CANDLEWORK

◆ Privacy

We want as little as possible.

No account, no signup, no server-side profile of you. One thing touches your device: settings saved in your own browser. Visits are counted without cookies.

Last reviewed · September 2026

The short version

  • No account, no login, no email collection.
  • We hold no database of users — there is no server-side profile of you.
  • Your site settings are stored in your own browser and never transmitted to us.
  • Visits are counted with Cloudflare Web Analytics, which sets no cookies and stores nothing on your device.
  • We sell and share nothing. There is nothing to sell.

1 · Who we are

CANDLEWORK is an independent, non-commercial educational site, published anonymously (see How this was made). For any privacy request or question, contact:

404meanings@gmail.com

2 · Stored in your browser (not sent to us)

The site uses your browser's localStorage to remember your preferences between visits. This data stays on your device. We cannot read it, it is never transmitted to any server, and it contains nothing that identifies you.

  • cw_mood — your bull / bear / neutral theme choice.
  • cw_visited — which rooms you have opened, so the network map shows progress.
  • cw_path_off — whether you dismissed the guided-path prompt.

To erase all of it: clear site data for this domain in your browser settings, or browse in a private window. Nothing is lost that matters — the site simply forgets your preferences.

3 · Analytics — no cookies

We count visits with Cloudflare Web Analytics to understand which rooms people find useful. It sets no cookies and stores nothing in your browser, and Cloudflare states that it does not fingerprint visitors or follow them across sites. Because nothing is stored on your device, there is nothing to ask permission for, and no banner.

What is counted

  • Pages viewed and the site that sent you here.
  • Broad location (country level), device and browser type.
  • How quickly pages load.

We do not use it for advertising, and we never receive anything that identifies you personally. Cloudflare's own terms: cloudflare.com/privacypolicy.

Until September 2026 this section described Google Analytics, loaded only after consent. It has been removed from the site.

4 · YouTube (The Signal Room)

The Signal Room features original music hosted on YouTube. How we handle it:

  • No YouTube player loads on our page. Clicking a track opens it on YouTube in a new tab, so nothing from YouTube runs here.
  • The long "session" mixes always open in a new tab on YouTube by design, so the music keeps playing while you browse.
  • Track thumbnails are images loaded from Google's image servers, which means your IP is visible to Google for that request.

Once you are on YouTube — whether embedded or in a new tab — you are subject to Google's privacy terms, not ours, and Google may collect data according to its own policies: policies.google.com/privacy.

If you prefer no third party at all, the Signal Room includes a generative ambient option that is synthesised in your own browser and contacts nobody.

5 · Third parties

  • Google Fonts — typefaces are requested from Google's font servers, which means your IP address is visible to Google as part of that request. No cookies are set by this.
  • Cloudflare Web Analytics — counts visits without cookies, as described above.
  • YouTube — tracks open on YouTube in a new tab. See above.
  • Our host — the site is served as static files; the host keeps standard server logs for security and reliability.

There are no ads, no ad networks, no social-media pixels, no session recording, no heatmaps, no A/B testing tools, and no affiliate trackers on this site.

6 · Your rights

Under GDPR (EU/UK) you have rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. In practice, since we hold no personal data about you on any server, most of these resolve instantly: there is nothing for us to hand over or delete. Your browser-stored settings are yours to erase at any time.

Under CCPA/CPRA (California) you have rights to know, delete, correct, and opt out of sale or sharing. We do not sell or share personal information, and we do not use it for cross-context behavioural advertising.

You may also lodge a complaint with your local data protection authority. To exercise any right, or if you believe we are handling something badly, email the address above.

7 · Children

This site is not directed at children and we do not knowingly collect data from anyone under 16. Its subject matter is intended for adults.

8 · Security & changes

The site is served over HTTPS with a strict Content-Security-Policy and standard security headers. It has no login, no forms, and no user-submitted content, which removes most common risk surfaces entirely.

If this policy changes materially, the "last reviewed" date above changes and the consent prompt is re-issued where the change affects it.

▸ This policy describes the site as built. If you find it inaccurate in any respect, that is a bug — please report it to 404meanings@gmail.com.