Privacy Policy

Short version: no accounts, no ads, no cookies, and nothing sold or shared for advertising. Two Cloudflare services see limited data — visitor statistics that skip you if your browser sends Global Privacy Control, and a bot check that runs only after you accept these documents. To keep floods off the site, requests are counted per network address for a few seconds, then forgotten. Your settings stay in your browser.

Who runs this site

SoftHarbor is a non-commercial project run by an individual developer, poli0981 (SkullMute), in Vietnam, who decides how the little data described here is handled. Privacy questions: privacy@poli0981.dev.

What stays in your browser

These are kept in your browser's localStorage and never sent anywhere; clearing this site's data removes them:

• sh:legal — the version of these documents you accepted;
• sh:human — until when the bot check below counts as done;
• sh:lang — that you answered the language suggestion;
• sh:theme, sh:scrollbar, sh:motion, sh:keys — your display choices.

A service worker also stores the offline page and the site's styles and fonts, so the site still opens without a connection. There are no cookies.

Visitor statistics

We use Cloudflare Web Analytics to see which pages are read and how fast they load. It sets no cookies and stores nothing in your browser. When a page loads, a script from Cloudflare reports the page address, the address you came from, page-load timings and your browser's user-agent string; Cloudflare derives a country from your connection and shows us totals only — we never see individual visits or IP addresses.

It does not run at all if your browser sends Global Privacy Control, nor on any host other than softharbor.net. We use it out of a legitimate interest in knowing whether the site works and is used.

The bot check (Cloudflare Turnstile)

After you accept these documents — never before — the gate runs Cloudflare Turnstile once to tell people from automated traffic. It usually finishes on its own; occasionally it asks for a click. Turnstile runs in a frame from challenges.cloudflare.com and evaluates signals from your browser and device; Cloudflare states that it uses them only to tell people from bots, not to track you or to target advertising.

The one-time token it produces is sent to this site's verification endpoint, /api/verify, which forwards it — with your IP address — to Cloudflare's Siteverify service to confirm it. To prevent abuse, the endpoint counts requests per IP address (per /64 network for IPv6) for one minute. We keep no record of either: the endpoint logs only whether a check succeeded and how long it took.

A pass is remembered in your browser for 48 hours (sh:human). If the check cannot run — blocked, offline, or our endpoint is down — you are let in anyway, and it is tried again after an hour. We use it out of a legitimate interest in keeping automated abuse off a public service.

Rate limiting

So that one runaway script cannot crowd everyone else out, this site's own code counts the requests for its pages, feeds and data per IP address (per /64 network for IPv6) over a window of a few seconds. A network that sends far more than anyone reading the site would gets a "Too many requests" page until the window passes. The counts are held by Cloudflare's rate limiter for that window only; we keep no record of addresses — when a request is refused, the log says only that it happened. We do this out of a legitimate interest in keeping a public service available to everyone.

Hosting

Cloudflare serves the site and the endpoint above. As a network provider it processes connection data, such as IP addresses, to deliver and protect the site, under its own privacy policy. We do not receive those logs; Cloudflare shows us aggregate request counts.

If you email us

Addresses at poli0981.dev are delivered to a mailbox hosted by Google. We use your address and message only to deal with what you wrote, and delete them once they are no longer needed for that — or sooner, if you ask.

Bug reports

"Report a bug" is a link to a prefilled GitHub issue form. Its address contains the page's URL, your browser's user-agent string and recent error lines from this site, so GitHub receives them as soon as you open the link. Nothing is filed until you review and submit the form, under GitHub's terms and privacy policy — remove anything you would rather not share first.

Other sites

Links to developers' sites lead to services with privacy policies of their own.

Your choices and rights

Turn on Global Privacy Control to switch the statistics off; block challenges.cloudflare.com if you prefer — the gate still lets you in. Clearing this site's data removes everything stored in your browser. We hold nothing that identifies you except email you send; to see, correct or delete it, or to object to anything here, write to privacy@poli0981.dev. You may also complain to your data protection authority.

Changes

When this policy changes, the date above changes with it, and the gate asks everyone to accept the new version.