PRIVACY

Last updated November 14, 2026. This site is run by Carter Cole. Questions or requests: carter@cartercole.com.

What is measured

Server logs, for every request. Amazon CloudFront, which serves this site, logs each request: your IP address, the page asked for, the time, the referring page, your browser's user agent, and the country and network (ASN) Amazon derives from the address. I use them to count traffic, including bots and crawlers, and to spot abuse. Cookies are not logged. These logs are kept 30 days.

Anonymous, always on. Each page view adds one to daily counters for the page, the referring site, your country, device size (mobile, tablet or desktop), browser and operating system, and how long the page was on screen. A few actions are counted the same way: opening an entry's details or a screenshot, and following a link to another site (which address). To count unique visitors without a cookie, your IP address and user agent are hashed together with a random value that changes every day and is deleted after two days, so the hash can't be traced back to you afterwards. No cookie is set and nothing identifies you. Visitors sending a Do Not Track or Global Privacy Control signal are not counted.

Error reports. If the site's JavaScript fails in your browser, the error message, the page and your browser's user agent are sent so I can fix it. No identifier goes with it unless you accepted below. They are sent even with Do Not Track, since they say nothing about you.

Full, only if you click Accept. If you accept on the banner, I also collect:

• a random visitor ID stored in a cookie named vid (lasts up to 400 days, renewed when you visit);
• a session ID kept in your browser's session storage until you close the tab;
• a device fingerprint: a hash built from your browser, language, time zone, screen, graphics and similar settings, used to recognise a returning device;
• your IP address and browser (user agent) for each page view, with its country and network;
• the pages you view, where you came from, and a recording of your visit: mouse movement, clicks, scrolling and page changes. Text you type into form fields is masked and never captured. Error reports from your visit are linked to it.

Choosing "Anonymous only", or sending Do Not Track or Global Privacy Control, means none of the list above is collected. Your choice is remembered in a cookie named consent (one year). Change it at any time with "Privacy choices" at the foot of every page.

Why

To understand what is read, find problems, and spot abusive traffic. I don't sell the data, use it for advertising, or share it with anyone for their own purposes.

Legal bases

Server logs, anonymous counting and error reports rely on legitimate interests: running the site securely and fixing it. The cookie, fingerprint, per-visit IP records and session recording rely on your consent, which you can withdraw whenever you like. Withdrawing doesn't affect what was collected before.

Accounts and profiles

You never need an account to read anything here. If you want one, SIGN IN takes you to accounts.cartercole.net, where you sign in with a passkey (there is no password, and the hub only keeps the public key). It sends this site a signed token that names your account by an id and, if you set one, nothing else about you. The token is kept in your browser's local storage for about an hour and is sent, as an Authorization header and never as a cookie, to the API at cartercole.com, which checks it against the hub's published keys.

What I keep if you make a profile: the account id, the alias you chose, and whatever you add: a display name, a short bio, a picture, links to your other profiles, and the design era and background you saved. They are stored as files in a private bucket on AWS. The picture is served publicly from its own address; everything else is shown only to you, and to anyone with your /profile?u=alias link if, and only if, you turn on "show this page". A profile page is marked noindex, so search engines are asked to leave it out. I can take an alias back if it is used to harm someone, and give it to someone else. DELETE MY PROFILE on that page removes the profile, the picture and the alias; nothing is kept apart from backups of the bucket's older versions, which expire after 30 days.

The analytics console is the other sign-in. It sets a session cookie (cl_session, 7 days, sent only to /_c/) for the administrator alone. Each page asks /_c/api/me whether that cookie is there, so it can show me an ADMIN mark. For anyone else the answer is no; the request lands in the server logs like any other, but isn't counted as a visit.

Carter Say

The /cartersay page makes its speech in your browser, so what you type is never sent to me or anyone else (session recordings, if you accept them, never capture typed text). To do that it keeps a 125 MB copy of the speech model in your browser's cache storage and remembers the voice and effect you picked in local storage (cartersay.voice, cartersay.effect). None of it leaves your device, and you can clear it with your browser's site data settings. A link made with SHARE LINK carries its line after the # in the address, a part browsers never send to a server; the page takes it out of the address bar once it has read it, so it is not recorded either. Saved audio and video are made in your browser too.

The background

The animation behind every page, and the ones at /asobi, run in your browser. The mouse, your touches and, on a phone, which way it is tilted move them, and none of that is sent anywhere. Local storage remembers which background you saw last, so the next page shows a different one (bg.last), your best scores (bg.hi.*), the background you picked, the ones you left out of the rotation and whether you asked it to hold still (bg.lock, bg.skip, bg.still, all on /bg), and the design era, hue and colour harmony you picked in the ERA panel, the font it needs and the background it suggests (era, era.font, era.motif, era.shift, era.harmony, era.scene). None of it leaves your device, and you can clear it with your browser's site data settings.

Badge

The /badge page and its explorer talk to an LED badge over Web Bluetooth. The pictures, video and text you pick are drawn and encoded in your browser and sent only to the badge you connect, never to me. The badge page remembers your recent emoji and whether experimental features are showing in local storage (badge.emoji.recent, badge.showExp); the explorer remembers its settings and the Bluetooth names and browser device IDs of badges it has seen (badge.explorer.prefs, badge.explorer.identities). None of it leaves your device, and you can clear it with your browser's site data settings.

Memes

The /memes generator draws your meme in your browser, from templates served by this site. The text you type, and any picture of your own you drop in, stay in the tab unless you choose to share the meme online. An edit link carries the template and its text after the #, which browsers do not send to the server; the page reads it and then takes the text out of the address bar.

Sharing online is the one thing that sends a meme here. When you press it, the finished picture is stored at cartercole.net/m/<id> with a page showing it, along with which template it uses, when it was shared, and the words on it as the picture's description. Anyone with the link can see it; nothing lists shared memes, and the pages ask search engines not to index them. Your browser keeps the code that deletes it in local storage (mm-posted), and Delete on either page removes it for everyone. To stop floods, the address you share from is counted as a salted hash, which is thrown away when its window ends (a day at most); it isn't stored with the meme. Only memes on one of the templates can be shared, so a picture of your own never leaves your browser.

How long I keep it

• Server logs (IP address, user agent, page): 30 days.
• Anonymous counters: 400 days. The daily hashing value: 2 days.
• Error reports: 90 days.
• Visit records (IP, user agent, IDs): 400 days.
• Session recordings: 30 days.
• Shared memes: until you delete them, or I take one down after a report to abuse@cartercole.com.

Who handles it

The site and its data run on Amazon Web Services in the United States (S3, CloudFront, Lambda, DynamoDB). Where a network name is shown for an address, it comes from a database copy kept on the server, so your address is not sent anywhere to look it up. The page's fonts load from Google Fonts, so Google sees your IP address and browser when a page loads, under Google's own privacy policy. A project's video plays from YouTube, which is also Google: a page with a video embeds YouTube's player from youtube-nocookie.com, so YouTube sees your IP address and browser when that page loads (a player further down the page loads as you scroll toward it) and may store data in your browser once you press play, under the same policy. No other third parties receive visitor data.

Your rights

You can ask to see, correct or delete what I hold about you, object to processing, or complain to your local data protection authority. Because records are keyed by cookie, I need your visitor ID (the value of the vid cookie, which your browser can show you) or your IP address, and roughly when you visited, to find them. Email the address above; I'll respond within 30 days. California residents: I do not sell or share personal information, and I honour Global Privacy Control.

Children

This site is not directed at children under 13 and I don't knowingly collect their data.

Changes

If this policy changes in a way that matters, I'll update the date above and, if it means collecting more, ask for your consent again.