We want as little as possible.

The short version

1 · Who we are

CANDLEWORK is an independent, non-commercial educational site, published anonymously (see How this was made). For any privacy request or question, contact:

[email protected]

2 · Stored in your browser (not sent to us)

The site uses your browser's localStorage to remember your preferences between visits. This data stays on your device. We cannot read it, it is never transmitted to any server, and it contains nothing that identifies you.

• cw_mood — your bull / bear / neutral theme choice.
• cw_visited — which rooms you have opened, so the network map shows progress.
• cw_path_off — whether you dismissed the guided-path prompt.
• 404m:consent — your analytics choice, so we stop asking.

To erase all of it: clear site data for this domain in your browser settings, or browse in a private window. Nothing is lost that matters — the site simply forgets your preferences.

3 · Analytics — consent first

We use Google Analytics 4 to understand which rooms people find useful. It is our only third-party tool, and it is off by default.

On your first visit you are asked. Until you click "Allow analytics", Google Consent Mode is set to denied and no analytics cookies are set. If you decline, no analytics data is collected and the banner does not return.

If you consent, what is collected

• Pages viewed, time on page, and general navigation through the site.
• Approximate location (country/region level), derived from IP. IP anonymisation is enabled.
• Device, browser, and referral source.

We do not use Google Analytics for advertising, remarketing, or ad personalisation — ad storage and ad personalisation are set to denied permanently, not just before consent. We never send Google anything that identifies you personally, because we never have anything that does.

Legal basis (GDPR): consent (Art. 6(1)(a)). Data may be processed by Google in the United States under its standard transfer safeguards. Google's own terms: policies.google.com/privacy.

To change your mind: clear this site's data in your browser and the consent question will be asked again. You can also block analytics entirely with any browser-level content blocker — the site is built to work fine without it.

4 · YouTube (The Signal Room)

The Signal Room features original music hosted on YouTube. How we handle it:

• No player loads until you click it. Track cards show a thumbnail and a play button only — the YouTube player is not present on the page until you ask for it.
• When a player does load, we use youtube-nocookie.com (YouTube's privacy-enhanced mode), which reduces the cookies YouTube sets.
• If you declined analytics/embed cookies, clicking a track opens it on YouTube in a new tab instead of embedding a player here — so nothing third-party loads on our page at all.
• The long "session" mixes always open in a new tab on YouTube by design, so the music keeps playing while you browse.
• Track thumbnails are images loaded from Google's image servers, which means your IP is visible to Google for that request.

Once you are on YouTube — whether embedded or in a new tab — you are subject to Google's privacy terms, not ours, and Google may collect data according to its own policies: policies.google.com/privacy.

If you prefer no third party at all, the Signal Room includes a generative ambient option that is synthesised in your own browser and contacts nobody.

5 · Third parties

• Google Fonts — typefaces are requested from Google's font servers, which means your IP address is visible to Google as part of that request. No cookies are set by this.
• Google Analytics — only after consent, as described above.
• YouTube — music embeds, click-to-load only, via youtube-nocookie.com. See above.
• Our host — the site is served as static files; the host keeps standard server logs for security and reliability.

There are no ads, no ad networks, no social-media pixels, no session recording, no heatmaps, no A/B testing tools, and no affiliate trackers on this site.

6 · Your rights

Under GDPR (EU/UK) you have rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. In practice, since we hold no personal data about you on any server, most of these resolve instantly: there is nothing for us to hand over or delete. Your browser-stored settings are yours to erase at any time.

Under CCPA/CPRA (California) you have rights to know, delete, correct, and opt out of sale or sharing. We do not sell or share personal information, and we do not use it for cross-context behavioural advertising.

You may also lodge a complaint with your local data protection authority. To exercise any right, or if you believe we are handling something badly, email the address above.

7 · Children

This site is not directed at children and we do not knowingly collect data from anyone under 16. Its subject matter is intended for adults.

8 · Security & changes

The site is served over HTTPS with a strict Content-Security-Policy and standard security headers. It has no login, no forms, and no user-submitted content, which removes most common risk surfaces entirely.

If this policy changes materially, the "last reviewed" date above changes and the consent prompt is re-issued where the change affects it.

▸ This policy describes the site as built. If you find it inaccurate in any respect, that is a bug — please report it to [email protected].