Privacy policy

1. Who is responsible

The controller (Verantwortlicher) for the processing described here, within the meaning of Art. 4(7) GDPR, is:

No data protection officer has been appointed, as the thresholds in Art. 37 GDPR and § 38 BDSG are not met.

2. What this site does not do

These are properties of how the site is built, not just promises:

• — No cookies. Nothing is written to cookie storage, so there is no consent banner, because there is nothing to consent to.
• — No analytics or tracking. There is no analytics script, no tag manager, no pixel, and no advertising code of any kind.
• — No external requests. Fonts, styles, scripts and images are all served from this site's own domain. The page loads nothing from a CDN, a font service, or any other third party, so no third party learns your IP address through this site.
• — No local storage. Nothing is kept in localStorage or sessionStorage.
• — No accounts, no forms on this site. There is no login and no form here that submits anything. The beta sign-up is a link out to an Airtable form — see section 6 — so nothing you enter there passes through this site.

3. The pattern demo

The phrase you type into the demo on the home page is turned into a pattern by JavaScript running in your own browser. It is never sent over the network, never written to storage, and never seen by the operator of this site or by anyone else. Closing or reloading the page discards it. No personal data is processed by the operator as a result of using the demo.

The download buttons build the file in your browser and hand it straight to your device; nothing is fetched from a server and nothing is uploaded. The PNG is drawn from the SVG on a canvas here on your machine, not converted anywhere else. The generator records the phrase, and every rotation of it, in the document's metadata, and the saved SVG has that description removed — it contains the drawing and nothing else. The PNG carries no text at all. Neither file is named after your phrase.

4. Hosting and server log data

This site is hosted on GitHub Pages, a service of GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA.

Technically, your browser has to reach GitHub's servers to load this page. In doing so GitHub processes connection data, which typically includes your IP address, the page requested, the date and time, the referring page, and your browser and operating system identifiers. GitHub uses this to deliver the site, to keep it secure, and to detect abuse. The operator of this site has no access to these logs and cannot read them.

Legal basis: Art. 6(1)(f) GDPR. The legitimate interest is the secure, reliable and efficient delivery of a website.

Transfer outside the EU: GitHub, Inc. is based in the United States, so serving this page involves a transfer of that connection data to a third country. The safeguards GitHub applies to such transfers, along with its retention periods, are set out in GitHub's Privacy Statement and, specifically for this hosting product, in GitHub's note on data collection for GitHub Pages.

5. Contacting us by email

If you write to the address on the contact page, your email address and whatever you put in the message are processed in order to read and answer it.

Legal basis: Art. 6(1)(b) GDPR where your message concerns a contract or steps leading to one, otherwise Art. 6(1)(f) GDPR — the legitimate interest in answering enquiries.

Retention: messages are kept until the matter they concern is settled, then deleted, unless a statutory retention period requires otherwise. You can ask for deletion at any time.

6. The beta sign-up list

The sign-up page does not contain a form. It contains a link to a form hosted by Airtable, Inc., 155 5th St, San Francisco, CA 94103, USA, which acts as processor for the beta list. Until you follow that link, your browser makes no request to Airtable and Airtable learns nothing about you — the form is deliberately linked rather than embedded, so that merely reading the page does not disclose your IP address to a third party.

If you do follow it and submit the form, Airtable stores your entry in a base named "Beta", which the operator of this site can read. Nothing you type into the form passes through this website. The form collects exactly three things:

• — Name — used to address you. Nothing checks it, so a first name or a pseudonym is fine.
• — Email address — the only way you are contacted about beta access.
• — Whether you want the newsletter — a yes or no.

These serve two separate purposes, and consenting to one does not consent to the other.

Beta list — legal basis: Art. 6(1)(a) GDPR, your consent, given by submitting the form. Your name and email are used to contact you about beta access and for nothing else. Retention: until the beta ends or you ask for removal, whichever comes first.

Newsletter — legal basis: Art. 6(1)(a) GDPR, a separate consent, given only if you answer yes. If you answer no, your address is never used for the newsletter, and answering no has no effect on your place on the beta list. Retention: until you unsubscribe. Every newsletter carries an unsubscribe link, and you can also unsubscribe by writing to the address in section 1.

You may withdraw either consent at any time, independently of the other, with effect for the future. Withdrawal does not affect the lawfulness of processing carried out beforehand, and costs nothing beyond the price of sending the message.

Transfer outside the EU: Airtable, Inc. is based in the United States, so submitting the form transfers your data to a third country. The safeguards Airtable applies are set out in Airtable's Privacy Policy. To have your entry deleted, write to the address in section 1.

7. Your rights

In respect of your personal data you have the right to:

• —Access (Art. 15 GDPR) — ask whether and what data about you is processed.
• —Rectification (Art. 16 GDPR) — have inaccurate data corrected.
• —Erasure (Art. 17 GDPR) — have data deleted.
• —Restriction (Art. 18 GDPR) — have processing limited.
• —Data portability (Art. 20 GDPR) — receive your data in a machine-readable format.
• —Objection (Art. 21 GDPR) — object to processing based on legitimate interest, on grounds relating to your particular situation.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in the member state of your habitual residence, place of work, or the place of the alleged infringement. To exercise any of these rights, write to the address in section 1.

8. Automated decision-making

No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place.

9. Changes to this policy

This policy will be updated if the site changes in a way that affects it — for example if a form, an embed, or any third-party service is ever added. The date at the top shows when it was last revised. The full revision history is public in the source repository.