Privacy
What happens to your data when you visit a page on this site, open one of its links or sign up through it. In short: visit statistics, no advertising, and your email address only if you choose to give it.
Who is responsible
OuroSoft runs this site and is responsible (the “controller”) for the personal data described here.
For any privacy question or request, email [email protected].
What we collect and why
Visit and click statistics
We count page views and link clicks with Umami, a privacy-focused analytics tool that we host on our own server. When a page loads, your browser fetches Umami's script from our server and reports the page address, the page's title and address name (slug), the page you came from, your screen size, your browser language and which version of the page you saw (for A/B tests). When you open a link, our server reports which link it was (its title), the website it leads to (the domain only), your country, which version of the page you saw, and whether you passed an 18+ confirmation or a sign-up. Our server also sends an event when an 18+ confirmation is shown (age_gate_shown) or confirmed (age_gate_confirmed) and when someone signs up by email (email_signup, with the title of the sign-up box, never your email address). To do that it passes on your browser's user agent, language, the page you came from and your IP address.
Umami doesn't use cookies. It is designed not to store IP addresses: it uses them, with your browser details, to create a pseudonymous visitor ID (a salted hash) and may derive your country, region and city. Events are stored individually in our self-hosted Umami, not only as totals, and are kept until we delete them. A pseudonymous ID is still personal data.
Legal basis: our legitimate interest in knowing how the pages are used (Art. 6(1)(f) GDPR).
Security and availability
Our server uses your IP address in memory to limit how many requests one address can make (for example, 60 link opens a minute). These counters are never written to disk and are cleared when the server restarts. Our application's request logs record the address requested, the host name and the response, not your IP address. The exception is a failed sign-in attempt to the admin area, which logs the IP address for security. Our hosting provider and Cloudflare may keep their own short-term logs, which we don't control. Requests from bots and scrapers are recognised by their user agent and refused. The site is delivered through Cloudflare, which tells our server your country; we use it to show or hide links that are only available in some countries.
Legal basis: our legitimate interest in keeping the service secure and working (Art. 6(1)(f) GDPR).
Email sign-ups
Some links ask for your email address first. If you sign up, we store your email address, which page and sign-up box you used, the wording you saw (its title, small print and button label) as a record of your consent, and the time. We don't store your IP address with it. The page owner uses the address for what the sign-up box describes, for example sending you a newsletter, and can export the list to do so.
Sign-up boxes can also pass your address on to the newsletter service the page owner uses, together with the page and sign-up box you used, the wording you saw and the time, so it can send you what you signed up for. That service handles the address on our behalf (as a processor), and you can unsubscribe from it at any time.
Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by asking us to delete your address; this doesn't affect anything done before.
Cookies
We only set cookies the site needs to work as you'd expect. None are used for advertising or to follow you across websites, and none can be read by scripts on the page.
| Cookie | What it does | Kept for |
|---|---|---|
fl_age_… | Remembers that you confirmed you are 18 or older, for one link. | 14 days |
fl_gate_… | Remembers that you signed up through a sign-up box, so its link stays unlocked. | 14 days |
flv_… | Keeps showing you the same version of a page while its owner compares two versions. | 1 year |
The site's admin area uses a sign-in cookie for the site operator only; visitors never receive it.
Other services
- Umami runs on our own server. Statistics are not shared with Umami's developers or anyone else.
- Our hosting provider runs the server that stores and serves the site, and an off-site backup provider holds encrypted backups of our data, which include email sign-ups. They process this data on our behalf.
- Content from other servers. Link thumbnails, image blocks and any custom code the page owner adds may load from other servers, which then receive your IP address and browser details. Their own privacy policies apply.
- YouTube and Vimeo. When a page shows a video, your browser loads the player straight from YouTube (privacy-enhanced mode, youtube-nocookie.com) or Vimeo (with its “do not track” setting) as the video comes into view. They receive your IP address and browser details, may store data in your browser when the player loads or you play the video, and their own privacy policies apply.
- Cloudflare carries the connection between your browser and our server.
- Websites you open. Links take you to other websites, which have their own privacy policies. They see that you came from this site, and some links add campaign tags (such as utm_source) to the address.
We don't sell your data or use it for advertising.
International transfers
Cloudflare, YouTube (Google) and Vimeo are based in the United States, so your data may be sent there when you load a page that uses them. Their own privacy policies and transfer safeguards apply.
How long we keep it
- Email sign-ups: until you ask us to delete them or the page owner removes them. Deleted addresses also disappear from our backups as older backups are replaced. A copy passed to a newsletter service stays there until you unsubscribe or ask for it to be deleted.
- Statistics: stored as individual events in our self-hosted Umami and kept until we delete them. We haven't set an automatic deletion period.
- Backups: follow our server's backup schedule; older backups are replaced over time.
- Rate-limit counters: in memory only, until the server restarts.
- Cookies: as listed above. You can delete them in your browser at any time.
Your rights
You can ask for a copy of the personal data we hold about you, have it corrected or deleted, restrict how we use it, receive it in a portable format, and object to processing based on our legitimate interest. Where we rely on your consent, you can withdraw it at any time. To do any of this, email [email protected].
You also have the right to complain to a data protection supervisory authority, for example the one in the country where you live or work.
Contact
OuroSoft. Privacy requests: [email protected]