Privacy

What we record when you look at the mosaic

When the artwork finishes loading, your browser sends us one short message saying it did. It sends another if you rest the pointer on a tile long enough to read who it is — about four tenths of a second, the same moment the label appears — and another if you click one. The site directory, the archive and each site's own page count the same two things: one message when the page loads, one if you follow a link to somebody's site. Each message writes a single row, which holds:

• whether it was a view, a pause on a tile, or a click, and which day's artwork it belongs to — a page view of the directory belongs to no artwork, and nor does a look at an archived day or at one site's page, which are pictures of a board rather than that board being shown. All three are stored as nothing rather than as a guess;
• which of our pages it came from — the mosaic, the directory, the archive or a site page;
• if you arrived by following one of our own links, which kind it was — one of five words (mosaic, day, tile, embed, related) that we put in the link ourselves: the first three when somebody pressed share, the fourth on our embeddable widget's link back here, and the last on a card in a site page's “keep exploring” row. It says which of our links was followed, not anything about you. We do not record the address of the page you came from: browsers offer that, and a referring address from a search engine can contain what you typed, so we do not store it;
• and, separately, one row when somebody presses share — which page they pressed it on, and which site's tile if they were sharing one;
• for a pause or a click, which advertiser's tile it was;
• if you follow the “presented by” link on a sponsored day, that it was followed and which day's artwork it was on — there is no advertiser attached to that one, because a sponsor has no tile;
• a coarse region — one of about a dozen groups such as WEST_EUROPE or EAST_ASIA, worked out from your browser's language header. It is not a city, a country or a coordinate. The same header decides which region's board the home page shows you, and which language it opens in — read on the request and not kept for that;
• a SHA-256 hash of the IP address the request came from;
• one of three words for the kind of device it came from — phone, tablet or desktop. Your browser announces itself on every request it makes anywhere, in a line detailed enough to say which version of which browser on which operating system; we read that line, reduce it to one of those three words, and keep only the word. The line itself is never stored, because it is distinctive enough to help single a person out and the word is not. It is there so we can tell whether the phone version of the board actually works, which we had no way of knowing before.

We do not claim that hash is anonymous. An IP address is short enough that anyone holding both a hash and a candidate address can test one against the other, so a hash is a pseudonym, not a disguise. It means we cannot read an address back out of our own database, and that we never store the address in the analytics table — nothing stronger than that. We treat these rows as personal data and describe them here for that reason.

We also keep one counter per day and region in our cache, so the ticker under the artwork can say how many people looked at it. To count people rather than page loads, your browser makes up a random number for the tab you are in and includes it with that message. It is kept in session storage, which means it is gone when you close the tab, it is never sent to us on its own the way a cookie would be, and it has nothing whatsoever attached to it — no name, no history, no link to any other day. The counter itself keeps no list of those numbers, only a tally, and expires after seven days.

A tile is counted at most once per visit however long you look at it or however often you come back to it, so this is a count of what you looked at, not of how you moved the mouse. We also drop these messages when they come from something that identifies itself as a bot or a crawler, and one address can only add so many pauses and clicks to one tile in a day. That is there to keep an advertiser's numbers honest, not to identify anybody.

Abuse counters

To stop one person flooding the board with junk listings, we count requests per address: how many times a form has been submitted in the last hour, and how many sites have been registered from that address today. These counters live in our cache, are keyed on the same SHA-256 hash described above rather than on the address itself, and expire on their own — within the hour for the first, within a day for the second. They hold a number and nothing else: no record of what was submitted, and no way to list what an address has done.

One cookie you ask for, no accounts, no third-party trackers

Visiting sets no cookies at all, so there is no consent banner to click away. There is exactly one cookie we can set, and only when you ask for it: if you choose a language from the list at the foot of a page, a cookie called lang holding that two-letter code (such as vi) is saved for a year so the home page opens in it next time. It holds nothing else, it is not used for counting, and it is never set because of what your browser announces — only because you clicked. Clearing it, or choosing English, puts things back. Beyond that, the per-tab number described above — and, if you play a visual experience, the list of the ones you finished in that tab — are the only things we put on your device, and neither survives the tab being closed. We run no analytics product, no advertising pixel and no session recorder — the counting is ours, it stays on our own servers, and nothing follows you from this site to another one. Even the typefaces are served from this site rather than from a font provider, so opening a page here makes no request to anyone else at all.

Where your address does exist: our own logs

Our web server writes ordinary request logs, and those do contain the raw IP address for a short period. They exist to debug faults and to spot abuse, they are not joined to the analytics table, and they are not used to build any profile.

Clicking a tile opens that advertiser's own website in a new tab, directly, with no ad network and no redirect in between. What that site then does is governed by its own privacy policy, not this one.

What we store if you register a website

Some listings are ones we created ourselves, from information already published on the site — see the editorial policy. For those there is no form, no email address and nothing collected from anyone: the name, address, category and the sentence beneath it are ours, written from the public page. They appear in the directory, on a page of their own and, when we have marked them for it, as a tile in the artwork and on the archived page for each day they were in it. Nobody at the site has an account, and asking us to take the listing down needs no proof and no reason — and unlike a listing that signed up, removing one of these takes its name out of the archived days as well. Everything below describes a listing that came through the form.

If you claim one of those listings as its owner, we keep what the claim form asks for — your name, your email address and anything you wrote in the message — together with the listing it is about and whether we approved it. We keep it because it is the record of a decision to hand a listing to somebody, and because the address is where the report link goes. It is not filed with the view and click records above and carries no address hash or device: you have told us who you are, so a pseudonym beside it would be a pretence. Approving a claim also sets that address as the listing's contact if it had none. Ask us and we will delete the claim.

Registration is a form, and we keep what the form asks for:

• the site's name, address and category;
• one optional sentence describing it, if you write one — it is shown on your card in the site directory;
• your logo image, if you upload one — trimmed and re-encoded, then stored by us;
• an email address, if you give one — it is optional, and it is how we reach you about your listing;
• the tier and duration you chose, and the dates your listing runs;
• for a paid listing: what it came to, whether it has been settled, when, and how coarsely — “bank”, “paypal”, “cash” or “other”. No card number, no account number, no payment reference; there is no checkout on this site and nothing here could charge you;
• counts of views, pauses and clicks on your own tile;
• how many times your report link has been opened, and when it last was.

Those counts are shown back to you on a private report page, at a link we send when your listing is approved. The link itself is the only key to it — there is no password — so anyone you forward it to can read the same numbers. If it reaches someone it should not have, ask us and we will issue a new one; the old link stops working the moment we do. It shows how many people saw each day's artwork your tile was in, how many paused on your tile long enough to read it, and how many clicked through to your site. It never shows who they were, because we do not know. We do count how many times the page itself is opened — that is a number about your listing, so that we can tell whether the report is worth keeping; because the link has no password, it cannot tell you apart from anyone else holding it.

The name, the link, the category, the description and the logo are published — that is the point of a listing. They appear on the tile, in its tooltip, on your card in the site directory, on a page of your own listing every mosaic you have been part of, and on the archived page for every day your tile was in the picture — all public pages that search engines and assistants are meant to read. The archived days are permanent. Ending a listing removes it from the board and from the directory; it does not remove it from the days it was actually part of, because those pages are a record of what was published. What we do drop from them is the outbound link, so a delisted site keeps its place in the picture without still receiving visitors. Your email address is not published and is not shown to other advertisers. It goes to our mail provider when we write to you, and it appears in the private notice we get when you register, described below.

We use it for one thing: writing to you about your own listing — that it was approved or declined, that it is about to expire, or to answer something you asked us. There is no newsletter and no marketing list.

If you meet Pixeloom on somebody else's website — we offer a small widget that other sites can embed — we count that it was shown, and we count the website's address, but never the two together with anything about you. The widget's address is kept as a plain daily tally: a date, a domain like example.com, and how many times it was shown and clicked. There is no address, no hash and no identifier of any kind in that tally. The separate row we write about the visit — the one carrying the hashed IP described above — records only that it came from an embed, never which site it was on. So “this person was reading that site” is a sentence we cannot produce.

Two details, because they are what make that true rather than merely intended. Your browser sends us only the domain of the page you were on — the address is trimmed before it leaves your device, so the rest of the URL never reaches us at all. And if the site you were on hides even that, the tally records it as unknown and we do not go looking.

If you play one of our visual experiences — the short illusions and experiments — we count what happened as plain daily tallies: that one was started, finished, played again, and which answer was picked when it asked what you saw. Those tallies hold a date, the experience and a number, and nothing about who you are: no address, no hash, no device, no session. Your answer is a game answer; we do not treat it as anything about your eyesight or your health, and we could not tie it back to you if we wanted to.

Two small things make the counts honest. So one person cannot vote a hundred times, the first answer from an address to a question each day is the one that counts; to know that, we keep a SHA-256 hash of the address in our cache for two days, beside the question and nothing else, and then it expires by itself. And so we can tell whether people go on to a second experience, your browser keeps a list of the experiences you have finished in this tab, in session storage, and tells us only whether this is the first or the second one — never the list. It is gone when you close the tab.

If you use Challenge a friend at the end, the link it makes says how you did, as one of three words we chose — saw, fooled or played — and never which answer you picked. We read that word when the link is opened, to word its preview and the challenge your friend sees; we do not store it or count it, and it is in the link only because you chose to send it.

If you play a challenge — a few of those pictures in a row, with a score at the end — we count the same kind of daily tallies for it: that it was started, finished, played again or shared, and how many finishes scored each result (“3 of 5”). The score is counted once per address per challenge each day, using the same two-day hashed key as the answers above; nothing else about you is kept beside it. Your answers inside a challenge also count towards each picture's own answer tally, as if you had played it on its own. If you send the score to a friend, the link carries the number (k=3) and never which pictures you got — we read it to word the preview and do not store it.

How long we keep things

• Your listing — for as long as it runs, and afterwards as part of the record of which mosaics it appeared in. Ask us and we will delete it.
• View, pause and click rows — 90 days, then deleted automatically by a nightly job. They carry no name and no email; the hash is the only identifier in them, and deleting the row deletes the hash with it.
• Per-day totals for each advertiser — kept indefinitely, because they are what makes an old mosaic's numbers true after the rows behind them are gone. They are counts and nothing else: a date, an advertiser, and how many times each thing happened. There is no identifier of any kind in them.
• The viewer counter — seven days, then it expires by itself.
• Abuse counters — an hour, or a day, then they expire by themselves.
• Visual experience and challenge tallies — kept indefinitely, as counts with no identifier in them. The hash that stops repeat votes and repeat scores expires after two days.
• Server logs — rotated in the ordinary way and not retained long-term.

Where it lives, and who can see it

Everything sits in our own PostgreSQL database and Redis cache, on servers we run. There is no third-party data warehouse and no analytics vendor. Access is limited to the people operating Pixeloom.

When we email you, the message passes through whichever mail provider we have configured for outbound SMTP; they handle it to deliver it, in the same way any mail provider does. We do not sell, rent or trade personal data — not the advertiser table, and not the event table.

Registering, and every later change to your listing's status, also posts a short notice to the private chat the people running Pixeloom use to keep track of submissions. It carries the site's name, address, category and plan — the same details that appear on your tile once the listing is approved — and, if you gave one, your email address, so we can reply to you about the listing. The notice travels through Telegram, which handles it to deliver it. It goes to us and nobody else; it is not a public channel.

We will hand over data if we are legally required to. If that ever happens and we are permitted to tell you, we will.

What you can ask for

Write to [email protected] and we will act on any of these:

• a copy of what we hold about your listing;
• a correction — a wrong link, a stale logo, a changed category;
• deletion of your listing and its details;
• deletion of event rows: tell us the IP address you used and roughly when, and we can find and remove the matching rows — we cannot search by hash alone without the address to hash. Anything older than 90 days has already gone by itself.

We do not require you to prove an identity you never gave us in the first place. For a listing, a request from the email on file, or from an address at the domain itself, is what we act on.

Children

Pixeloom is not directed at children, and registering a website is something a business or a site owner does. We do not knowingly collect anything from a child.

Changes

If what we collect changes, this page changes with it and the date below moves. Material changes — new categories of data, a new recipient — will be said plainly here rather than buried in a revision.

Contact

Privacy questions go to [email protected], the same address as everything else. The contact page says what else that inbox is for, and the terms cover the rules of a listing.

Version 1.5 · effective September 23, 2026