privacy
What stick with me knows about you. Short version: almost nothing, on purpose. Last updated 27 July 2026.
The one thing to remember
Anything you put on a note is public forever. Please don't write your full name, address, phone number, workplace, or anything else that identifies you or someone else. The wall cannot un-know it once it's up.
No accounts, no cookies, no tracking
There are no user accounts. There are no cookies. There are no analytics, no advertising, no tracking pixels, and no third-party scripts of any kind. Fonts are served from this site, not from anyone else's.
What is stored when you leave a note
A note saved to the wall contains only:
- the words you typed, and any doodle you drew;
- the name you chose to sign, if any (blank becomes “a stranger”);
- the paper colour, ink colour and handwriting you picked;
- where on the wall you stuck it, and the time it was stuck.
That's the whole note. No IP address, no device details, no identifier is attached to it. Nothing in a stored note points back at you.
What is stored about you, briefly
- A one-way hash of your IP address. To enforce “one note every half hour” and to stop flooding, the engine keeps a SHA-256 hash of your IP with a timestamp. The hash cannot be reversed into your address by us, and it is not attached to your note. It is discarded once the half hour has passed.
- A random session id while your browser is connected, so live typing reaches other people watching. It disappears when you close the tab.
- A peel token for fifteen minutes after you stick a note, so your browser — and only your browser — can take that note back. We store only a hash of it.
What your own browser stores
Two things, in local storage on your device. Not cookies, never sent anywhere, and clearable by clearing your site data:
swm_theme— whether you prefer the lamp on or off.swm_peels— peel tokens for notes you just stuck, so the peel button works. Entries delete themselves after fifteen minutes.
Who else is involved
Two infrastructure providers handle traffic, and like all web hosts they can see IP addresses at the network level as part of delivering the site:
- GitHub Pages serves the page itself.
- Cloudflare runs the live engine that holds the wall.
Server logs from the engine are kept briefly for debugging and abuse prevention and are not used to build any profile of you. No data is sold, rented, or shared with anyone else — there is nobody else.
Your rights
Since notes are anonymous and carry no identifier, we usually cannot tell which note is yours — which means we cannot look it up for you. What you can do:
- Peel it yourself within fifteen minutes of sticking it.
- Ask for removal at any time: email dyson@plotflow.io with the note's coordinates (hover a note to see them) or a screenshot, and it will be taken down. You don't need to prove it's yours; if a note names or exposes you, that is reason enough.
If you are in a place with data-protection rights such as the UK/EU (GDPR) or California (CCPA), you may request access to or deletion of any personal data held about you. Given the above, that is generally limited to a short-lived IP hash. Write to the address above.
Children
The wall is not intended for children under 13, and we do not knowingly collect anything from them. If you believe a child has posted something identifying, email us and it will be removed.
Changes
If this policy changes, the date at the top changes with it.
Contact
Data controller: [NAME / ENTITY — fill in], [COUNTRY — fill in].