Cookie Policy

A cookie is a small file a website asks your browser to keep and hand back on every later request, which is how a site recognises you between visits. Local storage, session storage and IndexedDB do a similar job with a different mechanism, and the law treats them the same way.

This site sets no cookie and uses no session storage and no IndexedDB. It uses local storage for exactly one item, va, described in the next section. Open your browser's developer tools on any page here, look at the storage panel, and that one item is all you will find.

The visit count is the site's own, served from pyxole.com, and it keeps only totals for each day: how many people came and how many visits, which pages were opened, the site or app a visit came from (its name only, such as Google or Steam, and the campaign word if the link carried one), the country, the kind of device, the browser, system and language, how long pages stayed on screen, which outside links were tapped (Steam, Discord) and how fast the pages showed. A visit sends two short messages to the site, one as it starts and one as you leave, and nothing about the visit itself is kept once its numbers are added in.

The va item holds the day this browser was last counted, with a random code for that day (a new one every day), whether it has come back before, so you are counted once a day, and the visit in progress (when it started, where it came from, the pages opened, the time spent and the links tapped), so each counts once. The site keeps no network address and no identifier: to tell one browser from another within a day it keeps a scrambled key made from the address, the browser and that day's code, and deletes it two days later. No cookie is involved. With Do Not Track switched on, the page sends nothing at all.

Page views are also counted by Cloudflare Web Analytics. It reports how many times a page was opened, the country a visit came from, the referring site, and rough performance timings.

It works without a cookie and without a device fingerprint: there is no identifier that would let it tell a returning visitor from a new one, or follow anyone from here to another website. Cloudflare does not use the data to build advertising profiles.

If measurement is switched off for a build, no script loads at all and the site makes no third-party request whatsoever.

Apart from the visitor mark above, a few things sit in your browser after visiting, and none of them is set by us:

• The HTTP cache. Copies of the page, its stylesheet, its scripts and the pixel font, kept so a second visit is fast. Ordinary browser behaviour, cleared with your browsing data.
• Your own browser settings. Zoom level, reduced-motion preference, language. We read the reduced-motion preference to decide whether to animate, and reading it stores nothing.
• Security state. The HTTPS certificate and connection details your browser keeps for any site it talks to.

Under the EU and UK ePrivacy rules, consent is needed before storing or reading information on your device, unless that storage is strictly necessary for a service you asked for. The one thing this site stores is the visitor mark: a single word with no identifier in it, never sent anywhere, whose only job is to stop the site counting you twice.

Consent banners exist for advertising and cross-site tracking. This site has neither, so a banner would add a click, a layout shift and a dark pattern's worth of suspicion for no gain to anybody.

If that ever changes, a banner appears before the thing it is asking about loads, with a refusal that is one click and works. Not a legitimate-interest maze.

There are none. No YouTube player, no Discord widget, no Steam iframe, no font served from Google, no library pulled from a CDN. The pixel font, the icons and every script are served from our own domain.

That is enforced rather than intended: the content security policy on every page blocks anything from an origin that is not ours, apart from the analytics endpoint named above. A third-party embed added carelessly would fail to load rather than quietly start tracking.

Links to Steam, Discord and our social accounts are plain links. Nothing from those platforms loads until you click one.

You are welcome to. Any content blocker, tracking protection setting, or a browser set to refuse third-party requests will stop the analytics beacon, and Do Not Track stops the visitor count before it sends anything. The site works exactly the same afterwards. Nothing here is gated on measurement.

To clear what your browser keeps from us, the visitor mark included, use its Clear browsing data controls; your next visit is then counted once more.

This policy is about the website. The Pyxole client, once it exists, runs through Steam and inherits Valve's arrangements for accounts and telemetry. Anything the game itself stores will be described on its Steam page and in the game, not here.