PRIVACY POLICY

1Who is responsible

This policy covers petridish.games and its subdomains, including rorschach.petridish.games (together, "the Site"). The Site is run by Max Pliskin, trading as Petri Dish Games ("we", "us"), an individual developer in Colorado, United States. We are the data controller for anything described below.

Games distributed through a store have their own arrangements. The Greenout mobile app is covered by its own privacy policy, and anything you do inside Steam, itch.io, Google Play or Discord is governed by that platform.

2What we do not do

• There are no user accounts, logins, profiles or newsletters. We never ask for your name, email address or age.
• There is no analytics package on the Site: no Google Analytics, no Plausible, no pixels, no session recording, no fingerprinting.
• We set no cookies at all, and no tracking or advertising identifiers.
• There is no advertising on this website.
• We do not sell or share personal information, and we do not build profiles or run targeted advertising, as those terms are used in United States state privacy laws.
• We hold no payment details, ever. Purchases happen on a store, and the store keeps them.
• Your personality remains, for the moment, on your own device. See section 16 of the Terms of Service.

3What stays on your device

Several pages remember things using your browser's local storage. This data never leaves your machine, is not readable by us, and is not linked to any identifier. Clearing site data in your browser deletes all of it. Blocking storage costs you the convenience and nothing else.

• glia-session-v1 and glia_* — the Glia synthesizer's autosaved session, its local organism pool, and the picks you made in it.
• rorschach_picks, rorschach_pool, rorschach_sound — a local history of your last few hundred Rorschach Lab choices, the pool you are judging in, and whether sound is armed.
• concordance:side — which side panel the Concordance opened with.
• hexfont-editor — the state of the internal font editor at /editor.
• feedback:sent — when you last sent feedback, so the panel can ask you to wait a moment before sending again. A timestamp, nothing else.
• feedback:key — present only on the maintainers' own devices, which enrol themselves by opening a page with a secret in the URL fragment so their own notes are filed as theirs. Nothing puts it on a visitor's device.
• Browser games served from the Site keep their own local progress, such as a best score or an ad-free entitlement, in the same way.

4What our servers receive

Ordinary web requests

The Site is a static site served by a hosting provider. Like every web server, theirs receives what your browser must send to be answered: your IP address, user agent, the URL requested, a referrer if your browser sends one, and a timestamp. Our provider keeps that in operational logs and aggregate traffic counts, which exist to keep the Site up and to absorb abuse. We do not use it to identify or profile visitors, and we do not join it to anything else.

Feedback you send

Every page carries a feedback button, and the wiki carries one beside each section heading. Nothing is sent unless you write something and press Send. What arrives is the page and section you sent it from, which of the five labels you picked, and your own words, up to 1500 characters.

There is no name field and no email field, and we do not want either. Stored alongside the message are your browser's user agent string, the country our host reports, and a salted one-way hash of your IP address, which exists so that one person cannot flood the queue and cannot be turned back into the address it came from. Please keep personal details out of the message itself: what you type is stored as you typed it.

Feedback is private. It is never published, never shown to other visitors and never answered, because there is no address to answer to. It is read by the developer and used to fix what it points at. Since nothing identifies you, we cannot later find your message to correct or delete it unless you can describe it well enough for us to recognise it.

The Rorschach Lab

The Rorschach Lab is the one interactive part with a server behind it. When you use it, your browser sends the lab:

• which pair of organisms it was dealt, and which of the two you chose or rejected;
• whether an organism actually compiled and drew in your browser, so a broken one can be retired;
• a request to cross a pair, when you press the button, and which pool you are in.

Those messages carry organism numbers, nothing more. There is no account, no cookie and no client identifier attached, so a vote cannot be traced back to you or joined to your other votes. They exist because they are the selection pressure: your choices are what the population evolves against, and the results are public in the Gallery. Because a vote is anonymous at the moment it is made, we cannot later find it and pull it back out.

5Third parties that see a request

We embed a small number of outside resources. We send them nothing about you, but loading a resource from another company's server necessarily reveals your IP address and browser to that company.

• Google Fonts (fonts.googleapis.com, fonts.gstatic.com) — the Site's typefaces load from Google on every page. See Google's privacy policy.
• YouTube — trailers on the home page and the Teztlotzl page are embedded through youtube-nocookie.com, Google's no-cookie player domain, which does not set advertising cookies unless you play a video. Google still logs the request.
• Our hosting and CDN provider — serves every file and keeps the operational logs described in section 4.

Links out to Steam, itch.io, Discord, GitHub and Google Play are ordinary links. Once you follow one, that company's own policy applies. We get no report that you clicked.

6Why any of this is lawful

Where the UK GDPR or EU GDPR applies, our legal basis is legitimate interests (Article 6(1)(f)): delivering the pages you asked for, keeping the Site available and secure, and running an experiment whose whole purpose is to collect anonymous preferences. We do not rely on consent because we set no cookies and run no trackers, and we do not process special-category data.

7How long it is kept, and where

Hosting and server logs are short-lived and rotate on our providers' schedules, generally within days to a few weeks. Feedback is kept until it has been acted on and then for as long as the change it caused needs explaining, generally under a year; the hashes behind its rate limit expire within a day. Rorschach Lab votes are kept indefinitely as part of the population's history, because they are anonymous aggregate records rather than personal data. Data on your own device lasts until you clear it.

Our providers operate globally, so a request may be served from, and logged in, a country outside your own, including the United States. Where the GDPR applies, such transfers rely on the providers' standard contractual clauses.

8Your rights

Depending on where you live, you may have the right to access, correct, delete, port or restrict the personal data an organisation holds about you, to object to its processing, to opt out of sale, sharing or targeted advertising, and not to be discriminated against for exercising any of that. Residents of Colorado, California and other United States states with a privacy statute, and residents of the UK and EEA, all have some version of these rights.

In practice we hold almost nothing to act on: no account, no email address, no identifier linking any record to you. That means an access or deletion request usually has nothing to return or erase, and the honest answer is often "we do not have anything of yours". Write to us anyway if you think we do, at maxpliskin1@gmail.com, and we will answer within the time the applicable law allows. Because we cannot identify you from our records, we may not be able to verify a request, in which case we will say so rather than guess.

There is no sale or sharing of personal information to opt out of, and no appeals process is needed for a refusal we do not make. If you are in the UK or EEA you may complain to your data protection authority; in the UK that is the Information Commissioner's Office.

9Do Not Track and Global Privacy Control

We run no cross-site tracking, so a Do Not Track header or a Global Privacy Control signal has nothing on this Site to switch off. Both are honoured by default, in the sense that the behaviour they ask us to stop never starts.

10Children

The Site is for a general audience and is not directed at children under 13. We do not knowingly collect personal information from anyone, children included. If you believe a child has somehow sent us personal information, contact us and we will delete it.

11Security

The Site is served over HTTPS. The strongest protection here is structural: there is no account database to breach, and the only personal data at rest is whatever a visitor chose to type into the feedback box, held where no page can read it back out. No system is perfectly secure, and we make no guarantee that transmission over the internet is infallible.

12Changes

If this policy changes, the new version is posted at this address with a new effective date. A change that meaningfully expands what we collect will be called out on the Site rather than slipped in.

13Contact

Privacy questions, requests and corrections: maxpliskin1@gmail.com. The Terms of Service cover the rules for using the Site.