The legal part
Privacy policy
What this site keeps and what it doesn’t, how the contact form handles your message, and what happens once you click a link that leads to another site.
Last checked 25 September 2026
In brief: the site is static, with a single exception, the contact form. You won’t find accounts, tracking pixels or an ad network. Everything there is to know is set out below.
What your browser keeps
Two small preferences are saved in your browser’s local storage. They aren’t cookies, they never leave your device, and we have no way of reading them:
- Age confirmation, so the 18+ notice doesn’t come back on each page.
- Sidebar state, meaning whether you folded the navigation away.
Both disappear when you clear your browser data. Nothing breaks without them: the age notice just shows up again.
How the contact form works
There is a form on the contact page. Nothing else on the site sends data anywhere, so here is exactly what it does.
- What it collects: the name, email address and message you enter, and the topic you choose from the list.
- Where it goes: directly to a single mailbox we read, as an email. Your address becomes the reply-to address, which is how we answer you.
- What is added to it: your IP address and the time, written into the body of the email, purely to deal with spam.
- Where it is stored: the message itself, only in that mailbox. No database, no CRM, no mailing list, and no third party receives any of it.
- Anti-spam: a hidden field that bots usually fill in, a check on how quickly the form is sent, and a limit of three messages every ten minutes for each IP address. To enforce that limit the server keeps a small file named after a SHA-256 hash of your IP address, never the address in readable form, holding only the times of your latest messages. Times older than ten minutes are dropped the next time a message arrives from the same address; the file itself stays on the server and is not deleted automatically.
Want a message you sent deleted? Just ask in a reply and we will do it.
What the server logs
Like any web server, ours keeps standard access logs: IP address, timestamp, the URL requested, the referrer and the browser’s user-agent. They are there for security and for tracking down faults. Logs are not tied to anyone’s identity, and they are not shared.
Analytics tools
There are none as of writing. Should any be added, this page will say so, naming the provider, before they are switched on.
Links to other sites
Certain links to Candy AI carry tracking, and this site may earn a commission through them. Clicking one takes you to another company’s website, where their privacy policy applies instead of ours. They don’t send your personal data back to us, only aggregate figures on whether a referral took place.
Minors
The products covered here are for adults, and the site is meant for people aged 18 and over. It is not aimed at children, and we never knowingly collect information from them.
Getting in touch
Anything you want to ask about this policy can go through the contact page.