Privacy policy: what this site stores and shares

The short version: this is a static site with one exception, the contact form. It has no accounts, no tracking pixels and no ad network. The details follow.

What stays in your browser

Two small preferences live in your browser’s local storage. They are not cookies: they stay on your device, and we have no access to them:

• Age confirmation, which stops the 18+ notice from reappearing on every page.
• Sidebar state, that is, whether you collapsed the navigation.

Clearing your browser data removes both. The site works fine without them; the only effect is that the age notice appears again.

What the contact form does

The only place where the site sends data is the form on the contact page. What follows is its full behaviour.

• Collected: you type a name, an email address and a message, and pick a topic from the list.
• Destination: a single mailbox that we read, to which it is sent as an ordinary email. Your address goes in the reply-to field, so that we can answer you directly.
• Added by the server: your IP address and the time of sending are put into the body of the email, and the only purpose is spam control.
• Storage: only that mailbox holds the message. We run no database, no CRM and no mailing list, and no outside party gets any of it.
• Anti-spam: the form has three defences: a hidden field that bots tend to fill in, a timing check on how fast it is submitted, and a limit of three messages per IP address in any ten minutes. For the limit, the server stores a small file whose name is a SHA-256 hash of your IP address (the file name never contains the readable address) and which contains only the times of your latest messages. When another message arrives from the same address, times older than ten minutes are discarded. The file itself is not removed automatically and stays on the server.

Ask in a reply if you want a message you sent to be deleted; we will do it.

Server logs

Standard access logs are kept, as on any web server. They record the IP address, timestamp, requested URL, referrer and the browser’s user-agent, and they exist for security and for tracing faults. They are not linked to anyone’s identity and are not shared.

Analytics

At the time of writing the site uses none. If one is ever added, this page will name the provider before it is switched on.

Links to other websites

Following one of the tracked links to Candy AI may earn this site a commission. Following one sends you to another company’s website, which operates under its own privacy policy and not ours. Nothing personal comes back to us from them: what we receive is aggregate numbers showing whether a referral happened.

Children

The products covered here and this site are both for adults aged 18 and over. We do not target children and never knowingly collect their information.

Questions about this policy

If anything here is unclear, ask through the contact page.