what this site collects, and why it's barely anything

last updated: 31 october 2026

the short version

This is a personal site run by one person. There are no accounts, no ad networks, and no analytics cookies. The only things stored on the site are what you type into the guestbook and a few anonymous numbers about page visits. The "here now" list isn't stored at all — it exists only while someone has a tab open. Contact messages are sent to Discord and are not kept in the site's database.

what gets collected

guestbook. If you post a message or a reply, I store the name you enter (or nothing, if you tick anonymous), the text, and the time it was posted. Names and messages are public, so they show up on the homepage for anyone to read.

contact form. If you use the contact form, I get the name, contact, topic and message you enter. It is sent to my Discord through a webhook and is not stored in this site's database. The form also uses a short in-memory IP-based rate limit to stop spam; the IP is not saved.

analytics. Each page view logs the page path, the site that referred you, your device type (desktop, tablet, mobile), a country code, and which external links or projects get clicked. The country comes from a lookup of your IP address, and the IP itself is not saved. These events have no identifiers tying them to you.

security. Failed vault passcode attempts are rate-limited. For that check the server stores a one-way hash of the requesting IP for up to a day; the raw IP is not saved and the hash is not used for anything else.

visit counter. A number in your browser and a matching total on the server keep track of how many pages have been opened. It isn't linked to a person.

widgets. The Discord, Last.fm, Roblox, weather and music widgets ask their public APIs for data. Those requests come from your browser, so those services see your IP address the same way any website would.

here now. While the site is open, your browser tells the other people on it that someone is here, and if your mouse is moving, roughly where it is on the page. That's the coloured "visitor" arrow you might see following someone else around. It only shows up for people looking at the same page as you.

The same connection carries a few smaller things: a ring where someone clicks, a wave button that pings everyone on your page, and a short line of text if they press / or tap the … button and type one. Messages are capped at 40 characters, checked for slurs and swearing before they leave the browser, and shown for a few seconds next to that person's cursor. The little "visitor" chips also say which page each person is on when you hover them.

None of that gets written down. It goes through a live connection to Supabase and disappears the moment you close the tab — there is no table of cursor positions or messages, and I can't look up where anyone was pointing five minutes ago.

stored in your browser

Small settings live in your browser instead of on a server: the background and the light or dark mode you picked are kept in localStorage, a random tab id and a note that you've entered this session live in sessionStorage, and the vault unlock state stays on your own device. One more localStorage flag remembers whether you switched on invisible mode, and another counts how many times this browser has visited. None of it leaves your browser.

what I don't do

• No analytics or tracking cookies.
• No selling, renting or sharing data with advertisers.
• No profiles of individual visitors.
• No recording of where you move your mouse. The live cursor is passed along for a second or two and never saved.
• No passwords or payment details.
• Contact details are only sent to Discord, not stored on this site.

who else is involved

Vercel hosts the site and keeps standard request logs for security and abuse. Supabase stores the guestbook and analytics rows and carries the live "here now" connection. Discord receives guestbook notifications and contact messages. ipapi.co turns an IP into a country code before it gets discarded. Widget providers are listed above. Each of them handles data under their own policies.

how long it sticks around

Guestbook messages stay until I remove them. Contact messages sit in Discord until I delete them; the site itself doesn't keep a copy. Analytics events are kept for general stats and cleaned up now and then. Server logs follow the host's own retention window.

your choices

invisible mode. The eye button next to the background switch makes you invisible: your cursor, clicks and messages stop being sent, and other people's stop showing up for you. Turn it off and you're back in the room.

You can clear everything stored in your browser by clearing site data for this domain. If you want a guestbook post or a contact message deleted, or want to ask what's held about you, message me on Discord or use the contact page.

changes

If what I collect changes, this page changes with it. The date at the top always shows the current version.

contact

Use the contact page or Discord (collusionz). Either one reaches me.