privacy.md

• guestbook: the name/handle and message you type, plus a timestamp. shown publicly on the guestbook page. don't post personal info you don't want public, i can't unsee it and neither can anyone else. stored until you ask me to remove it, or i remove it for being spam. every post runs through a moderation check first (see third_parties.txt below); anything it flags as hate/slurs/threats is held out of public view until i look at it, and i keep a short note of why it was held next to the entry.
• which site sent you here: once per browser session, your browser tells me the hostname of the page you clicked the link on, and i add one to a counter for that name. "reddit.com, 40 sessions" and nothing else. the path, the query string and any search terms in it are thrown away before anything is written, so what's stored can say a link on reddit works and can never say who followed it or what they searched for. arriving with no referring site at all, which is what typing the address or opening a bookmark looks like, counts under "direct". there is no row per visitor and nothing joins these counters to the hashed IP below or to anything else on this page.
• guestbook reactions: tapping one of the four emoji under an entry stores which entry, which emoji, and the scrambled version of your IP described in the window below. that's the whole row: no name, no message, nothing else about you. it exists so a count reads as one per person instead of one per click, and it's deleted the moment you tap the same emoji again to take the reaction back off, or when the entry it sits under is removed.
• a maparts account, if you choose to make one: the display name you pick and your password, the password only ever as a scrypt hash with its own random salt, never as the password itself. an account exists so the collection and wishlist you build on /maparts follow you between browsers, and those are stored as nothing more than which map ids you marked and the date you marked them. if you also use the mod, you can generate a one time code on your account page and type it in game, which binds your Minecraft UUID and name to the account so the mod's tracker can fill your collection for you. that link is optional and the account works without it, never knowing anything about your game identity. all of this lives in the maparts backend, not this site's own database. nobody needs an account to read the wall, play anything, or post here, and asking me deletes the whole thing.
• contact form: your name, the contact handle you give me, and your message, plus a timestamp. not public. i only use it to reply to your message. deleted once i no longer need it to respond to you.
• playground leaderboards: if you save a score, the nick you type, the score, the accuracy where the game has one, and a timestamp. the nick and score are shown publicly on that game's board, so pick a nick accordingly.
• a scrambled version of your IP, on a leaderboard row you saved, and also just from loading the site once. it gets its own window below, because burying that in a footnote would be exactly the kind of thing this page exists to not do.
• counters: how many visits, how many runs each game has seen, the running total behind the average under each board, and a separate count of people who spent at least 30 seconds on /maparts specifically. the game and visit totals are plain numbers with nothing attached; telling one visitor from another to keep those counts honest is what the scrambled IP above is for.
• maparts suggestions and reports: suggesting a category or reporting an image on /maparts sends only that image's id and your pick, nothing about you. it goes to a small backend i run for maparts specifically, not this site's own database, and not anyone else's hands either.
• ads on the mapart wall: the ads on /maparts and /advertise are sold and entered by me by hand. there is no ad network, no third-party ad script, and nothing on those pages talks to anyone but this site. what gets counted is how many times an ad was shown and how many times it was clicked, stored as a daily total per ad. a click also writes one row with the day and a scrambled version of your IP, described in the window below, so one person clicking the same ad twenty times does not read as twenty interested people. those click rows are deleted after 90 days; the daily totals stay. advertisers see numbers only, never anything about who you are, and nothing about your visit follows you to another site.

a handful of things need to tell one visitor from another: a leaderboard, so beating your own score updates your row instead of stacking a second one, the site-wide visit counter, so refreshing the page doesn't count as a new person, the maparts engaged-visit count, so a bounce doesn't count as a stay, and a guestbook reaction, so one person tapping an emoji counts once. they all use the same marker. here's exactly what it is.

• your raw IP is never written to the database. what's stored is an HMAC-SHA256 hash of it, salted with a secret kept outside the database. someone who walks off with the database file can't turn those back into addresses without also stealing the salt.
• it's still a stable marker pointing at you, so i treat it as your data rather than as anonymous noise. you can ask me to delete it.
• on a leaderboard, it's only written when you save a score. playing, or just reading a board, stores nothing. loading a board works the hash out in memory to highlight your own row, then forgets it.
• for the site-wide visit counter, it's written the first time you load any page in a browser session, purely to decide whether this is a new visitor or a repeat one. nothing else is attached to it, and it's never shown anywhere, unlike a leaderboard row.
• for the maparts engaged-visit count, your browser starts a 30 second timer when you land on /maparts. leaving before that never writes anything, so a page you bounced off of is never counted. staying past 30 seconds writes the same kind of hash, once per browser session, purely to avoid counting one visitor twice.
• for a guestbook reaction, it's written next to the entry id and the emoji at the moment you tap one, and deleted again the moment you untap it. that pair is also what lets the page light up the reactions you already left: loading the guestbook works the hash out in memory, marks your own taps, then forgets it, the same as loading a leaderboard.
• for an ad click on /maparts, the same kind of hash is written next to the ad's id and the day. it exists so repeat clicks from one person are visible as repeats. loading a page with an ad on it writes no hash at all: an impression is counted as a bare number.
• both counters' copies of the hash are kept at most 400 days, then deleted automatically. if you come back after that, you're counted as a new visitor again, the same as if you'd never been seen. this cap is the whole reason a hash is used here instead of your raw IP staying around forever.
• the rate limiter keeps your IP in memory briefly to count requests. it expires on its own and never hits disk.
• server software may temporarily log IPs as part of normal operation and basic security.

• no analytics product, no third-party ad scripts, no fingerprinting, and no cookies for anything you do as a plain visitor. nothing here loads Google Analytics or anything like it, and no third party is handed your visit. the closest thing i keep is the plain per-site counter described above, which lives in my own database and holds hostnames and numbers, not people. two exceptions, and both only ever happen if you type a password: logging into the maparts admin panel, which is mine alone, and logging into a maparts account, which would be yours. each sets one random session token in a cookie your own javascript can't read and that can't ride along from another site (httpOnly, SameSite=Strict); the account one expires after seven days, and logging out deletes it on both ends. the footer joke stays load-bearing for everyone who never types a password.
• nothing is sold, shared, or handed to anybody for money. there is no "partner". it's one person and a small server.
• the only login on this site is the optional maparts account. nothing else here has one, and reading, playing, signing the guestbook and reacting to an entry all work without ever telling me who you are.

this never reaches the server. it sits in your own browser, and clearing your browser data deletes it.

• sessionStorage: one flag, so the visit counter counts you once per session instead of once per page load.
• localStorage: your best times and scores, how many captchas you've "passed", how long the existential timer has been running, the maze tilt setting, whether you dismissed the cat, your playground wallpaper pick, and anything you type into the notes app in the playground. that notes text stays on your device. i never see it.

a short list, and none of them get an account, a cookie, or a cent.

• discord webhook: sending the contact form, or posting in the guestbook, pings my discord so i notice faster. that ping carries what you typed (name and message), so your text reaches discord as well as me. it doesn't carry your IP.
• AI moderation: to keep the guestbook from being a slur dumpster, the name and message you post are sent to two moderation services, Mistral (EU-based) and Groq (US-based), which score whether the text is hate speech, threats, and so on. only that text goes out, nothing about who you are, no IP. i send it because the plain word filter got walked straight past by people spacing out slurs. sending text to Groq means it briefly leaves the EU; it's covered by Groq's own standard data protection terms, and no reply from either service is stored, only the flagged/not-flagged result. if both services are unreachable the post is held rather than shown, so an outage can't wave something through.
• lanyard: the home page shows whether i'm online, and your browser fetches that from api.lanyard.rest itself, about once a minute while the page is open. it deliberately sends nothing about you, but any request your browser makes shows that service your IP and user agent, same as visiting any site. home page only. blocking the domain, or not sitting on the home page, stops it.

under GDPR (RODO if you're Polish like me) you can ask what data of yours i have, ask me to fix it, ask me to delete it, or complain to your country's data protection authority (in Poland, UODO) if you think i've messed this up. for a site this small the easy version is: message me and tell me which guestbook entry, contact message, leaderboard nick or maparts account is yours, and it's gone. an account takes its collection, its wishlist and any Minecraft link with it.

legal basis: guestbook posts and leaderboard scores are stored because you chose to post them publicly. contact messages are processed because it's necessary to actually reply to you. a maparts account and everything hanging off it exists because you asked for the account, so it's processed to provide the thing you signed up for, and it stops existing when you ask me to delete it. the hashed IP on a leaderboard row, the hashed IP behind the site-wide and maparts visit counters, the hashed IP on a guestbook reaction, the per-site arrival counters, and running guestbook posts through moderation, are all legitimate interest: one row per player, honest visit counts that don't inflate on refresh or bounce, emoji counts that can't be clicked into the ground by one person, knowing which links actually bring people here, and a wall that isn't a slur dumpster. the 400 day cap on both visit-counter hashes keeps those proportionate rather than indefinite, and a reaction's hash only lives as long as the reaction does.