Legal / Privacy

Privacy Policy

Last updated:

1. The short version

This site is run by one person, Vika Taylor, not a company, and the only way to reach me is by email.

Loading any page gives Cloudflare, the host, your IP address and basic request details, because that is how the page gets to you at all.

Nothing else runs unless you allow it: Google Analytics loads only after you press Accept, and the YouTube player on three of the sites loads only after you press play.

Fonts are served from the site itself, so simply reading a page sends your IP address to nobody but the host.

There are no accounts, no payments, no newsletter, no ads and no trackers, nothing is sold or shared, and you can change your mind at any time with the Cookie settings button.

Two values on this page are not filled in yet. They appear in square brackets in section 4. Both are retention periods held by the providers rather than by me, and neither will be guessed at here.

2. Who runs this site, and how to reach them

These sites are run by Vika Taylor, acting as an individual. Under the GDPR and equivalent laws, that person is the controller of any personal data described here.

Contact: vika.taylor.one@gmail.com. This is the only contact channel that exists. There is no contact form, no phone number and no support desk. Every request described on this page goes to that address.

Stated plainly, so that nothing is implied that is not true:

The reason is the same in each case: this is one person publishing a portfolio and free resources. There is no organisation behind it to appoint anybody through, and there is no processing here that would call for it. If you think a representative is required in your situation, write to the address above and say so.

3. Which sites this policy covers

Seven sites, one policy. They share the same code, the same consent gate and the same operator.

4. What is processed

There are exactly four things to describe. Three of them are ordinary web plumbing, and the fourth only happens if you ask for it.

4.1 Hosting and request logs

What. Every one of the seven sites is served from Cloudflare Workers static assets. When your browser asks for a page, Cloudflare receives your IP address and the metadata that comes with an HTTP request: which page you asked for, the time, your browser's user-agent string and similar headers. It keeps this in request logs.

Who receives it. Cloudflare, Inc. It acts as a processor, meaning it handles this data to run the service rather than for its own purposes. Its policy: cloudflare.com/privacypolicy.

When. On every single request, before and regardless of consent. This cannot be switched off, because the log entry is created by the act of delivering the page. There is no version of the site that can be served without it.

Legal basis, where the GDPR applies. Legitimate interest, Art. 6(1)(f): operating the site and keeping it secure. Without this the site cannot be delivered at all.

How long. [Cloudflare request log retention period: to be filled in from the Cloudflare account settings]. The period is set and applied by Cloudflare, not by me, and no figure will be stated here until it has been read off the account.

4.2 Analytics, and only after you say yes

What. Google Analytics 4, measurement ID G-VFPV5MZNL2. If it runs, it records which pages you view, the site or search that sent you, your approximate location, and your device and browser type, and it stores its own identifiers on your device. Your IP address is not kept in any stored form: Google Analytics 4 does not log or store IP addresses at all, so that protection is unconditional rather than something we switch on. The old anonymize_ip parameter is deliberately not passed; it belongs to Universal Analytics, GA4 ignores it, and sending it would imply a switch on our side that does not exist.

Who receives it. Google. Its policy: policies.google.com/privacy.

When. Only after you press Accept on the consent banner. gtag.js is not in the head of any page on any of the seven sites; it is injected by /consent.js after that press and at no other moment. Before it, zero requests reach googletagmanager.com or google-analytics.com. This was checked in a browser rather than assumed. If you press Decline, nothing is loaded at all, so there is nothing left to switch off afterwards.

Legal basis, where the GDPR applies. Consent, Art. 6(1)(a), taken before anything loads. You can withdraw it at any moment with the Cookie settings control in the footer of every page, and withdrawing is exactly as easy as giving it.

How long. [Google Analytics data retention setting: to be filled in from the GA4 property]. Google's default is not asserted here as a fact about this property, because it has not been verified.

4.3 Fonts, served from this site

What. Across the seven sites the typefaces are Bodoni Moda, Space Grotesk, Fraunces and JetBrains Mono. Every one of them is served from the origin that uses it, including the page you are reading now.

Who receives it. Nobody new. No request reaches fonts.googleapis.com or fonts.gstatic.com, so no IP address of yours goes to Google merely because a page uses a typeface. The font files travel over the same connection as the page, which is covered by section 4.1 and by nothing else.

This matters in Germany in particular: a Munich court held that embedding Google Fonts from Google's own servers, which passes the visitor's IP address to Google without consent, infringes the visitor's rights (LG Muenchen I, 20 January 2022, case 3 O 17493/20). Self-hosting is how that is avoided rather than merely disclosed.

4.4 The embedded video, on three of the seven sites

Three sites embed a video: claude-design-vs-lovable-vs-v0, fable-vs-opus and 3d-scroll-prompts. The other four have none.

What. What you see before you press play is not a player. It is a still image stored on the site itself. Only when you press play does a script create an <iframe> pointing at www.youtube-nocookie.com.

Who receives it, and when. Until that press, nothing whatsoever is requested from any YouTube or Google host. Once playback starts, YouTube receives your IP address and may store data on your device under its own terms. Next to every video there is also a plain link to youtube.com, which you can use instead: it takes you to YouTube deliberately, with the same effect and none of the ambiguity.

Legal basis, where the GDPR applies. Consent, Art. 6(1)(a), given by the deliberate act of pressing play after being told on the page what pressing play does.

5. What is stored on your device

None of the seven sites sets a cookie of its own. What they use is localStorage, which is per origin and is not shared between subdomains: a value written by one of these sites cannot be read by another.

Everything these sites write to your device
Origin Key Contents Lifetime
vikataylor.com, steamquest vt_consent {choice:'granted'|'denied', ts:<epoch ms>} 180 days, then you are asked again
claude-design vt_consent The same: your choice and the moment you made it 180 days
claude-design vt-theme 'light' or 'dark' Until you clear it
mood-palette-generator, moodpalette-prompts mp_consent The same shape: your choice and the moment you made it 180 days
fable-vs-opus fvo_consent The same shape: your choice and the moment you made it 180 days
3d-scroll-prompts p3d_consent The same shape: your choice and the moment you made it 180 days

None of this is personal data. A consent record is one word and one timestamp: it says that somebody using this browser pressed Accept or Decline, and when. It holds no identifier, nothing random, nothing that could single you out and nothing that could be matched against anything else. The theme key is a display preference, light or dark. Read the whole of it and you learn that a browser prefers dark mode.

Google Analytics does set storage of its own, and that storage does contain an identifier. It appears only after you press Accept, and never before. You can remove all of it by clearing site data for the origin in your browser.

6. What does not happen

These are absences, not intentions, and they are stated as absences on purpose. They are the strongest thing this document can say.

7. Your rights, and how to use them

Every framework named in this document grants some version of access, correction, deletion, objection and portability. There is one channel for all of them, in every jurisdiction: vika.taylor.one@gmail.com. There is no portal, no form and no ticket number.

What that channel can actually do, and where it cannot:

How long a reply takes. Within the period the law that applies to you sets, and no promise beyond that is made here. Under the GDPR and the UK GDPR that is one month, extendable in the way those laws allow.

Identity checks. There is no verification process, because there is no account to verify you against. If a request would expose somebody else's data, it will be refused with an explanation rather than guessed at.

Cost. Nothing. No fee, and no difference in how the sites work for you afterwards.

8. International transfers

Cloudflare and Google are both headquartered in the United States and both process data outside the EEA and the United Kingdom. That is unavoidable if the sites are to be hosted and, where you allow it, measured.

Both providers state that they rely on the EU-US Data Privacy Framework and its UK extension, and both offer Standard Contractual Clauses as a transfer mechanism. Those are the mechanisms. Their current certification status is deliberately not asserted here as a fact, because it can change and it is not something I can verify continuously. Check it at the source:

If you press play on a video, YouTube receives your IP address, and the same applies to it.

9. Rules that may apply where you live

The facts do not change from country to country: section 4 is the whole of it. What changes is the name of the right, the name of the regulator, and occasionally whether a rule attaches to a site like this one at all. Where it genuinely does not, that is said rather than dressed up.

9.1 European Union: GDPR

The controller is Vika Taylor, contactable at vika.taylor.one@gmail.com. The legal bases are stated next to each activity in section 4: Art. 6(1)(f) for serving and securing the pages, Art. 6(1)(a) for analytics and for the video player. Transfers outside the EEA are covered in section 8.

You have the rights in Arts. 15 to 21: access, rectification, erasure, restriction, portability and objection, plus the right under Art. 7(3) to withdraw consent at any time without it being harder than giving it. Read section 7 before you write, because it says which of these can actually be acted on here and which cannot.

You can lodge a complaint with the supervisory authority in your country of residence, your place of work, or the place of the alleged infringement. The list is at edpb.europa.eu.

No Data Protection Officer and no Art. 27 representative are appointed; section 2 says why. No data protection impact assessment has been carried out, because Art. 35 does not require one for processing of this kind: there is no systematic large-scale monitoring, no special category data and no automated decision-making.

9.2 United Kingdom: UK GDPR and PECR

The UK GDPR gives you the same set of rights as section 9.1, on the same legal bases, through the same email address.

Storing anything on your device in the UK is governed by the Privacy and Electronic Communications Regulations, which require consent for anything that is not strictly necessary. The consent banner is that consent, and the analytics storage in section 5 is the only thing it covers.

Complaints go to the Information Commissioner's Office: ico.org.uk. No UK Art. 27 representative is appointed.

9.3 Germany: TDDDG and the Impressum

In Germany, storing information on your device or reading information from it is governed by s 25 TDDDG, formerly the TTDSG. Consent is required unless the storage is strictly necessary to provide a service you have expressly asked for.

How that maps onto section 5:

The Impressum required by s 5 DDG is a separate page: Impressum.

Complaints go to the data protection authority of your Land. The federal commissioner keeps the list of them: bfdi.bund.de.

9.4 California: CCPA and CPRA

First, the honest part. The CCPA applies to businesses above thresholds this site does not come near: annual revenue over 25 million dollars, personal information of 100,000 or more consumers or households, or half of revenue from selling personal information. None of those is met, so the statute very probably does not attach at all. The disclosures below are made anyway, because the underlying facts are short and you should not have to work out first whether you are entitled to ask.

Categories of personal information collected in the last twelve months: identifiers, limited to an IP address; internet or other electronic network activity, meaning the pages you viewed and what referred you; approximate geolocation derived from that IP address; and device information, meaning your browser and device type. No other category is collected. No sensitive personal information is collected at all.

Where it comes from: from you, directly, by loading a page.

Why: to serve and secure the sites, and, if you press Accept, to see which content people read.

Who it is disclosed to: Cloudflare, for hosting; Google, for analytics, and only after Accept; YouTube, only if you press play on a video.

Nothing is sold and nothing is shared. Not in the last twelve months and not at any other time, using those two words exactly as the CCPA and the CPRA define them, which includes disclosure for cross-context behavioural advertising. There is therefore no "Do Not Sell or Share My Personal Information" link on these sites: there is no such disclosure to opt out of, and adding the link would suggest otherwise.

The right to limit the use of sensitive personal information does not arise here, because no sensitive personal information is collected. Nothing is being withheld behind that sentence.

You have the rights to know, to delete, to correct, and not to be discriminated against for asking. There is no price, no account and no service tier, so there is nothing to discriminate with, and no financial incentive programme exists. An authorised agent can write on your behalf to the same address. Note the limit in section 7: with no account, a request often cannot be matched to one person's data rather than another's.

9.5 Canada: PIPEDA

PIPEDA covers personal information collected in the course of commercial activity. These sites sell nothing and carry no advertising, so it is doubtful that the Act attaches to them. The substance is the same either way.

Consent is meaningful and given in advance: analytics loads only after you press Accept, which is express opt-in rather than an assumption. You can withdraw it at any time. Requests for access to, or correction of, personal information go to vika.taylor.one@gmail.com, subject to the limits in section 7.

If you are not satisfied, the Office of the Privacy Commissioner of Canada takes complaints: priv.gc.ca.

9.6 Brazil: LGPD

Under the LGPD, Vika Taylor is the controller. The legal bases map onto Art. 7: legitimate interest for hosting and request logs, consent for analytics and for the video player.

Art. 18 gives you confirmation that processing occurs, access, correction, anonymisation or deletion of unnecessary data, portability, information about who data has been shared with, and revocation of consent. Section 7 explains which of these are substantive here and which are formalities, given how little exists.

No encarregado has been appointed. The email address at the top of this page is the channel for LGPD requests, and it is read by the controller personally.

The supervisory authority is the ANPD, the Autoridade Nacional de Proteção de Dados: gov.br/anpd.

9.7 India: Digital Personal Data Protection Act 2023

Under the DPDP Act, Vika Taylor is the Data Fiduciary and you are the Data Principal. The Act is being brought into force through rules made under it, so what follows describes how these sites are set up rather than making a claim about the current commencement of every section.

Analytics runs on consent, which is what the Act requires, and the notice you are reading is what accompanies it. You have the right to a summary of the personal data processed, to correction and erasure, to grievance redressal, and to nominate somebody to exercise your rights.

Grievances go to vika.taylor.one@gmail.com. There is no registered Consent Manager and no Data Protection Officer, because neither is required of a fiduciary of this kind: these sites have not been designated a Significant Data Fiduciary. If a grievance is not resolved, the route is the Data Protection Board of India.

On children, the Act sets the threshold at eighteen and requires verifiable parental consent below it, along with a prohibition on tracking and on behavioural advertising directed at children. No personal data is knowingly collected from children, no behavioural advertising exists on any of these sites, and analytics stays off until somebody actively presses Accept. See section 10.

9.8 Japan: APPI

Under the APPI, the purpose of use is stated plainly: operating and securing the sites, and, with your consent, measuring which content is read. It is not used for anything else, and it is not used to build a profile.

Transfer of personal data to a third party in a foreign country needs your consent, and that is exactly what the Accept button is. Nothing goes to Google before you press it. Cloudflare's role is that of a contractor handling data in order to run the hosting.

You may request disclosure, correction, suspension of use, and disclosure of the records of third-party provision, through the address at the top of this page. Section 7 is the honest limit: with no account, there is often nothing that can be identified as yours to disclose.

The supervisory body is the Personal Information Protection Commission: ppc.go.jp.

9.9 South Korea: PIPA

PIPA is built on consent, and consent here is opt-in and specific. The items are those in section 4.2, the purpose is understanding which content is read, and the retention is the setting named in that section. Nothing is provided to a third party beyond what section 4 lists, and nothing is provided for marketing.

You have the right to access your personal information, to correct or delete it, and to suspend its processing, through the address at the top of this page, with the limits in section 7.

No domestic representative in Korea is appointed. PIPA requires one only of overseas operators above set size thresholds; this is one person's portfolio and a set of free resources.

Complaints and mediation go to the Personal Information Protection Commission: pipc.go.kr.

9.10 Indonesia: PDP Law

Under Law No. 27 of 2022 on Personal Data Protection, Vika Taylor is the personal data controller and Cloudflare is a processor.

Analytics runs on your consent, given before anything loads and withdrawable at any time. You have the rights to information about the processing, to access, to correction, to erasure, and to withdraw consent. The right to object to automated decision-making has nothing to bite on here: no automated decision-making takes place, as section 6 says.

Requests go to vika.taylor.one@gmail.com. No local representative in Indonesia is appointed. The supervisory authority provided for by that law is the route for complaints once it is operating.

9.11 Middle East: Saudi PDPL, UAE PDPL and neighbours

Requirements differ sharply from one jurisdiction to the next in this region, and this section makes no claim to cover all of them.

The two main national laws are the Saudi Personal Data Protection Law, overseen by SDAIA, and the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. Both give you, in broad terms, the right to be informed, to access your data, to have it corrected, to have it deleted, and to withdraw consent. All of those go through the address at the top of this page.

Some free zones run their own separate regimes, including the DIFC and the ADGM, with their own regulators and their own procedures.

Nothing is claimed here about local registration, licensing or a local representative in any Middle East jurisdiction. None has been obtained, and none is asserted. If a specific requirement applies to your situation, write and say which one.

10. Children

None of these sites is directed at children, and no personal data is knowingly collected from them. There is no account to create, no form to fill in and no way for a child to submit anything.

Because analytics is off until somebody presses Accept, a child who visits and does not press it is not measured at all.

The age threshold differs by country: thirteen under COPPA in the United States, between thirteen and sixteen depending on the member state under Art. 8 of the GDPR, eighteen under India's DPDP Act. No age verification exists on these sites, for the same reason there is no login: there is nothing to attach it to.

If you believe a child's personal data has reached me, write to vika.taylor.one@gmail.com and it will be deleted.

11. Changes to this policy

The date at the top of this page changes whenever the text does. This version is dated .

There is no mailing list, so there is no way to notify you of a change, and none is promised. Consent is in any case asked again every 180 days, as section 5 shows, so a change that affects what is collected reaches you at the next prompt at the latest.

12. Language versions

This English version is the authoritative one. The German, French, Spanish and Portuguese versions are translations provided for convenience. If a translation and this page ever disagree, this page is the one that applies.

Related documents: Terms of Use, Cookie Notice, Impressum (German).