Privacy Policy

Overview

taro.surf is a personal art gallery. This policy explains what information the site handles and your choices. We aim to collect as little as possible.

Information we collect

From visitors, we do not require an account and do not require you to provide personal information to browse. The site stores small preference cookies for your light/dark theme and for your language, which it sets on your first visit from your browser's language, or the site's default language, and updates when you pick one. It also keeps a browser-local setting for your preferred gallery layout. It sets no advertising or analytics cookies. On the public pages, the third-party scripts and files the site loads set no cookies for advertising or cross-site tracking.

When the site owner signs in to manage the site, an administrative session cookie is set for the owner only.

Our hosting and content-delivery provider (Cloudflare) may process limited technical data such as IP address and request metadata to serve and secure the site. This is standard server operation, not tracking by us.

Some sites turn on an optional built-in analytics feature. If this site has visitor analytics enabled, it keeps aggregate counters in its own database to understand how the site is used: how often pages are viewed, which site referred a visit, visitor country, device type (desktop, mobile, or tablet), and how often the download button is pressed. These are counters, not profiles: they use no cookies, store no IP addresses, and keep no records tied to an individual visitor, and none of it is shared with any other site or service. The page-view, referrer, country, and device counters are deleted after about 35 days, the next time someone visits the site or the weekly cleanup runs. The download count is kept as a simple running total. The same feature also keeps a short diagnostic record of recent errors (the request path, the HTTP status, and an error message with personal details removed), limited to the newest 200 entries and visible only to the site owner.

When the site is served through Cloudflare, Cloudflare may add its own Web Analytics script to pages. It measures page views and performance for the site owner. Cloudflare states that this script uses no cookies, does not identify individual visitors, and does not track them across sites.

Artwork and third-party attribution

taro.surf displays artwork and attributes it to the artists who created it, which may include their names, handles, and links to their profiles. Fursuit photographs may be attributed to their photographers, and 3D avatar models to the artists who modeled, rigged, or textured them.

Profile pictures shown on the site are normally copied to our own storage, but when a copy is unavailable your browser loads the image from the host it lives on (for example X, Bluesky, or our upload provider), which receives your IP address and the page you are viewing.

The site also publishes a feed of newly added work at /feed.xml, listing titles, thumbnails, and artist and photographer credits. Feed readers and similar services fetch that feed and may keep their own copies, which this site cannot delete.

If you are an artist, photographer, or other rights holder featured here and want your attribution corrected or your work removed, contact us and we will act promptly. Removal covers the copies this site itself hosts.

How information is used

Preference cookies are used only to remember your display preferences. Any technical data handled by our provider is used to operate, secure, and troubleshoot the site.

We do not sell or share personal information, and we do not use it for cross-context behavioral advertising.

Service providers

We rely on infrastructure providers to run the site, which may include Cloudflare (hosting, CDN, Web Analytics, and storage for images, video clips, and 3D avatar model files), on some sites a file-upload provider, and, where email is configured, an email delivery provider (Resend) that processes the site owner's account email for messages such as password resets. They process data only to provide these services.

Sites running this software are typically built and maintained with AI development tools, which do not run as part of the site itself, so nothing you do here is sent to those tools as you browse. When the site owner or their developer is diagnosing a problem, the operational data they share with development or code-review tools can include server logs and database records, and those logs can contain request data such as IP addresses, page URLs, and browser user-agent strings.

For this site those tools are Anthropic's Claude, which writes and debugs code under the developer's direction, and CodeRabbit, a code review service that reads proposed changes.

For specific features the site also talks to Cloudflare Turnstile (bot protection on the sign-in page), Telegram (importing sticker packs), cons.fyi (convention listings), X (formerly Twitter) and Bluesky (fetching the profile pictures shown on this site; X is also asked which picture a post carries), entail.dev (an image classifier that suggests tags for artwork from its source post or the picture in it), FurTrack (importing fursuit photos), FuzzySearch (finding where a piece was posted; when the site owner asks for a lookup, a copy of that image is sent, including images not published on this site), and the shared artist registry (syncing artist credits; the registry receives this site's name and hostname as part of the sync). The site contacts these services to run the feature; they are not used to track visitors.

Your privacy rights

Depending on where you live (for example, under the California Consumer Privacy Act, as amended by the CPRA), you may have the right to know what personal information is held about you, to request its deletion or correction, and to not be discriminated against for exercising these rights. Because we do not sell or share personal information, there is no "opt out of sale/sharing" to exercise.

To make a request, contact us. You can reach us using the contact options provided on this site. We will respond within the time frame required by applicable law.

Do Not Track and Global Privacy Control

Some browsers and extensions send a "Do Not Track" (DNT) or Global Privacy Control (GPC) signal. This site does not act on them. We do not sell or share personal information as the California Consumer Privacy Act defines those terms, and we do not use it for cross-context behavioral advertising, so these signals have no opt-out to carry here. The theme and language cookies described above remember your display preferences. They do not follow you to other sites.

Data retention and security

We keep information only as long as needed to operate the site, and we use reasonable measures to protect it. No method of transmission or storage is completely secure.

If visitor analytics is enabled, the error log keeps only the newest 200 entries, and the page-view, referrer, country, and device counters are deleted after about 35 days, the next time someone visits the site or the weekly cleanup runs. Your browser deletes the theme cookie 1 year after the site last sets it, and the language cookie about 400 days after the site last sets it. The site owner's account email is kept until the owner changes or removes it.

Children

This site is not directed to children under 13, and we do not knowingly collect their personal information.

Changes to this policy

We may update this policy from time to time. The current version is always the one published on this page.

Contact

You can reach us using the contact options provided on this site.