Privacy
The short version: there are no accounts, the site itself sets no cookies, and it collects almost nothing about you. The long version is below.
Cookies
The site itself sets no cookies. Cloudflare Turnstile, which we use on the guestbook and report forms, may set a strictly necessary security cookie when it challenges a visitor. Our visitor statistics are cookieless. A few small settings are kept in your own browser instead (see “Settings kept in your browser”).
Visitor statistics
We count visits with Umami, an open-source statistics tool that we run ourselves on a server we rent, so no analytics company sees the numbers. It’s cookieless: it doesn’t set cookies, and it doesn’t follow you from site to site.
For each page you read, it records the page’s address (without anything after a ? or #), its title, the website that sent you (just the website, never the page), your browser’s language and screen size, the broad kind of browser, device and operating system, and the country, region and town your connection appears to come from. A page that doesn’t exist is recorded only as “missing”, whatever address was typed. It also counts a few clicks: opening one of our archived sources, pressing Visit on a Surprise Me card, and going round the webring.
It doesn’t store your IP address. It uses it, with your browser’s details, to make a scrambled visitor code that changes every month, so we can tell one visit from another without knowing who you are. We use the statistics to see what people enjoy and to make the museum better.
The record of each visit is kept for about three months (this month and the three before it), then deleted; our backups hold it for up to two weeks longer. After that we keep only totals, such as how many people read each page in a month, so we can compare a month with the same month a year before. Anything fewer than five people did in a month is lumped together as “other”, so the totals can’t point to anyone.
If your browser sends the “Do Not Track” signal, nothing is counted. If it blocks this site’s storage altogether, nothing is counted either. You can also switch the counting off in this browser here.
The guestbook
If you sign the guestbook we store the name you type, the place you type (optional), your message and the emoticon you pick. We don’t ask for an email address, and messages that contain links are turned away. Nothing is shown until it’s been read and approved.
- Approved entries are shown on the guestbook page and kept until we remove them. To have one removed, contact us.
- Rejected entries are deleted after 30 days.
- Please don’t write personal information such as your address, school or phone number. Entries that give it away aren’t published.
Limits on how often you can do things
To stop spam, the site limits how often one connection can sign the guestbook, report a site or add to the visitor counter. To do that it mixes your IP address with a secret and keeps only the scrambled result (a salted hash). The result can’t be turned back into your address. These scrambled values are deleted after 7 days.
Turnstile
The guestbook and report forms use Cloudflare Turnstile to tell people from bots. It runs a short check in your browser and sends information to Cloudflare, whose own privacy terms apply to that check. When it challenges a visitor it may set a strictly necessary security cookie, which exists only to keep the check safe. Turnstile only loads on pages with a form.
Surprise Me
Surprise Me counts how often each site is picked. The count has no information about you.
Settings kept in your browser
These items live only in your own browser. They’re never sent to us. Clearing your browser’s site data removes them.
| Name | Kept in | What it holds | Why |
|---|---|---|---|
oi.sound | localStorage | “on”, only if you turned Sound on | Remembers that you want sound. Sound is off until you choose it. |
oi.effects | localStorage | “on”, only if you turned Effects on | Remembers that you want the moving decorations. |
oi.introSeen | localStorage | “1” once you have seen the front-door intro | So the intro isn’t shown again. |
oi.floppies | localStorage | A list of the floppy disks you have found | Fills your sticker book on the Floppies page. |
oi.surpriseSeen | localStorage | The last few Surprise Me sites you were shown | So Surprise Me doesn’t repeat itself straight away. |
oi.counted | sessionStorage | “1” after the visitor counter has counted this visit | So one visit counts once. It disappears when you close the tab. |
oi.signedIn | sessionStorage | “1” once the Messenger “signed in” toast has shown | So the toast shows once per visit. |
oi.torture | sessionStorage | Whether the hidden 1997-page joke mode is switched on | Keeps the joke on while you stay on the site. It disappears when you close the tab. |
oi.away | sessionStorage | Whether the pixel away message (from typing brb) is showing | Keeps it showing between pages until you press a key. It disappears when you close the tab. |
oi.tortureTune | sessionStorage | “1” once the joke mode’s tune has been played (only ever with Sound on) | So the tune plays once per visit, not on every page. It disappears when you close the tab. |
umami.disabled | localStorage | “1”, only if you pressed “Stop counting my visits” | Tells our visitor statistics not to count you in this browser. The statistics script checks it before it sends anything. |
localStorage keeps its value until you clear it. sessionStorage disappears when you close the tab.
Contact by email
If you email us, we receive your address and what you write. We use it to reply, and we keep the conversation only as long as it’s useful. Ask us to delete it and we will. See the Contact page.
Other sites
When you follow a link to another site, that site’s own rules apply. We choose them with care and check them every day, but we don’t run them.