⚠ UNDER CONSTRUCTION ⚠ this personal prototypical project is perpetually a work in progress ⚠ UNDER CONSTRUCTION ⚠

🔒 Privacy Policy

Last updated: 4 September 2026

This is a personal website. I'm not selling anything, I'm not running ads, and I'm not building a profile of you. There's no analytics script, tracking pixels, advertising cookies, or anything of the like anywhere on diaduck.xyz.

That said, a few things do involve your data, so here's the honest rundown of it all.

Why does a personal website even have one of these? The guestbook, mostly. The moment I started publishing other people's names, avatars, messages, and personal websites out to the whole internet, I stopped being someone with a hobby site and became what UK and EU law calls a data controller -- the "it's just a personal thing" exemption doesn't stretch to broadcasting someone else's details to an indefinite audience. That comes with an obligation to tell you plainly what I collect and why. Hence this page.

🧑 Who's responsible

Dia, running diaduck.xyz from Manchester, UK. You can reach me at dia@diaduck.xyz about anything on this page including asking me to delete your data.

🌐 Just browsing

The site is hosted on Cloudflare Workers. Like any web host, Cloudflare handles the technical details of your request -- your IP address and browser user-agent, as well as which page you asked for -- to actually serve the page and to protect the site from abuse. I don't store those logs myself, and I don't have a dashboard of who visited what.

I don't set any analytics or tracking cookies. If you never sign in with Discord -- to sign the guestbook or to comment on a post -- this site sets no cookies at all.

The one thing the site does keep in your browser is your theme. Picking one from the dropdown saves it to local storage under the key theme, so the site looks the way you left it next time. That isn't a cookie: it never gets attached to a request, so neither I nor Cloudflare ever see it, and it stays on the device you chose it on. Clearing your site data for diaduck.xyz removes it.

📖 The guestbook

The guestbook is one of two places where I deliberately collect and keep anything -- the other is comments on blog posts, just below. There are two ways to sign the guestbook.

Signing with Discord

If you sign in with Discord, I ask Discord only for the identify scope. From that I store:

All of that except the raw ID is shown publicly on the homepage, as per the point of a guestbook. Entries live in Cloudflare KV storage, with a copy on my machine as backup.

I never see, receive, or store your Discord password, email, or access token. The OAuth token is used once, server-side, to read your public profile and is then discarded.

While you're mid-signature there's one cookie: gb_session. It holds only the profile details above, is HttpOnly and Secure, and expires after 10 minutes (or immediately once you've signed). It's strictly necessary to make the form work, it isn't used for tracking.

Signing by email form

If you use the email form instead, I collect your display name, email address, message, and optionally a website and avatar URL. These go into a pending queue that I review by hand.

How long it's kept

Guestbook entries are meant to stick around indefinitely, it's a scrapbook! But it's your entry: email me and I'll remove it, no questions asked and no explanation needed.

💬 Comments

Blog posts have comments. Signing in with Discord is the only way to leave one, so that there's a real account behind every comment. Unlike the guestbook, you can comment as many times as you like.

I ask Discord for the identify scope only, exactly as with the guestbook, and from that I store:

Everything there except the raw ID is shown publicly on the post. The ID is kept so I can apply a posting cooldown and remove someone's comments if I have to; it is not included in what the site serves to visitors. Comments live in Cloudflare KV storage.

As with the guestbook, I never see your Discord password, email or access token. The OAuth token is used once, server-side, to read your public profile, and then discarded.

Cookies

Commenting sets one cookie, cm_session. It's HttpOnly and Secure, so no script on the page can read it, and it lasts 7 days unless you sign out. It isn't a lookup key into a table of you -- it holds your Discord ID, username, display name and avatar URL directly, cryptographically signed so it can't be edited, along with the time it expires.

During sign-in only, there's a second one: cm_oauth, a random value lasting 10 minutes that exists purely so I can tell your sign-in apart from one somebody else started in your name. It's deleted the moment you land back on the post.

Both are strictly necessary to make commenting work at all, which is why there's no cookie banner -- they're the kind of cookie that's exempt from needing consent, because they do the thing you just asked for and nothing else. Neither is used for tracking, and if you never comment you never get either.

How long it's kept, and getting it removed

Comments stick around with the post. Email me and I'll delete any of yours -- no questions, no explanation needed. Signing out just clears the cookie; it doesn't remove anything you've already posted.

Comments are served by my own Cloudflare Worker, so unlike webmentions below, no third party is involved in showing them to you, other than Discord's CDN serving the avatars.

💬 Webmentions

Blog posts use webmentions via webmention.io, a third-party service. When you view a blog post, your browser fetches that post's mentions from webmention.io, so that service sees your IP address and request. Their privacy practices are their own.

If you send a webmention, or if Brid.gy forwards a like or reply you made on Bluesky or Mastodon, then your name, avatar, post content, and the URL you posted from get displayed publicly on my post. Ask and I'll remove any of it from my site, though I can't remove it from the original network or from webmention.io.

🎵 Music

The music page shows what I've recently listened to, pulled from Last.fm.

This is fully server-to-server: your browser asks my own Cloudflare Worker for the data, and the Worker fetches it from Last.fm using an API key. Last.fm only sees requests from my server about my own listening history.

Your browser never contacts Last.fm directly, and Last.fm doesn't see your IP or anything else about you.

🔗 Other people's stuff

A few pages load or link to things I don't run. When your browser loads one of these, that company sees your IP address:

Ordinary links out to GitHub, Twitter, Twitch, Last.fm, Bluesky and friends don't load anything until you actually click them. Once you're there, you're under their privacy policy, not mine.

⚙ Your rights

Under UK GDPR supplemented by the Data Protection Act 2018 you can ask me to show you what I hold about you, correct it, delete it, or stop using it. In practice that's a short list - a guestbook entry, a comment on a post, or an email you sent me - and the way to exercise any of it is the same: email me. I'll sort it out, and I won't make you jump through hoops.

My lawful basis is consent when you choose to sign the guestbook, post a comment, or email me, and legitimate interests for keeping the site online and secure. If you're unhappy with how I've handled it, you can complain to the ICO, though I'd rather you just told me first so I can fix it.

🐣 Kids

This site isn't aimed at children under 13, and I don't knowingly keep data from them. If a child has signed the guestbook or left a comment and you'd like it gone, email me and it's gone.

📝 Changes

If I add something to the site that changes any of this, I'll update this page and the date at the top. There's no explicit edit history as of writing.

Questions? dia@diaduck.xyz. 🦆