Privacy Policy

What we collect

"The Visitor Book" (email sign-up): your email address, an optional name, the language you browsed in, where you signed up, and the IP address of the request (kept only to prevent abuse of the sign-up form). Every email we send includes a one-click unsubscribe link tied to a private token — unsubscribing is immediate and does not require an account.

Booking, commission, similar-figurine or new-figurine, reservation and waitlist requests, and a request to be told when a work still in the making is ready: your name, email, phone number, the messenger or social-network contact you choose for the reply, up to three photographs you attach (photographs not attached to a sent request are deleted within a day), and whatever project details you write (size, mood, budget, deadline, occasion). These forms work anonymously — no account is required. Each request gets a private "cancel token" that is saved in your own browser so you can look up or cancel your own request later; if you later create an account, you can link past requests to it using the same token and email. A copy of a new request (your name, email and message) is also sent to the artist as a notification; see "Third parties".

Contact messages: your email address and message text, and the IP address of the request (kept only to prevent abuse). We deliberately do not ask for your name on this form.

"Book of Impressions": an optional name, your message, and an optional mood — posted anonymously, not tied to your email or any request. The IP address of the request is stored beside it, not shown, only to prevent abuse.

If you create an account, the account holds a display name and one or more ways in. By email: your email address (confirmed by a link we send) and your four signs, kept only as a hash made with a secret that is stored outside the database — we cannot read your signs. By Telegram: your Telegram numeric id and your @username (the username is refreshed at each sign-in and shown only to you); we do not take your photo, phone number or contacts. By Google (and Apple, when it is switched on): the account identifier that provider gives us, the email address it reports, and, the first time, your name for the profile; we take nothing else, and we do not post to or read from those accounts. For security we also keep the IP address, browser and approximate country and city of sign-in attempts and open sessions; this is how we detect abuse and let you see and close your own sessions, not how we follow your browsing.

Tales and the shelf: comments (name, optional email, text), a like or a quiet dislike, and a reading counted once per reader per day, all tied to a random identifier held in your browser (see "Cookies and browser storage"), not to your name. "I want a sequel" and "Send me the next one" keep your email address (the same Visitor Book as the newsletter) or, if you signed in through Telegram and ask for it, your Telegram name, and the outcome of the letter or note. A vote for whom the next tale should be about is kept once per person and the counts are not shown to readers.

The studio and the game: if you take part, the name you chose for your work is shown publicly with your frames and ratings; the frames and pictures you upload; your votes and ratings; and your in-game balance and copies. In-game dust and grain are not money.

Notifications: if you turn them on, your browser gives the site a push address and two keys that let the server send you a message. We store them with the language you browse in and the topics you ticked (new works, tales, gazette leaves, cards and battles) — no name, no email, no account. You turn them on and off yourself, in the panel at the foot of the page or in the “More” sheet. The record is deleted when you turn notifications off, when your browser reports that the address no longer exists, and after five failed deliveries in a row. The message travels through your browser’s own push service (Google, Mozilla, Apple or Microsoft, depending on the browser), which sees that a message was sent to your device but is not given your name. The text of a notification is the title and a short lead of what is new on the site, nothing personal.

The site as an app: pages, data and pictures you have opened are kept on your device for up to 30 days so that they open without a connection; they are not sent anywhere and are replaced when the site is updated. Installing the site to your home screen only adds an icon. The browser also remembers two small things in local storage: the day you closed the “Install” bar (it is not shown again for 30 days) and your notification topics.

Search field and questions: text in the search field is used on this device to find works, tales and cards. When a phrase looks like a question (two words or more, a question word or a question mark), it is sent to our server after a short pause while you type, so that an answer can be chosen by its meaning; at that moment it is not written down. Single words are never sent for an answer. If the site could not answer, the text of the question is recorded without your name, email or any link to you (addresses and long numbers are cut out). It is stored like the other measurement events and helps decide what to teach the site to answer. Voice input is a function of your browser: in Chrome the sound is recognised by Google, in Safari by Apple; our servers receive only the text. The “Listen” button on tall tales uses the voice built into your device and sends nothing anywhere.

Language by country: on a first visit, if your browser asks for nothing but English, the server looks up the country of your IP address in a table kept on our own server and the site may open in that country’s language. The address is not sent anywhere or stored for this, and the answer is only remembered in your browser for a few days; a language you pick with the language button always wins and is remembered. Country data: IP Geolocation by DB-IP (https://db-ip.com), licensed CC BY 4.0.

Site analytics

We run our own first-party analytics — nothing is sent to Google, Meta, or any outside analytics company. We do not store your raw IP address for analytics at all: instead we compute a one-way, salted hash of a truncated IP range and your browser type that changes every day, so the same visit cannot be linked across days or matched back to an individual. We also record your approximate country (resolved from an offline database on our own server — your IP address is never sent to a third party to look this up), the page you viewed, your device/browser category, and, if you arrived via a link with tracking parameters, those parameters. Raw analytics events are kept for 30 days and then deleted; after that, only anonymous daily totals (like "how many visits from a given country") remain, with nothing that identifies an individual visit. On top of that we note how long you were actually present on a page (not while the tab is hidden or idle), how far you scrolled, the last heading you reached, and where you went next — another page of this house, only the name of another website, or simply "left"; what you typed into the archive search (never what you typed into forms: for a form we note only which field you were in when you left without sending it, and whether it was sent); what you opened on a work page (which photograph, the magnifier); how fast the page loaded on your device; and script errors or dead links you ran into. To tell a returning browser from a new one, your browser keeps one date — the day it first opened this site. It is the same for many browsers, identifies nobody, and is not sent with a name or an address; the daily hash above still changes every day.

Server log

Apart from analytics, the server keeps an ordinary operating log of requests: time, page or interface address, result, how long it took, your IP address and browser identification. It is read only by the artist, to find faults and abuse, and entries are deleted after 14 days. To limit how often one address can send forms or comments, the server also keeps recent request times per IP address in its memory; they are not saved to disk and disappear within an hour or on restart.

Cookies and browser storage

This site does not set cookies. It does use your browser's local storage, which stays on your device. Most of it never leaves your device: your language, wishlist, which pieces and tales you have viewed or read, the cancel tokens described above, what has changed since your last visit, and settings of the tools you use. Two things are sent to us: a random visitor identifier (so a like, a mark, a vote or a reading is not counted twice), and, while you are signed in, your session key, which goes with each request that needs it. A sign-in in progress also keeps a short-lived note in this tab's session storage, which is cleared when the tab is closed. You can clear all of it in your browser at any time; that signs you out and forgets the identifier.

Third parties

We do not share your data with advertisers or ad networks, and we use no third-party analytics: the typefaces are hosted on our own server, and nothing is loaded from Google, Meta or similar services when you browse. Some outside services do carry data because of what the site does. Telegram: if you sign in through Telegram it receives the one-time word and brings back your id and @username; the artist's notification bot sends the artist a message with the name, email and text of each new request, comment or booking; and a separate bot posts new works and leaves to the public channel (no personal data). Google, and Apple when switched on: if you choose them to sign in, they know you signed in to this site; we receive only what is listed above. Email: letters (confirmation, receipts, replies, the newsletter) go out through the mail service the site is set up with. Pinterest and other networks receive anything only if you press their share button. This website does not process payments, so we never handle your card details. Etsy: buying and paying for a work happens on Etsy under its own policy. The site sends nothing to Etsy — you go there by a link. Notifications: the push service of your browser (Google, Mozilla, Apple or Microsoft) carries the message to your device; it receives the text encrypted and cannot read it.

How long we keep data

Raw analytics events: 30 days. Server log: 14 days. Sign-in attempts, with their IP address and browser: 90 days. Sign-in sessions: valid for 30 days; deleted when you sign out or close them, and every expired one is swept in the daily clean-up, whether or not you ever came back. One-time Telegram, Google and Apple sign-in records, with the IP address and city: deleted soon after they are used or expire. Newsletter sign-ups, bookings, commissions, orders, contact messages, comments and tale readers' records: kept until you ask us to remove them or, for the newsletter, until you unsubscribe — after which the record is marked inactive rather than immediately erased, so we do not accidentally re-contact you. Notification subscriptions: until you turn them off or your browser reports that the address no longer exists (five failed deliveries in a row also delete the record).

Your rights

You can ask us at any time to see, correct, or delete the personal data we hold about you, or to explain how it is used. You can delete your account yourself in your profile, unlink Telegram, Google or Apple there if you have another way in, and close your other open sessions. For the newsletter, the unsubscribe link in any email does this instantly. For anything else — a booking, a commission, a contact message, a comment — write to the email address below and we will act on it promptly.

Children

This site is not directed at children. Every form that collects contact details — the newsletter sign-up, bookings, commissions, orders, waitlist requests, a request to be told when a work is ready, and account registration — requires you to tick a box confirming you are 16 or older before it will submit, and our server rejects the request if that box was not checked. This includes making a new name through Telegram, Google or Apple: on the sign-up page those buttons stay closed until the box is ticked, and if a person we do not know yet arrives through one of them without it, the server creates no name. Signing in to a name that already exists asks nothing again. The tick is a self-certification, not an identity check (we do not verify age documents), but it is an actual technical requirement enforced on both sides, not just a line in this policy.

Changes to this policy

If this policy changes, the "last updated" date at the top of this page will change too. We recommend checking back occasionally if you have an ongoing request with us.

Contact

Questions about your data, or a request to access/correct/delete it, can be sent to: