privacy & cookies

last updated: october 2026

cyan in the dark is a small, self-hosted site. It is not a business, it does not sell anything, and it has no interest in your data beyond making the site work. This page describes, plainly, what is stored and why.

what is stored

if you make an account

• your username — how the site identifies you.
• your password — stored only as a salted PBKDF2-SHA256 hash. The original password is never written to disk and cannot be read back from the hash.

if you use the site

• your notes — private to your account, visible only to you.
• messages you send through the contact form — visible to logged-in users of the site.
• stories and images you generate in the game — saved to your account so you can pick up where you left off.
• files you upload — stored on the server.

cookies

This site sets exactly one cookie, and only so that staying logged in works:

• name: session
• purpose: keeps you signed in between pages. Without it, every page would ask you to log in again.
• lifetime: 7 days, or until you log out.
• flags: HttpOnly (JavaScript cannot read it), Secure (sent only over HTTPS), and SameSite=Lax (not sent from other sites).

There are no advertising cookies, no analytics, no tracking pixels, and no third-party cookies of any kind. Nothing about your visit is shared with anyone.

who can see your data

• Your notes and your account — only you.
• Contact-form messages — any logged-in user of the site.
• The site operator — has access to the server, and so technically can read anything stored on it. This is a small personal site; there is no team and no data is sold or shared.

what this site does not do

• No advertising or ad networks.
• No analytics or visitor tracking.
• No selling, renting, or sharing of data with third parties.
• No profiling and no automated decision-making about you.

where your data lives

On a server owned and operated by the site's owner. Data is not sent to any cloud provider for storage or processing. AI features run on local hardware; where a request is instead handled by a public cloud AI service, the text you sent for that request is the only thing passed along.

your choices

• log out at any time — the session cookie is cleared.
• delete your notes from the notes page, at any time.
• ask for your account and its data to be removed by posting in the shared discussions.

contact

Questions about this policy, or a request to delete your data? Send a note in the shared discussions.