Privacy

This page details how the values we committed to are implemented in practice: no tracking, no accounts, no cookies.

What we do not collect

Boxdex is a static site. We do not create user accounts, track your browsing, set cookies, or load third-party tracking scripts (no Google Analytics, no Facebook pixel, no ad networks). Browsing transmits no personal data to third parties. The only exception is the optional contribution form, detailed below.

Local storage

Your theme preference (light/dark) and stack state are saved in your browser's localStorage. This data never leaves your device.

Contributing a box

Browsing never sends us anything. The one exception is the optional "Add a Box" form: the only page on the site that transmits data, and only when you press submit.

A submission (box data, build notes, uploaded files, and the optional author field) becomes a public pull request on GitHub. It is visible to anyone and stays in the repository's git history even after edits, so do not include personal information you would not publish yourself. GitHub processes it under GitHub's privacy statement.

On the live site the form is guarded by Cloudflare Turnstile, an anti-bot check and the only third-party script on the site, loaded on that page alone. Cloudflare evaluates technical browser signals to tell humans from bots, and our endpoint forwards your IP address to Cloudflare once to verify the result. Cloudflare's privacy policy below applies.

We store nothing ourselves: there is no database and the Worker keeps no copy of your submission. The pull request is the only record.

Cloudflare

The site is hosted on Cloudflare (R2 + Workers). Per request, Cloudflare's infrastructure logs:

This is standard infrastructure logging, handled by Cloudflare, not by us. We have no access to raw request logs.

The tradeoff is more about scale: a lot of the web's traffic now passes through a handful of companies like Cloudflare, and it's a US company subject to US jurisdiction. We use it anyway: the free tier covers a project with no revenue, it handles traffic at a scale we couldn't match on our own infrastructure, and it keeps the operational side simple for something run in spare time. Serving a static site from shared edge infrastructure also avoids running a dedicated server around the clock, which is a more efficient use of energy for what is mostly light traffic.

To limit what Cloudflare sees, use a VPN (Mullvad · ProtonVPN) or Tor for stronger anonymity.

See Cloudflare's privacy policy for details.

Your rights (GDPR)

We do not store personal data about you. If you have a question, reach us via GitHub Issues.

If you read this far, you probably also read datasheets for fun. You're one of us.
See you in the issues.