Privacy Page — soundbuttons-click

The short version

This site does not have accounts, does not ask for your email, and does not run analytics that follow you between sites. What it does collect is ordinary server log data — the request, the address it came from, the browser string, the time — kept for security and capacity and deleted on a fixed schedule.

If advertising is enabled, an ad network sets its own cookies and receives your IP address and user agent. That is the only third-party data flow on the site, it is described in full below, and it does not exist until ads are switched on.

What is collected, and why

Three categories, each with a purpose that would not work without it.

**Server logs.** Every request to the site produces a line: timestamp, requested path, response code, bytes sent, referring page if your browser sends one, IP address, and user agent string. These exist because hosting providers need them to run the service, because abuse has to be diagnosable, and because capacity planning without them is guesswork.

**Aggregate counts.** The site counts how many times a page was served. These counts are numbers, not profiles: they are not linked to an IP address in the retained data, and they are not combined with anything else.

**Advertising data, if ads are enabled.** An ad network may set cookies or read device identifiers to select and measure ads. That data goes to the network, not to this site; the site receives aggregate reports, not individual records.

What is not collected: names, email addresses, account identifiers, precise location, contact lists, or anything typed into a form, because there are no forms.

Cookies and local storage

The site itself sets no cookies. It does not write to local storage, does not use session storage for tracking, and does not fingerprint your browser.

If advertising is enabled, the ad network may set cookies. Those are third-party cookies, they are controlled by the network's own policy, and they can be refused in your browser settings without breaking the site — the pages will still play sound, because playback does not depend on any cookie.

There is no cookie banner on this site because there are no first-party cookies to consent to. If that changes, the banner will appear before the cookie does, not after.

Retention

Server logs are kept for thirty days and then deleted. The retention period exists because most abuse investigations happen within days of the event, and because a log that is kept forever is a liability with no matching benefit.

Aggregate counts are kept indefinitely, because they are not personal data: they are a number per page per day with no identifier attached.

Advertising data is retained by the ad network under its own policy. The site does not hold a copy.

One thing the logs cannot tell us, and it is worth being explicit because people assume otherwise: they do not identify a person. An IP address is shared by everyone behind the same router, changes when a phone reconnects to a mobile network, and says nothing about who was holding the device. A log line is evidence that a request happened, not evidence about who made it.

Removal requests are logged with a date and a URL and kept for as long as the removal matters, which in practice means as long as the site is running. These logs contain the requester's contact details, because a removal that cannot be traced back to its request is a removal nobody can defend later.

Who else sees the data

Three kinds of recipient, and no others.

**The hosting provider.** The site runs on rented infrastructure. The provider processes requests on the site's behalf and has its own privacy terms.

**A content delivery network, if one is in front of the site.** A CDN terminates the connection and forwards the request, which means it sees the same request data the server does.

**An advertising network, if ads are enabled.** It receives the request context it needs to serve an ad and sets its own identifiers.

The site does not sell data, does not share it with data brokers, and does not pass it to anyone for marketing. There is no affiliate programme and no tracking pixel from a social network.

Your rights

If you are in the European Economic Area, the United Kingdom, Switzerland, California or another jurisdiction with a data protection statute, you have rights over your personal data: to know what is held, to get a copy, to have it corrected, to have it deleted, to object to processing, and to complain to a supervisory authority.

Exercising them is straightforward because there is so little to exercise them against. Write to [email protected] with the request and enough information to locate the records — usually the date and approximate time of your visit, and the IP address if you know it. A request is answered within thirty days.

Two honest limits. Server logs are deleted after thirty days, so a request about a visit older than that will find nothing, and that is the correct answer rather than an evasion. And an objection to advertising processing is handled by the ad network's own controls, because the site does not hold that data.

Children

The site is not directed at children under thirteen and does not knowingly collect personal data from them. There are no accounts, no comments and no messaging, so there is no mechanism by which a child could provide personal information in the first place.

Some boards contain crude humour and loud audio. That is a content question rather than a data question, and the about page addresses it: parents should treat this site the way they would treat any public soundboard.

Security

The site is served over HTTPS. Access to server logs is limited to the person maintaining the site. There is no database of users to breach, which removes the most common breach scenario for a site of this size.

No system is secure in an absolute sense. If a vulnerability is found, the fix is applied and, where personal data was affected, affected parties are told what happened rather than left to read about it elsewhere.

International transfers

The hosting provider and any CDN may process requests in countries other than yours. Where that happens, the transfer relies on the provider's own safeguards — standard contractual clauses or an adequacy decision — rather than on a separate agreement with each visitor, which would be impossible for a site with no accounts.

Do Not Track and similar signals

The site honours the spirit of Do Not Track by not tracking in the first place. There is no cross-site profiling to switch off. If advertising is enabled, the ad network's own opt-out controls apply, and the site will link to them on this page when that happens.

Global Privacy Control and similar browser signals are respected where they can be: a browser that sends one will not be served personalised advertising by a network that honours it, and the site passes the signal through rather than stripping it.

Changes

This page is edited when the data flows change, not on a schedule. A new processor, a new ad partner, a change in retention: each of those is an edit here, and the edit is made before the change goes live.

If a change materially affects what is collected, it will be described in plain language at the top of the page rather than buried in a revision list.

Advertising partners and your controls

If advertising is enabled, the network serving it is a separate company with its own data practices, and the controls that matter are mostly on its side. Three of them are worth knowing about.

Personalised advertising can usually be switched off in the network's own settings, which stops your visit history being used to choose ads but does not stop ads appearing.

Your browser can refuse third-party cookies outright. Doing that does not break playback or navigation on this site, because neither depends on a cookie.

On mobile, the operating system has a tracking permission that applies to ad identifiers. Refusing it applies across apps that respect it, and this site respects the signal where the network passes it through.

The site will list the specific network here when advertising is switched on, with a link to its policy and its opt-out. Until then there is no partner to name, and inventing one to make this section look complete would be exactly the kind of thing this page exists to avoid.

If something goes wrong

If a breach or a misconfiguration exposes personal data, the people affected are told what happened, what data was involved and what to do about it. For a site of this size the exposure is almost always server logs, and the honest description of that is: an IP address, a user agent and a list of pages requested.

Notification happens within seventy-two hours of the site becoming aware, which is the deadline the European rules set, and it happens whether or not the law where you live requires it.

Contact

Privacy questions and rights requests: [email protected].

Corrections about anything else on the site: the address on the about page. Takedown requests: the address on the takedown page. Sending a privacy request to the takedown inbox is the most common reason a reply is slow.