The short version
- No tracking cookies. Nothing on this site follows you between visits or between sites.
- No advertising networks, no data brokers, no profiling.
- No accounts, so there is nothing to sign up for and no password to lose.
- Visitor numbers are counted in aggregate. We can see that a page was viewed. We cannot see who viewed it.
- Nothing is sold or handed to anyone for marketing.
The one cookie
If you look, you will find a single cookie named XSRF-TOKEN. It is set by the framework the site
is built on and exists to stop a third-party site from forging a request in your name. It holds a random value,
it is not read by anything else, and it identifies nothing about you. We are mentioning it because a page that
claims "no cookies" while setting one is not being straight with you.
What is collected when you visit
Server and network
The site is served through Cloudflare, which sits in front of it as a CDN and protects it from abuse. Like any web server, Cloudflare's network necessarily sees the IP address your request comes from, along with the page you asked for, the time, and the browser's user-agent string. This is how the web works; a site cannot send you a page without knowing where to send it. Cloudflare keeps these logs briefly for security and abuse prevention.
Visitor statistics
We use Cloudflare Web Analytics to count page views. It is deliberately chosen because of what it does not do: it sets no cookies, writes nothing to your browser's storage, and does not build a profile or follow you to other websites. It records the page, the referring page, and coarse technical details such as browser, operating system and country, and reports them as totals.
We rely on our legitimate interest in knowing whether anyone is reading the site. If you would rather not be
counted, any content blocker that blocks static.cloudflareinsights.com will stop it, and the site
works exactly the same without it.
Search
Google Search Console tells us which search terms show this site in Google's results and how often people click through. That information comes from Google's own search records, not from anything running on this site, and it reaches us only as aggregate counts.
Third parties
Four, and no more than four:
- Cloudflare serves the site and counts visits, as described above.
-
Bunny Fonts (
fonts.bunny.net) serves the two typefaces the site uses. It was chosen over the more common Google Fonts specifically because it is run in the EU and does not log or track the people who load fonts from it. -
YouTube appears only on the pack pages that have a trailer, and only through YouTube's
privacy-enhanced embed (
youtube-nocookie.com). It sets nothing until you actually press play. Press play and you are watching a YouTube video, and Google's terms apply to that. - itch.io is where the packs are sold. Links out to it are ordinary links; nothing from itch runs on this site. Once you are on itch.io you are covered by itch.io's privacy policy.
Buying a pack
Purchases happen entirely on itch.io, not here. Your payment details go to itch.io and their payment processor; we never see them. What reaches us is a record that a sale happened, and the email address you chose to associate with it, which is used to deliver the file and to answer you if you write about it. It is not added to a mailing list.
Your rights
If you are in the EU or the UK, the GDPR gives you the right to ask what personal data is held about you, to have it corrected or deleted, and to object to it being processed. In practice this site holds almost nothing that could be tied to you: the analytics are aggregate and there are no accounts. If you have bought something, the record of that purchase lives with itch.io and their tools are the fastest route to it.
Ask us anything about this, or ask us to delete something, through the contact form on our itch.io page, and we will answer.
Changes
If what the site does changes, this page changes with it and the date at the top moves. There is no mailing list to notify, so the date is the honest signal.