Website Privacy Policy

This site counts visits. If you accept the prompt, each page you open writes a row to our database with the path, where you came from, your IP address, the city that IP maps to, and a description of your browser and screen. A random id in your browser ties those rows together across visits.

That’s ordinary website analytics and we’re not going to dress it up as anything better. It’s ours alone, we don’t sell it, there are no advertisers involved, and you can have it deleted by asking. If you’d rather we didn’t, say no to the prompt and nothing gets written.

There are two, because there are two products and they behave differently.

• This page is the website. It records what’s described below.
• The Lumen policy is the Android app. That app collects nothing — it ships without the INTERNET permission, so it can’t open a network connection at all.

Installing the app doesn’t put you in this website’s records, and visiting this website doesn’t put you in the app’s, because the app doesn’t keep any.

Once you’ve accepted, every page view writes the following.

What your browser tells us

• The page path, the full URL and the page title.
• The referring URL — the page you clicked through from, if there was one.
• Any utm_source, utm_medium and utm_campaign tags on the link you followed.
• Your user agent string, plus the browser name and version, operating system name and version, and device type (desktop, mobile or tablet) we parse out of it.
• Your screen width and height, your window width and height, and your device pixel ratio.
• Your timezone and your language setting.
• How long the page stayed open, sent as a second request when you leave it.

What the connection tells us

• Your IP address, taken from the request headers.
• Your city, region and country. We don’t run a lookup ourselves — Vercel, which hosts the site, works these out at its edge and passes them along with the request. They still end up stored against the page view, which is the part worth knowing.

What builds up over time

• A random visitor id, stored in your browser's localStorage. There's no name on it and it isn't shared with anyone, but it survives closing the tab and restarting the browser, so it's what lets us tell a returning visitor from a new one.
• A session id in sessionStorage, which lasts until the tab closes.
• A record per visitor id holding when you were first and last seen, how many sessions and page views you've had, the first referrer and campaign tags you ever arrived with, your most recent IP and location, and the browser and screen details above.
• Free-text notes. That visitor record has a field where we can write a note about a visitor by hand in the database. It’s typed by us, not collected from you, and it stays attached to the record until the record goes.

To see whether anyone is reading the site, which pages hold attention, and whether a link we posted somewhere brought anybody. That’s the whole purpose. It isn’t used to target advertising, it isn’t sold or handed to a data broker, and it isn’t used to make a decision about you.

There are no third-party trackers on this site. No Google Analytics, no advertising pixels, no embedded social widgets. The fonts are served from our own domain rather than Google’s. Apart from the request that loads the page and the one that records it, your browser isn’t talking to anyone on our behalf.

Into a Supabase database that exists for nothing else. Supabase is the processor; they store the rows and don’t use them. Row-level security is on with no public policies, so the tables can’t be read from the browser or by an anonymous request — only by our server key, and by us in the dashboard.

The site itself is hosted by Vercel, which handles the request and sees your IP in the course of serving the page.

12 months. Page views older than that are deleted, and a visitor record is deleted once it has no page views left inside the window — which takes the device details, the stored location and any notes with it.

Nothing is recorded until you accept the prompt. Ignoring it counts as no. Declining is remembered, so you won’t be asked again on that browser.

If your browser sends a Do Not Track header, the site doesn’t record anything and you never see the prompt at all. That check runs before any of the collection code, so there’s nothing to opt out of afterwards.

Email scamplabs@gmail.com and ask. You don’t need to give a reason and you don’t need an account, because there aren’t any.

The one thing that helps is your visitor id, shown above if this browser has one. Without it we’re matching on an IP address and a rough time window, which is fuzzier and may catch less. You can also clear it yourself at any time by clearing this site’s data in your browser — that removes the id, though it leaves the rows already written, which is why the email is the part that actually deletes anything.

If what the site records changes, this page and the date at the top change with it. If the change is a material one — a new category of data, or a new company receiving it — the consent prompt comes back so the answer you gave isn’t taken to cover something you never saw.

Questions, corrections, or a deletion request: scamplabs@gmail.com. A person reads it.

Scamp Labs · scamplabs.com · Terms of use