Privacy

What an account stores

• Your email address and a hashed password, for signing in. The hash is stored, never the password.
• Whether your address is verified, and — only while a password reset is in flight — a reset token.
• The patterns you star, the difficulty ratings you cast, and the pattern names you propose. A proposed name becomes public only when a curator publishes it, and published names are shown on pattern pages without your name attached to them.

What the servers log

PocketBase records its own activity log — sign-ins, failures, and administrative actions — with the requesting IP address, and the proxy in front of this site keeps a rotating access log (IP, URL, timestamp) for a bounded window. Both exist to answer "was this account attacked", and both are the reason an account can be investigated but not, in the ordinary case, read.

No tracking

There are no analytics, no third-party scripts, no advertising, and no cross-site trackers. The server's Content-Security-Policy forbids the page from contacting any origin but this one, so "we do not send your data anywhere" is enforced by configuration, not just stated here.

Cookies

This site sets exactly one cookie: a signed-in marker that is HTTP-only (pages cannot read it), scoped to this site, and valid for a day. It is strictly necessary to give you the session you asked for, which is why there is no cookie banner — a notice for the cookie that carries the login you performed would ask your consent for the thing you are here to do. Favourites are kept in your browser's local storage before sign-in so a signed-out visit can star a pattern; that stays on your machine until you file it to an account. The throw heights you last filtered a partner list by are kept there too, and never leave your browser.

Deleting your account

Your account page has a delete section: type your password and the account goes, with its stars, ratings and pending suggestions, in one request. The activity log entries sign-ins left behind are not personal data of yours — they are the site's record of an attack surface — and they age out with the log.

Questions, and the law's list

Write to accounts@juggling.digital. This site has no advertising, no analytics, no selling of data, no international transfers beyond the one machine that hosts it, and no automated decision-making — a data request to an account here is: your email, your verification flag, your stars, your ratings, your pending suggestions, and then a deletion that takes all of it.