Draft, to be checked
Privacy
Who is responsible
Kaitlynn A. Hawranke, Switzerland, contact@kah.design. This is the contact for every question about your data on this website. The Swiss Federal Act on Data Protection (FADP) applies. For visitors from the European Union the GDPR may apply as well.
In short
- No analytics, no tracking, no advertising.
- This website sets no cookies.
- It keeps a few small settings in your own browser, listed below. They are not sent to anyone.
- There is no account, no newsletter and no form that sends data to a server.
Hosting and server logs
The website is hosted on Cloudflare Pages, a service of Cloudflare, Inc. (USA). When you open a page, your browser sends technical data to Cloudflare so the page can be delivered and protected against attacks: your IP address, date and time, the address you asked for, the page you came from if your browser sends it, and browser and device details. Cloudflare processes this data on its servers, also outside Switzerland and the EU. I do not keep server logs of my own and I do not combine this data with anything else.
[To check: Cloudflare's data processing terms, how long Cloudflare keeps this data, and whether Cloudflare's bot protection is switched on for the domain. If it is, Cloudflare can set a technical security cookie.]
Cookies and storage in your browser
This website itself sets no cookies. It stores the following in your browser. Nothing of it leaves your device and you can delete it at any time in your browser settings.
| Name | Where | What for | How long |
|---|---|---|---|
kah-theme | Local storage | The mode you chose (Paper, Ink, Blueprint or Glass), so the pages open in it again | Until you delete it |
kah-404-concept | Local storage | Only on the "Page not found" page: which of its three versions was picked with the small Prototype control | Until you delete it |
kah-loader | Session storage | That the opening animation has played, so it is not shown again in the same tab | Until you close the tab |
kah-mode-pulse | Local storage | That the hint on the mode button has been shown, so it is not shown again | Until you delete it |
kah-room-hint | Session storage | That the hint in the gallery room has been shown | Until you close the tab |
kc-lock-visit | Session storage | Only after you have opened a section with a passcode: a random word that marks this visit. It is not the passcode and opens nothing by itself | Until you close the tab |
kah-lock | IndexedDB | Only after you have opened a section with a passcode: the key that keeps it open, in a form that cannot be read out. See "Sections with a passcode" | This visit, or 30 days if you tick the box |
Fonts
The fonts are files on this website. No font is loaded from Google or from any other company.
Other files loaded from elsewhere
The 3D room of the gallery and the 3D stages on two project pages load the library three.js from the public network jsDelivr (cdn.jsdelivr.net). Your browser sends your IP address and the usual technical data to that network when one of these parts starts.
Films and 3D scenes from other services
Some project pages can show a film from YouTube (in its privacy mode, youtube-nocookie.com) or Vimeo, or a 3D scene from Spline. Nothing is loaded from these services when you open a page. Only when you press play or open the scene does your browser connect to the service. From then on that service receives your IP address and may set its own cookies. Its own privacy terms apply.
Client websites in the drawer
Some project pages have a tab "Visit website" at the bottom. Nothing is asked from the client's website when you open the project page. Only when you open the drawer does your browser load that website inside the page, and one extra request checks whether it answers. From then on that website receives your IP address and browser details, and it can load its own scripts and set its own cookies, as if you had visited it directly. It is not told which page you came from. Its own privacy terms apply. Today these are www.hoshii.ai, payprweight.com, trspa.org, purposelabs.ai, sovara-labs.com, www.kallistik.com and blakeandboky.com. For other projects the tab only offers "Open in new tab", and nothing is contacted until you follow that link.
Links to other websites
The website links to my profiles on LinkedIn, Instagram, Behance and GitHub, to Nemu & Co., to websites of clients and partners, and to a booking page for a call (book.nemu.agency; the link page uses a booking page run by Motion, app.usemotion.com). Nothing is sent to any of them until you click a link. After the click the privacy terms of that website apply.
Email and the brief in the Contact section
Email links open your own mail app. The short brief in the Contact section works the same way: your answers stay in your browser, and at the end the website opens a prepared email in your own mail app. The website sends nothing to a server. If you send me that email, or any other, I use what you write to answer you and to handle your request, and I keep the correspondence as long as that takes.
Sections with a passcode
Some project sections are confidential and locked. Their content sits in the page in encrypted form. When you type the passcode, your browser decrypts the section on your device. The passcode is not sent anywhere and is not stored.
So that you are not asked again on every page, your browser keeps a key made from the passcode. It is kept in a form that cannot be read out or copied (a non extractable key in the browser's IndexedDB storage, named kah-lock), and it never leaves your device. One correct entry opens the locked sections of the other projects that share the passcode. For that, a page with a locked section loads a short list of technical values from this website itself, none of them secret.
- Without the box "Keep this unlocked on this device for 30 days" the key is for this visit only: it stops working when you close the tab and expires after 12 hours at the latest.
- With the box ticked, the key is kept for 30 days.
- "Lock again on this device" removes every stored key at once. Deleting the website's data in your browser settings does the same.
"Request access" opens a short form for your name, your email address and, if you like, your LinkedIn profile. When you press the button, the website prepares an email to contact@kah.design, opens it in your own mail app and copies the same text to your clipboard. The website itself sends nothing and stores nothing: your request only reaches me when you send that email.
Your rights
You can ask what personal data about you I hold, and ask to have it corrected or deleted. Write to contact@kah.design. You can also turn to the data protection authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU the authority of your country.
Changes
This page is updated when the website changes. The date at the top says which version you are reading.