privacy.md

• guestbook: the name/handle and message you type, plus a timestamp. shown publicly on the guestbook page. don't post personal info you don't want public, i can't unsee it and neither can anyone else. stored until you ask me to remove it, or i remove it for being spam. every post runs through a moderation check first (see third_parties.txt below); anything it flags as hate/slurs/threats is held out of public view until i look at it, and i keep a short note of why it was held next to the entry.
• which site sent you here: once per browser session, your browser tells me the hostname of the page you clicked the link on, and i add one to a counter for that name. "reddit.com, 40 sessions" and nothing else. the path, the query string and any search terms in it are thrown away before anything is written, so what's stored can say a link on reddit works and can never say who followed it or what they searched for. arriving with no referring site at all, which is what typing the address or opening a bookmark looks like, counts under "direct". there is no row per visitor and nothing joins these counters to the hashed IP below or to anything else on this page.
• guestbook reactions: tapping one of the four emoji under an entry stores which entry, which emoji, and the scrambled version of your IP described in the window below. that's the whole row: no name, no message, nothing else about you. it exists so a count reads as one per person instead of one per click, and it's deleted the moment you tap the same emoji again to take the reaction back off, or when the entry it sits under is removed.
• a maparts account, if you choose to make one: the display name you pick and your password, the password only ever as a scrypt hash with its own random salt, never as the password itself. accounts are 18+, and signing up also stores which version of the terms you accepted and when, which is the record that you agreed to them and said you were 18 or over. an account exists so the collection and wishlist you build on /maparts follow you between browsers, and those are stored as nothing more than which map ids you marked and the date you marked them. if you also use the mod, you can generate a one time code on your account page and type it in game, which binds your Minecraft UUID and name to the account so the mod's tracker can fill your collection for you. that link is optional and the account works without it, never knowing anything about your game identity. all of this lives in the maparts backend, not this site's own database. nobody needs an account to read the wall, play anything, or post here, and asking me deletes the whole thing.
• contact form: your name, the contact handle you give me, and your message, plus a timestamp. not public. i only use it to reply to your message. deleted once i no longer need it to respond to you.
• playground leaderboards: if you save a score, the nick you type, the score, the accuracy where the game has one, and a timestamp. the nick and score are shown publicly on that game's board, so pick a nick accordingly.
• a scrambled version of your IP, on a leaderboard row you saved, and also just from loading the site once. it gets its own window below, because burying that in a footnote would be exactly the kind of thing this page exists to not do.
• counters: how many visits, how many runs each game has seen, the running total behind the average under each board, and a separate count of people who spent at least 30 seconds on /maparts specifically. the game and visit totals are plain numbers with nothing attached; telling one visitor from another to keep those counts honest is what the scrambled IP above is for.
• counters with a date on them: four running tallies, each one a key and a number and a day, and none of them attached to a person or to each other. which page was opened (the bare path, never the query string or anything after a #). which site sent people here, now broken down by day rather than one lifetime total. whether the visitor was on a phone, a tablet or a desktop, which is three buckets and nothing finer: the browser, the version and the platform your browser also announces are read to pick one of the three and then thrown away. and which country, worked out on my own server from a list of IP ranges that ships with the code, so no third party is ever asked and your address never leaves the machine. a row of any of these says "37 people on a phone on the 14th" and can never be asked which 37. they exist so i can tell whether the wall needs work on mobile and whether a link somewhere is actually bringing anyone.
• which maparts get looked at: opening a mapart's full view, or a group's page, adds one to a count for that image and that day. no id of yours goes with it, so the number says "this one was opened 40 times" and never who opened it. it drives the "most looked at" ordering on the wall and tells me which categories are worth the effort. repeat opens by one person inside an hour only count once, and how that is done without storing anything is in the window below.
• maparts suggestions and reports: suggesting a category or reporting an image on /maparts sends that image's id and your pick. it goes to a small backend i run for maparts specifically, not this site's own database, and not anyone else's hands either. a suggestion is also stored with the time and a random session tag, so i can review "these 30 came from one person tonight" together instead of one by one. the tag is made up on the spot and isn't built from your IP or anything else about you. to know that your next suggestion belongs to the same session, the backend keeps a scrambled version of your IP next to the tag in memory only. it is never written down, and it's forgotten after 3 hours without a suggestion or whenever the backend restarts. after that, nothing connects you to the tag.
• ads on the mapart wall: the ads on /maparts and /advertise are sold and entered by me by hand. there is no ad network, no third-party ad script, and nothing on those pages talks to anyone but this site. what gets counted is how many times an ad was shown and how many times it was clicked, stored as a daily total per ad. a click also writes one row with the day and a scrambled version of your IP, described in the window below, so one person clicking the same ad twenty times does not read as twenty interested people. those click rows are deleted after 90 days; the daily totals stay. advertisers see numbers only, never anything about who you are, and nothing about your visit follows you to another site.

a handful of things need to tell one visitor from another: a leaderboard, so beating your own score updates your row instead of stacking a second one, the site-wide visit counter, so refreshing the page doesn't count as a new person, the maparts engaged-visit count, so a bounce doesn't count as a stay, and a guestbook reaction, so one person tapping an emoji counts once. they all use the same marker. here's exactly what it is.

• your raw IP is never written to the database. what's stored is an HMAC-SHA256 hash of it, salted with a secret kept outside the database. someone who walks off with the database file can't turn those back into addresses without also stealing the salt.
• it's still a stable marker pointing at you, so i treat it as your data rather than as anonymous noise. you can ask me to delete it.
• on a leaderboard, it's only written when you save a score. playing, or just reading a board, stores nothing. loading a board works the hash out in memory to highlight your own row, then forgets it.
• for the site-wide visit counter, it's written the first time you load any page in a browser session, purely to decide whether this is a new visitor or a repeat one. nothing else is attached to it, and it's never shown anywhere, unlike a leaderboard row.
• for the maparts engaged-visit count, your browser starts a 30 second timer when you land on /maparts. leaving before that never writes anything, so a page you bounced off of is never counted. staying past 30 seconds writes the same kind of hash, once per browser session, purely to avoid counting one visitor twice.
• for a guestbook reaction, it's written next to the entry id and the emoji at the moment you tap one, and deleted again the moment you untap it. that pair is also what lets the page light up the reactions you already left: loading the guestbook works the hash out in memory, marks your own taps, then forgets it, the same as loading a leaderboard.
• for an ad click on /maparts, the same kind of hash is written next to the ad's id and the day. it exists so repeat clicks from one person are visible as repeats. loading a page with an ad on it writes no hash at all: an impression is counted as a bare number.
• as of 2026-09-14 there is also one row per hashed IP per day, which is the only way to answer whether anybody comes back. the older counter writes a hash the first time it ever sees it and never again, so it can say 1,700 people have been here and cannot say whether that is 1,700 strangers or the same 50 returning. this row is the same hash, the same salt and the same 400 day cap; the only new thing is the date beside it. it holds no page, no source and nothing about what you did.
• the country counter reads your IP, decides which country it falls in, adds one to that country's number for the day, and keeps nothing else. the IP is not stored, the answer is not stored next to you, and the lookup happens on my own server against a list that ships with the code. the list only covers IPv4, so if you are on IPv6 you land in "unknown", which is a real share of people rather than a rounding error.
• opening a mapart's detail view works out the same kind of hash purely to notice that you already opened that one in the last hour, so flicking back and forth does not count as forty people. that pairing lives in the server's memory, expires on its own, and is never written to disk. a row saying which maparts a given reader opened would be a far more revealing thing to keep than the count it would be protecting, so it does not exist.
• both counters' copies of the hash are kept at most 400 days, then deleted automatically. if you come back after that, you're counted as a new visitor again, the same as if you'd never been seen. this cap is the whole reason a hash is used here instead of your raw IP staying around forever.
• the rate limiter keeps your IP in memory briefly to count requests. it expires on its own and never hits disk.
• server software may temporarily log IPs as part of normal operation and basic security.

there is no cookie banner on this site because there is nothing to ask you about. load any page here as a plain visitor and the server sets no cookie at all. you can check that yourself in your browser's devtools, under application, then cookies.

two cookies exist, and neither one can appear unless you type a password:

• maparts account session, set when you log in to a maparts account. one random token, httpOnly so page javascript can't read it, SameSite=Strict so it can't ride along from another site. expires after seven days, and logging out deletes it on both ends.
• admin session, the same thing for the moderation panel, which is mine. you will never have one.

both are strictly necessary to deliver a thing you explicitly asked for (being logged in), which is the exemption in art. 398 of the polish prawo komunikacji elektronicznej and art. 5(3) of the ePrivacy directive. that is why no consent is asked for them, and why asking would be theatre.

the counters added on 2026-09-14 (pages, devices, countries, returning visitors, mapart views) changed none of this. all of them are worked out and stored on my server, from a request your browser was already making. none of them writes, reads or needs anything on your device. that is why this page still has no banner on it.

there are no analytics cookies, no advertising cookies, no third-party cookies, and no pixels or tags of any kind. three bits of browser storage that were not strictly necessary (a visit-counter flag, a maparts visit flag, and an ad impression dedup list) got deleted on 2026-09-14 rather than put behind a banner. the counters they fed dedup on the server now, which works just as well. what is left in your browser is listed in stays_in_your_browser.txt below and is all either something you asked for or something you clicked.

• no analytics product, no third-party ad scripts, no fingerprinting, and no cookies for anything you do as a plain visitor. nothing here loads Google Analytics or anything like it, and no third party is handed your visit. the closest thing i keep is the plain per-site counter described above, which lives in my own database and holds hostnames and numbers, not people. the only two cookies that exist are login sessions, broken down in cookies.txt above. the footer joke stays load-bearing for everyone who never types a password.
• nothing is sold, shared, or handed to anybody for money. there is no "partner". it's one person and a small server.
• the only login on this site is the optional maparts account. nothing else here has one, and reading, playing, signing the guestbook and reacting to an entry all work without ever telling me who you are.

this never reaches the server. it sits in your own browser, and clearing your browser data deletes it.

• sessionStorage: one entry, and only if you click to dismiss the announcement banner on /maparts. it stores the text you dismissed, so changing the message shows it to you again instead of silencing it forever. clicking that button is the only thing that writes it. (the moderation console keeps its token here too, but that needs a password you don't have.)
• localStorage: your best times and scores, how many captchas you've "passed", how long the existential timer has been running, the maze tilt setting, whether you dismissed the cat, whether you turned the 18+ toggle on, your playground wallpaper pick, and anything you type into the notes app in the playground. that notes text stays on your device. i never see it. every one of these is either a setting you chose or a score you asked to keep, which is why none of them needs consent either.

a short list, and none of them get an account, a cookie, or a cent.

• OVH SAS (roubaix, france): the server this site runs on is rented from them, so they hold the disk everything above sits on. that makes them a processor, not another audience for your data; it stays in the EU and nobody at OVH is sent anything about you on purpose. the web server keeps its normal access log, which includes IP addresses, on that machine for 14 days and then deletes it automatically. i.exdede.xyz, where images and files i link are served from, is the same machine with the same 14 day log and nothing else attached to it.
• discord webhook: sending the contact form, or posting in the guestbook, pings my discord so i notice faster. that ping carries what you typed (name and message), so your text reaches discord as well as me. it doesn't carry your IP.
• AI moderation: to keep the guestbook from being a slur dumpster, the name and message you post are sent to two moderation services, Mistral (EU-based) and Groq (US-based), which score whether the text is hate speech, threats, and so on. only that text goes out, nothing about who you are, no IP. i send it because the plain word filter got walked straight past by people spacing out slurs. sending text to Groq means it briefly leaves the EU; it's covered by Groq's own standard data protection terms, and no reply from either service is stored, only the flagged/not-flagged result. if both services are unreachable the post is held rather than shown, so an outage can't wave something through.
• lanyard: the home page shows whether i'm online, and your browser fetches that from api.lanyard.rest itself, about once a minute while the page is open. it deliberately sends nothing about you, but any request your browser makes shows that service your IP and user agent, same as visiting any site. home page only. blocking the domain, or not sitting on the home page, stops it.

under GDPR (RODO if you're Polish like me) you can ask what data of yours i have, ask me to fix it, ask me to delete it, or complain to your country's data protection authority (in Poland, UODO) if you think i've messed this up. for a site this small the easy version is: message me and tell me which guestbook entry, contact message, leaderboard nick or maparts account is yours, and it's gone. an account takes its collection, its wishlist and any Minecraft link with it.

legal basis: guestbook posts and leaderboard scores are stored because you chose to post them publicly. contact messages are processed because it's necessary to actually reply to you. a maparts account and everything hanging off it exists because you asked for the account, so it's processed to provide the thing you signed up for, and it stops existing when you ask me to delete it. the hashed IP on a leaderboard row, the hashed IP behind the site-wide and maparts visit counters, the one-per-day row behind the returning-visitor count, the hashed IP on a guestbook reaction, the per-site arrival counters, the dated page, device and country tallies, the per-mapart view counts, and running guestbook posts through moderation, are all legitimate interest: one row per player, honest visit counts that don't inflate on refresh or bounce, knowing whether anyone comes back rather than guessing, emoji counts that can't be clicked into the ground by one person, knowing which links actually bring people here, knowing whether the wall needs work on a phone, knowing which maparts are worth the shelf space, and a wall that isn't a slur dumpster. the 400 day cap covers every one of those hashes, the new per-day row included, which keeps them proportionate rather than indefinite; a reaction's hash only lives as long as the reaction does; and the dated tallies keep no hash at all, so there is nothing in them to expire.