log; the counts and analytics are aggregate. If you have bought something, the record of that purchase lives with itch.io and their tools are the fastest route to it.

Ask us anything about this, or ask us to delete something, through the contact form on our itch.io page, and we will answer.

Changes

If what the site does changes, this page changes with it and the date at the top moves. There is no mailing list to notify, so the date is the honest signal.