Vika Taylor Privacy policy MMXXVI YouTube

Legal / Privacy

Privacy Policy

Last updated:

1. The short version

These thirteen sites are free, non-commercial examples made for my YouTube videos, and nothing is sold on any of them. They are run by one person, Vika Taylor, based in Kyiv, Ukraine, not by a company, and the only way to reach me is by email.

Loading any page gives Cloudflare, the host, your IP address and basic request details, because that is how the page gets to you at all.

Nothing else runs unless you allow it: Google Analytics, which these sites run through Cloudflare's Zaraz service, starts only after you press Accept, and the YouTube player on eleven of the sites loads only after you press play.

Fonts are served from the site itself, so simply reading a page sends your IP address to nobody but the host.

There are no accounts, no payments, no newsletter, no ads and no trackers, nothing is sold or shared, and you can change your mind at any time with the Cookie settings button.

2. Who runs this site, and how to reach them

These sites are run by Vika Taylor, acting as an individual, from Kyiv, Ukraine. Under the GDPR and equivalent laws, that person is the controller of any personal data described here.

Contact: vika.taylor.one@gmail.com. This is the only contact channel that exists. There is no phone number, no support desk and no form that sends anything to a server: the one contact form in the network, on the KUROGANE demo, only prepares an email in your own email app (section 4.5). No postal address is published. Every request described on this page goes to that address.

Stated plainly, so that nothing is implied that is not true:

The reason is the same in each case: this is one person publishing a portfolio and free examples. The processing described below is small in scale, involves no special categories of data and, apart from delivering the pages, runs only with your consent, so the operator's assessment is that it is unlikely to put your rights at risk and that none of these appointments is required. That assessment is the operator's own. If you think a representative is required in your situation, write to the address above and say so.

3. Which sites this policy covers

Thirteen sites, one policy. They share the same code, the same consent gate and the same operator. All thirteen are free, non-commercial examples of what can be built with AI tools, made for the YouTube channel @VikaTaylor. Nothing is sold on any of them: where a demo site shows a shop, a menu, a checkout or a pricing section, it shows how such a page works, with no prices and no way to buy.

4. What is processed

There are five things to describe. Two happen on every visit, because they are how a page reaches you: hosting and fonts. The other three happen only if you choose them: analytics after you press Accept, the video after you press play, and email when you write to me.

4.1 Hosting and request logs

What. Every one of the thirteen sites is served from Cloudflare Workers static assets. When your browser asks for a page, Cloudflare receives your IP address and the metadata that comes with an HTTP request: which page you asked for, the time, your browser's user-agent string and similar headers. It keeps this in request logs.

Who receives it. Cloudflare, Inc. It acts as a processor, meaning it handles this data to run the service rather than for its own purposes. Its policy: cloudflare.com/privacypolicy.

When. On every single request, before and regardless of consent. This cannot be switched off, because the log entry is created by the act of delivering the page. There is no version of the site that can be served without it.

Legal basis, where the GDPR applies. Legitimate interest, Art. 6(1)(f): operating the site and keeping it secure. Without this the site cannot be delivered at all.

How long. Cloudflare publishes no fixed retention period for this data. Its privacy policy states only that it stores personal information “for a period of time that is consistent with the business purposes set forth in Section 3 of this policy or as long as needed to fulfill and comply with legal obligations”, and lists the factors it weighs rather than a number (Cloudflare Privacy Policy, section 11 Data Retention, read 3 September 2026). So there is no figure to state, and none is invented here. The period is set and applied by Cloudflare, not by me, and a request about it goes to Cloudflare. This paragraph previously held a placeholder promising a number that would be read off the account; naming the absence is more useful than waiting for one that is not published.

4.2 Analytics, and only after you say yes

What. Google Analytics 4, measurement ID G-VFPV5MZNL2, which these sites run through Cloudflare Zaraz, a Cloudflare service that runs tools like this on Cloudflare's servers instead of in your browser. Once it runs, it records which pages you view, the site or search that sent you, the site's own events (for example which video was played or which outside link was followed), how long a page stayed in view, an approximate location, and your device and browser type. It recognises a returning browser by a random ID kept in a cookie (section 5).

Who receives it. Cloudflare, Inc., which runs Zaraz as a processor, the same role it has as the host (cloudflare.com/privacypolicy), and Google, which receives the measurements from Cloudflare's servers (policies.google.com/privacy).

How it works. When you press Accept, the site's own /consent.js starts Zaraz, which is served from the site's own address under /cdn-cgi/zaraz/. Zaraz then sends Cloudflare the address and title of the page, the page that sent you, your screen and window size, colour depth, character set and time-zone offset, any cookies the page's own scripts can read (these sites set none) and the entry Zaraz keeps in your browser (section 5). Cloudflare's servers pass Google the page view, the site's events, your browser's user-agent, your IP address and the random ID. Google uses the IP address to estimate the approximate location and states that Google Analytics 4 does not log or store IP addresses (Google Analytics Help). Your browser makes no request to Google for any of this. After you accept, the site also tells Google, through Zaraz, that analytics is allowed and advertising is not.

When. Only after you press Accept on the consent banner, and only on the site where you pressed it. Before that, and from the moment you press Decline, the page sends nothing to Zaraz, so nothing reaches Google and no analytics cookie is set. This was checked in a browser rather than assumed.

Legal basis, where the GDPR applies. Consent, Art. 6(1)(a), given before anything is measured. You can withdraw it at any moment with the Cookie settings control in the footer of every page, and withdrawing is exactly as easy as giving it. Section 7 says what withdrawing does.

How long. The Google Analytics property keeps user-level data and event data for 14 months, the longer of the two periods Google offers for a standard property. That is the setting in the property itself, as set by the operator and confirmed on 17 September 2026. When the period ends, Google deletes the data automatically. According to Google Analytics Help, the setting does not affect Google's standard aggregated reports.

4.3 Fonts, served from this site

What. Every typeface used anywhere in the network is served from the origin that uses it, including the page you are reading now. This paragraph used to enumerate four families; the enumeration is gone because the sites do not share one type system and the list went stale the moment a site was added. What matters here is not which typefaces they are, but that none of them is fetched from a third party.

Who receives it. Nobody new. No request reaches fonts.googleapis.com or fonts.gstatic.com, so no IP address of yours goes to Google merely because a page uses a typeface. The font files travel over the same connection as the page, which is covered by section 4.1 and by nothing else.

This matters in Germany in particular: a Munich court held that embedding Google Fonts from Google's own servers, which passes the visitor's IP address to Google without consent, infringes the visitor's rights (LG Muenchen I, 20 January 2022, case 3 O 17493/20). Self-hosting is how that is avoided rather than merely disclosed.

4.4 The embedded video, on eleven of the thirteen sites

Eleven sites embed a video: claude-design-vs-lovable-vs-v0, fable-vs-opus, 3d-scroll-prompts, prompt-kurogane, opal, steamquest, mood-palette-generator, moodpalette-prompts, kurogane, fatcat and skystreets. The other two, vikataylor.com itself and globe, have none.

What. What you see before you press play is not a player. It is a still image stored on the site itself. Only when you press play does a script create an <iframe> pointing at www.youtube-nocookie.com.

Who receives it, and when. Until that press, nothing whatsoever is requested from any YouTube or Google host. Once playback starts, YouTube receives your IP address and may store data on your device under its own terms. Next to every video there is also a plain link to youtube.com, which you can use instead: it takes you to YouTube deliberately, with the same effect and none of the ambiguity.

Legal basis, where the GDPR applies. Consent, Art. 6(1)(a), given by the deliberate act of pressing play after being told on the page what pressing play does.

4.5 Email you send me

What. If you write to vika.taylor.one@gmail.com, whether through a mailto: link, through the contact form on the KUROGANE demo or from your own email app, I receive your email address, your name if you give it, and what you write. The contact form on the KUROGANE demo sends nothing itself: it opens your own email app with the message ready and the site's name in the subject, and nothing leaves your device until you press Send there.

Who receives it. Google, which runs the Gmail mailbox, as my email provider. Its policy: policies.google.com/privacy.

Legal basis, where the GDPR applies. Your request to be answered, Art. 6(1)(b), or my legitimate interest in answering the messages people send me, Art. 6(1)(f).

How long. Only as long as needed to answer you and keep track of the conversation. An email is deleted when you ask. It is never added to a mailing list, never used for advertising and never passed on.

5. What is stored on your device

Two kinds of thing. Before you press Accept, and if you decline, only the first kind exists.

Your choice, on each site. Every site keeps your banner choice in localStorage, which belongs to one origin only: a value written by one of these sites cannot be read by another. None of the thirteen sites sets a cookie of its own for this.

What each site writes itself
Origin Key Contents Lifetime
vikataylor.com, steamquest, claude-design vt_consent {choice:'granted'|'denied', ts:<epoch ms>, v:'2026-09-17'}: your choice, when you made it, and the version of this policy you answered 180 days, or until this policy changes in a way that needs a new answer, then you are asked again
claude-design vt-theme 'light' or 'dark' Until you clear it
mood-palette-generator, moodpalette-prompts mp_consent The same shape The same
fable-vs-opus fvo_consent The same shape The same
3d-scroll-prompts p3d_consent The same shape The same
opal opal_consent The same shape The same
kurogane ku_consent The same shape The same
prompt-kurogane pk_consent The same shape The same
skystreets ss_consent The same shape The same
globe gl_consent The same shape The same
fatcat fc_consent The same shape The same

None of this is personal data. A consent record is one word, a timestamp and a version date: it says that somebody using this browser pressed Accept or Decline, and when. It holds no identifier, nothing random and nothing that could single you out. The theme key is a display preference, light or dark.

After Accept only: what Zaraz stores. When you accept, Cloudflare Zaraz sets the three cookies below for vikataylor.com. Because they belong to that parent domain, all thirteen sites share them: your browser sends them with its requests to every one of those sites, as browsers do with cookies, and Google Analytics recognises the same browser on each site where you pressed Accept. They are HttpOnly, so no script on a page can read or delete them. Zaraz also writes one entry to the localStorage of the site where you accepted: _zaraz_google_consent_update, which holds the consent state from section 4.2 (analytics allowed, advertising not) and no identifier.

Cookies set by Cloudflare Zaraz, only after Accept
Name What it holds Lifetime
cfz_google-analytics_v4 The random analytics ID, a session number and engagement counters, which Google Analytics uses to tell visits apart One year
cfzs_google-analytics_v4 A count of page views in the current session Until you close the browser
cf_zaraz_client Zaraz's own working cookie; it was empty each time it was checked One year

These cookies do contain an identifier, which is why they appear only after you press Accept and never before. Names and lifetimes were read in a browser on 17 September 2026; Cloudflare can change them, and this table will follow. Where your choice is Decline, the site's script deletes the _zaraz_ entry, and that site does not run Zaraz, so nothing there reads the cookies; they stay in your browser until they expire or you delete them. The script also deletes what the earlier set-up of these sites could leave behind until September 2026: the cookies _ga, _ga_*, _gid and _gat* and the storage entry _gcl_ls. You can remove everything at any time by clearing cookies and site data for vikataylor.com in your browser.

6. What does not happen

These are absences, not intentions, and they are stated as absences on purpose. They are the strongest thing this document can say.

7. Your rights, and how to use them

Every framework named in this document grants some version of access, correction, deletion, objection and portability. There is one channel for all of them, in every jurisdiction: vika.taylor.one@gmail.com. There is no portal, no form and no ticket number.

What that channel can actually do, and where it cannot:

How long a reply takes. Within the period the law that applies to you sets, and no promise beyond that is made here. Under the GDPR and the UK GDPR that is one month, extendable in the way those laws allow.

Identity checks. There is no verification process, because there is no account to verify you against. If a request would expose somebody else's data, it will be refused with an explanation rather than guessed at.

Cost. Nothing. No fee, and no difference in how the sites work for you afterwards.

8. International transfers

Cloudflare and Google are both headquartered in the United States and both process data outside the EEA and the United Kingdom. That is unavoidable if the sites are to be hosted and, where you allow it, measured.

Both providers state that they rely on the EU-US Data Privacy Framework and its UK extension, and both offer Standard Contractual Clauses as a transfer mechanism. Those are the mechanisms. Their current certification status is deliberately not asserted here as a fact, because it can change and it is not something I can verify continuously. Check it at the source:

If you press play on a video, YouTube receives your IP address, and the same applies to it. If you write to me, your email reaches a Gmail mailbox, and the same applies to Google in that role.

The operator is in Ukraine. Vika Taylor lives and works in Kyiv, outside the EEA and the United Kingdom. The European Commission has not adopted an adequacy decision for Ukraine: its list, read on 17 September 2026, has seventeen entries, and Ukraine is not among them. Personal data reaches the operator in Ukraine in only two ways: as the reports inside the Google Analytics account, after you press Accept, and as any email you choose to send, which arrives in the Gmail mailbox run by Google. Both are read through Google's own services; nothing is copied to a server of mine.

9. Rules that may apply where you live

The facts do not change from country to country: section 4 is the whole of it. What changes is the name of the right, the name of the regulator, and occasionally whether a rule attaches to a site like this one at all. Where it genuinely does not, that is said rather than dressed up.

9.1 European Union: GDPR

The controller is Vika Taylor, contactable at vika.taylor.one@gmail.com. The legal bases are stated next to each activity in section 4: Art. 6(1)(f) for serving and securing the pages, Art. 6(1)(a) for analytics and for the video player, and Art. 6(1)(b) or (f) for email you send. Transfers outside the EEA are covered in section 8.

You have the rights in Arts. 15 to 21: access, rectification, erasure, restriction, portability and objection, plus the right under Art. 7(3) to withdraw consent at any time without it being harder than giving it. Read section 7 before you write, because it says which of these can actually be acted on here and which cannot.

You can lodge a complaint with the supervisory authority in your country of residence, your place of work, or the place of the alleged infringement. The list is at edpb.europa.eu.

No Data Protection Officer and no Art. 27 representative are appointed; section 2 says why. No data protection impact assessment has been carried out, because Art. 35 does not require one for processing of this kind: there is no systematic large-scale monitoring, no special category data and no automated decision-making.

9.2 United Kingdom: UK GDPR and PECR

The UK GDPR gives you the same set of rights as section 9.1, on the same legal bases, through the same email address.

Storing anything on your device in the UK is governed by the Privacy and Electronic Communications Regulations, which require consent for anything that is not strictly necessary. The consent banner is that consent, and the analytics storage in section 5 is the only thing it covers.

Complaints go to the Information Commissioner's Office: ico.org.uk. No UK Art. 27 representative is appointed.

9.3 Germany: TDDDG and the Impressum

In Germany, storing information on your device or reading information from it is governed by s 25 TDDDG, formerly the TTDSG. Consent is required unless the storage is strictly necessary to provide a service you have expressly asked for.

How that maps onto section 5:

The Impressum required by s 5 DDG, where it applies, would be a separate page. It is not published: s 5 DDG requires a postal address at which documents can be served, and the operator has decided not to publish her home address. These sites are free, non-commercial examples with no advertising and no affiliate links. A draft of the page exists with the missing fields shown as visible placeholders in square brackets; it is set to noindex and is linked from no page. The working contact channel is the email address in this document.

Complaints go to the data protection authority of your Land. The federal commissioner keeps the list of them: bfdi.bund.de.

9.4 United States: California (CCPA, CPRA and CalOPPA) and other states

First, the honest part. The CCPA applies to businesses above thresholds this site does not come near: annual gross revenue above 26,625,000 dollars (the figure in force since 1 January 2025), buying, selling or sharing the personal information of 100,000 or more consumers or households, or earning half or more of annual revenue from selling or sharing personal information. These sites are free and earn nothing, so none of those is met, and the statute very probably does not attach at all. The disclosures below are made anyway, because the underlying facts are short and you should not have to work out first whether you are entitled to ask.

Categories of personal information collected in the last twelve months: identifiers, limited to an IP address, a random analytics ID if you press Accept and, only if you write to me, your email address and name; internet or other electronic network activity, meaning the pages you viewed and what referred you; approximate geolocation derived from that IP address; device information, meaning your browser and device type; and, only if you write to me, what your email says. No other category is collected. No sensitive personal information is collected at all.

Where it comes from: from you, directly, by loading a page or by writing to me.

Why: to serve and secure the sites, to answer your email, and, if you press Accept, to see which content people read.

Who it is disclosed to: Cloudflare, for hosting and, after Accept, for running the analytics tool; Google, for analytics, only after Accept, and as the provider of the mailbox that receives your email; YouTube, only if you press play on a video.

Nothing is sold and nothing is shared. Not in the last twelve months and not at any other time, using those two words exactly as the CCPA and the CPRA define them, which includes disclosure for cross-context behavioural advertising. There is therefore no "Do Not Sell or Share My Personal Information" link on these sites: there is no such disclosure to opt out of, and adding the link would suggest otherwise.

The right to limit the use of sensitive personal information does not arise here, because no sensitive personal information is collected. Nothing is being withheld behind that sentence.

You have the rights to know, to delete, to correct, and not to be discriminated against for asking. There is no price, no account and no service tier, so there is nothing to discriminate with, and no financial incentive programme exists. An authorised agent can write on your behalf to the same address. Note the limit in section 7: with no account, a request often cannot be matched to one person's data rather than another's.

Global Privacy Control. Because nothing is sold or shared, a Global Privacy Control signal from your browser has nothing to switch off here. Analytics stays off until you press Accept, whether or not your browser sends that signal.

Do Not Track, and other parties. A browser's Do Not Track signal changes nothing here, because nothing that could follow you across sites runs before you choose it: analytics loads only after you press Accept, and the video player only after you press play. Once you do, Google, through Google Analytics, and YouTube may collect information about your activity over time and across different websites, under their own policies.

Other US states. Several other states, among them Virginia, Colorado, Connecticut and Texas, have privacy laws with similar rights. Requests under any of them go to the same address and get the same answer as above.

9.5 Canada: PIPEDA

PIPEDA covers personal information collected in the course of commercial activity. These sites sell nothing and carry no advertising, so it is doubtful that the Act attaches to them. The substance is the same either way.

Consent is meaningful and given in advance: analytics loads only after you press Accept, which is express opt-in rather than an assumption. You can withdraw it at any time. Requests for access to, or correction of, personal information go to vika.taylor.one@gmail.com, subject to the limits in section 7.

If you are not satisfied, the Office of the Privacy Commissioner of Canada takes complaints: priv.gc.ca.

9.6 Brazil: LGPD

Under the LGPD, Vika Taylor is the controller. The legal bases map onto Art. 7: legitimate interest for hosting and request logs, consent for analytics and for the video player.

Art. 18 gives you confirmation that processing occurs, access, correction, anonymisation or deletion of unnecessary data, portability, information about who data has been shared with, and revocation of consent. Section 7 explains which of these are substantive here and which are formalities, given how little exists.

No encarregado has been appointed. The email address at the top of this page is the channel for LGPD requests, and it is read by the controller personally.

The supervisory authority is the ANPD, the Autoridade Nacional de Proteção de Dados: gov.br/anpd.

9.7 India: Digital Personal Data Protection Act 2023

Under the DPDP Act, Vika Taylor is the Data Fiduciary and you are the Data Principal. The Act is being brought into force through rules made under it, so what follows describes how these sites are set up rather than making a claim about the current commencement of every section.

Analytics runs on consent, which is what the Act requires, and the notice you are reading is what accompanies it. You have the right to a summary of the personal data processed, to correction and erasure, to grievance redressal, and to nominate somebody to exercise your rights.

Grievances go to vika.taylor.one@gmail.com. There is no registered Consent Manager and no Data Protection Officer, because neither is required of a fiduciary of this kind: these sites have not been designated a Significant Data Fiduciary. If a grievance is not resolved, the route is the Data Protection Board of India.

On children, the Act sets the threshold at eighteen and requires verifiable parental consent below it, along with a prohibition on tracking and on behavioural advertising directed at children. No personal data is knowingly collected from children, no behavioural advertising exists on any of these sites, and analytics stays off until somebody actively presses Accept. See section 10.

9.8 Japan: APPI

Under the APPI, the purpose of use is stated plainly: operating and securing the sites, and, with your consent, measuring which content is read. It is not used for anything else, and it is not used to build a profile.

Transfer of personal data to a third party in a foreign country needs your consent, and that is exactly what the Accept button is. Nothing goes to Google before you press it. Cloudflare's role is that of a contractor handling data in order to run the hosting and, after you press Accept, the analytics tool.

You may request disclosure, correction, suspension of use, and disclosure of the records of third-party provision, through the address at the top of this page. Section 7 is the honest limit: with no account, there is often nothing that can be identified as yours to disclose.

The supervisory body is the Personal Information Protection Commission: ppc.go.jp.

9.9 South Korea: PIPA

PIPA is built on consent, and consent here is opt-in and specific. The items are those in section 4.2, the purpose is understanding which content is read, and the retention is the setting named in that section. Nothing is provided to a third party beyond what section 4 lists, and nothing is provided for marketing.

You have the right to access your personal information, to correct or delete it, and to suspend its processing, through the address at the top of this page, with the limits in section 7.

No domestic representative in Korea is appointed. PIPA requires one only of overseas operators above set size thresholds; this is one person's portfolio and a set of free resources.

Complaints and mediation go to the Personal Information Protection Commission: pipc.go.kr.

9.10 Indonesia: PDP Law

Under Law No. 27 of 2022 on Personal Data Protection, Vika Taylor is the personal data controller and Cloudflare is a processor.

Analytics runs on your consent, given before anything loads and withdrawable at any time. You have the rights to information about the processing, to access, to correction, to erasure, and to withdraw consent. The right to object to automated decision-making has nothing to bite on here: no automated decision-making takes place, as section 6 says.

Requests go to vika.taylor.one@gmail.com. No local representative in Indonesia is appointed. The supervisory authority provided for by that law is the route for complaints once it is operating.

9.11 Middle East: Saudi PDPL, UAE PDPL and neighbours

Requirements differ sharply from one jurisdiction to the next in this region, and this section makes no claim to cover all of them.

The two main national laws are the Saudi Personal Data Protection Law, overseen by SDAIA, and the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. Both give you, in broad terms, the right to be informed, to access your data, to have it corrected, to have it deleted, and to withdraw consent. All of those go through the address at the top of this page.

Some free zones run their own separate regimes, including the DIFC and the ADGM, with their own regulators and their own procedures.

Nothing is claimed here about local registration, licensing or a local representative in any Middle East jurisdiction. None has been obtained, and none is asserted. If a specific requirement applies to your situation, write and say which one.

9.12 Ukraine: Law on Personal Data Protection

The operator lives and works in Ukraine, so Ukrainian law may apply as well: the Law of Ukraine No. 2297-VI “On Personal Data Protection” of 1 June 2010. Its Article 8 gives you, among other rights, the right to know where your personal data comes from, why it is processed and who processes it; to access it, and to receive an answer within thirty calendar days on whether it is processed and what it contains; to object to the processing; to ask for your data to be changed or destroyed if it is processed unlawfully or is inaccurate; to withdraw your consent; and to complain about the processing to the Ukrainian Parliament Commissioner for Human Rights or to a court. All requests go to vika.taylor.one@gmail.com, with the limits described in section 7.

Compliance with that law is overseen by the Ukrainian Parliament Commissioner for Human Rights, the Ombudsman, and by the courts: ombudsman.gov.ua.

Ukraine is preparing a new data protection law aligned with the GDPR, draft law No. 8153. It was adopted in first reading on 20 November 2024, and on 17 September 2026 the Verkhovna Rada listed it as being prepared for second reading. This section will be updated when a new law takes effect.

10. Children

None of these sites is directed at children, and no personal data is knowingly collected from them. There is no account to create and no form that sends anything to a server, so there is no way for a child to submit anything through the sites.

Because analytics is off until somebody presses Accept, a child who visits and does not press it is not measured at all.

The age threshold differs by country: thirteen under COPPA in the United States, between thirteen and sixteen depending on the member state under Art. 8 of the GDPR, eighteen under India's DPDP Act. No age verification exists on these sites, for the same reason there is no login: there is nothing to attach it to.

If you believe a child's personal data has reached me, write to vika.taylor.one@gmail.com and it will be deleted.

11. Changes to this policy

The date at the top of this page changes whenever the text does. This version is dated .

There is no mailing list, so there is no way to notify you of a change, and none is promised. Consent is in any case asked again every 180 days, and at once when a change affects what is collected, because each stored choice records the version of this policy it answered (section 5).

12. Language versions

This English version is the authoritative one. The German, French, Spanish and Portuguese versions are translations provided for convenience. If a translation and this page ever disagree, this page is the one that applies.

Related documents: Terms of Use, Cookie Notice. The Impressum (German) is not published; see section 9.3.