Privacy Policy

When you visit a shared page, a random anonymous identifier (a visitor_id cookie) is set in your browser. This cookie:

• Is a randomly generated string (no personal information)
• Is HttpOnly (not accessible via JavaScript)
• Expires after 30 days
• Is used solely to distinguish unique visitors for analytics and rate limiting

Every visit to a shared page or article is recorded so the content admin can replay it later. The recording is a snapshot of the page's DOM followed by its changes over time, captured with the open-source rrweb library. It includes:

• Mouse movement, scrolling, clicks and taps with their position on the page
• Which parts of the page were visible and for how long
• Image clicks, video play / pause / seek / progress / fullscreen, and outbound link clicks
• Text typed into the page — inputs are not masked, so anything entered in the comment form (name, email, comment text) is part of the recording even if you never submit it

Alongside the recording, each visit stores:

• Your IP address and browser user agent
• Screen size, viewport size, device pixel ratio and browser language
• The referring page, if any
• An approximate location (country, region and city) derived from your IP address through a third-party lookup service (ip.sb). The IP is sent to that service once per new address.
• Visit start time, total duration and event counts

If you post a comment on an article, the name, optional email and comment text you submit are stored and the name and text are shown publicly on the article. The email is visible only to the admin. A short arithmetic challenge protects the form; it is verified on the server and stores nothing about you.

• No login or account information for visitors
• No browsing history outside of this site
• No advertising identifiers and no cross-site tracking

The data is used solely by the content admin to understand how shared content is read: aggregated statistics, click heatmaps and individual session replays in a private analytics dashboard. It is not sold or shared with anyone else.

Recordings, events and session metadata are kept until the admin deletes the shared content they belong to; there is no automatic expiry. This is a personal small-scale tool. Contact the person who shared the link if you want a visit removed.

• Cloudflare Turnstile may run a bot check before a shared page opens; Cloudflare processes your request under its own privacy policy.
• ip.sb receives your IP address for the approximate-location lookup described above.
• Images and videos may be served from an object storage or CDN provider chosen by the admin, which sees the usual request metadata (IP address, user agent) when your browser loads them.
• No Google Analytics, Facebook Pixel or similar third-party ad tracking is used.