Privacy
What we collect, and what we don't
Short version: we count how many people open each page and how many tap through to Amazon. We do not use analytics services, advertising trackers or cookies for visitors, and we do not build profiles of anyone.
What we record when you visit
For each page view and each tap through to Amazon we add 1 to a counter. Specifically we store:
- a daily count of page views and outbound clicks, per product;
- the hour of day (UTC) the visit fell in, as a number from 0 to 23;
- a single word describing where the visit came from — pinterest, direct, search, instagram and so on.
That last one is worked out from the referrer your browser sends. We read it, match it against a short list of known sources, keep the label and discard the rest. The full referring URL is never written down.
We do not store your IP address, your browser's user agent, your device, your location, or anything that could identify you. The records are plain numbers with no identifiers attached, so they cannot be traced back to a person — not even by us.
There is no analytics service involved. No Google Analytics, no Meta pixel, no heatmaps, no session recording, no fingerprinting, no advertising network.
Cookies
Visitors are not given a cookie. You can browse the whole site without one being set — there is no consent banner here because there is nothing to consent to.
A single cookie (cleancozy_sid) is set only when someone signs in to the private
management area. It holds a random session identifier, nothing else, and it is deleted when the
browser closes or the person signs out.
Where your browser talks to someone else
We host no images or scripts of our own beyond this site. A few requests do leave for other companies, and those companies can see your IP address as a result:
- Amazon
-
Product photos are served from Amazon's image servers (
m.media-amazon.com), so your browser fetches them directly from Amazon. Following a product link takes you to Amazon, where Amazon's own privacy policy and cookies apply. - Google Fonts
-
The two typefaces used here are loaded from
fonts.googleapis.comandfonts.gstatic.com, which means Google receives your IP address as part of that request. No cookie is set by it. This can be switched off in the site settings, after which the site uses the fonts already on your device instead. - We use Pinterest's API to publish and read our own pins, authorised by our own Pinterest account. Nothing about you is sent to Pinterest by this site. If you arrived from a pin, Pinterest already knows that because you clicked their link, not because we told them.
- Our web host
- Like every website, the server that delivers these pages may keep short-lived technical logs that include IP addresses. Those logs belong to the hosting provider, are used to keep the server running and secure, and are not part of the statistics described above.
Affiliate links
As an Amazon Associate we earn from qualifying purchases. Prices and availability are set by Amazon and can change at any time.
Product links on this site carry an Amazon Associates tag. If you buy something after following one, Amazon may pay us a small commission. It never changes the price you pay. We do not receive your order details, your name, or anything else about your purchase — only an aggregate report of how many qualifying orders happened.
People with an account here
For the handful of people who can edit this site, we store:
- a username and a hash of the password (the password itself is never stored and cannot be recovered from the hash);
- which account created or last edited each product, so we can see who found what;
- if Pinterest is connected, the access and refresh tokens for that account;
- a counter of recent failed sign-in attempts, to slow down guessing. The address that attempted it is stored only as a salted one-way hash, so it cannot be read back;
- a salted one-way hash of the addresses we sign in from, kept for 30 days, so that our own visits are left out of the statistics. Same as above: hashed, never readable, and only ever recorded for an address that has successfully signed in.
Photos uploaded to create a pin are held only until the pin has been published, then deleted. Anything left behind is removed automatically within six hours.
How long we keep things
- Daily statistics
- 120 days, then deleted automatically.
- Per-product totals
- Kept while the product exists. These are single numbers, nothing more.
- Uploaded pin photos
- Until the pin is published; at most six hours.
- Failed sign-in records
- Roughly ten minutes.
- Our own device hashes
- 30 days from the last sign-in, then dropped automatically.
- Editor accounts
- Until the account is removed.
Your rights
Where the GDPR or the Swiss FADP applies, you have the right to ask what personal data is held about you, to have it corrected or erased, and to complain to a supervisory authority.
In practice, we hold no personal data about visitors, so there is nothing for us to hand over or delete — the statistics contain no identifiers of any kind. If you hold an account here, or you believe we have something of yours, please contact the site owner and we will sort it out.
Changes
If how we handle data changes, this page changes with it. It describes the software as it is actually deployed, not a generic template.