Privacy policy

Evolumes is the controller for the data described here. Write to privacy@evolumes.xyz with any question or request about your rights.

For every page view: the page path without its query string, the page title, the referring site, your browser, operating system and device type, screen size, browser language, and an approximate country, region and city.

A pseudonymous visit identifier derived by hashing the site id, your IP address, your browser user agent and a secret salt that is replaced every day. Because the salt changes daily the identifier cannot be linked across days. It is pseudonymous, not anonymous, and we treat it as personal data.

No cookies are set for analytics. We use two entries in your browser’s local storage: one remembers the choices you made here, the other is the flag that switches measurement off when you object. Both stay on your device and are never sent to us.

If you pick a language with the language switcher, a cookie named lang remembers it so the site opens in that language next time. It holds only the language code and is not used for measurement.

Clearing your site data removes all of them, and the site will ask again.

Your IP address is used in memory to derive the daily identifier and an approximate location, and is never written to our database.

No session recording, no keystrokes, no page content. Session replay is switched off in the analytics server configuration and the collection endpoint rejects replay data while it stays off.

What you type into the bestiary search travels in the address bar, so query strings are stripped from both the page address and the referrer before anything is recorded.

No cross-site tracking, no advertising or marketing profiles, no analytics company involved, and no analytics data leaving the European Economic Area. Nothing is used for automated decision-making or profiling in the sense of Art. 22 GDPR.

If you turn the heatmap on, we also record the coordinates of your clicks, the size of your window and page, and how far down a page you scrolled. It is aggregated to show which parts of a page get used.

It stays off until you switch it on, and you can switch it back off at any time. Withdrawing stops the collection at once and does not make the earlier collection unlawful.

Visit measurement rests on our legitimate interest in understanding and improving our own site (Art. 6(1)(f) GDPR). It is limited to aggregate audience measurement for this site alone, sets no cookie and builds no profile. You can object at any time with one click, and we act on it from that moment; page views recorded before you objected stay until their retention period runs out.

The heatmap rests on your consent (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy Directive). Withdrawing it has no consequence other than stopping the collection.

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, hosts the server the site and the analytics run on.

There is no other recipient. Nothing we measure is sold, shared with advertisers or transferred outside the European Economic Area.

On a server we rent from Hetzner in Germany. The analytics software runs on that machine and no analytics data leaves it.

Visit measurement is deleted after 13 months. Heatmap data is deleted after 90 days. Deletion runs automatically every day.

You may object to visit measurement or withdraw heatmap consent at any time using the choices below; both take effect in your browser immediately.

You have the right of access, rectification, erasure, restriction, portability and objection, and the right to complain to a supervisory authority in the country where you live or work.

Analytics data carries no name and no email address, so we normally cannot tell which records are yours (Art. 11 GDPR). If you want us to try, send us your IP address, your browser user agent and the date: the identifier is reproducible, so we can find and delete records from the same day. Older days used a different secret salt and cannot be resolved.