Privacy policy

Areabake is made and run by Kayan Nayak as an individual, not a company. For the purposes of the UK and EU GDPR that makes me the data controller. You can reach me at kayanknayak@gmail.com. There is no data protection officer, because a site this size is not required to appoint one.

Three things, and only three. Before you answer the question at the bottom of the screen, the site stores nothing on your device, sets no cookies, and makes no requests of its own at all.

• Server logs. Areabake is hosted on Base44. Like every web host, its servers record the request: an IP address, the page asked for, a timestamp, and the browser's user-agent string. This happens for every visitor, is needed to serve the site and keep it from being abused, and is not something I can switch off.
• Storage on your own device. Your streak, your puzzle progress, your best run and your theme choice are written to your browser's local storage. They stay on your device. They are never transmitted to me or to anyone else, which also means they do not follow you to another browser and clearing your site data will erase them.
• Page counts, but only if you agree. If you say yes to the question at the bottom of the screen, opening a page sends the name of that page to Base44. That is the whole payload. No identifier is attached, no cookie is set and no session id is created, so the counts cannot be tied back to you or joined up across visits. If you say no, or simply ignore it, none of this runs.

• Your name, email address, phone number or postal address. Nothing on the site asks for any of them.
• The number you type into Fortune. That calculation runs entirely inside your browser. The figure is never sent to a server, never written to storage, and disappears the moment you close the tab.
• Anything from advertising or social networks. There are no ad scripts, no tracking pixels, no Facebook or Google tags, and no embedded widgets anywhere on the site.
• Fonts are served from this site rather than from Google, so loading a page does not reveal your IP address to a font provider.

If you are in the UK or the EU, the GDPR requires me to name a lawful basis for each purpose.

• Serving the site and keeping it up (server logs): legitimate interests, under Article 6(1)(f). Running a website is not possible without them, and the interest in a site that works and resists abuse is not outweighed by the limited privacy impact of a short-lived log entry.
• Saving your streak and settings: this is storage that is strictly necessary to provide the game you asked to play, so under the ePrivacy rules it does not need separate consent. It never leaves your device, so no personal data is processed by me at all.
• Counting page views: consent, under Article 6(1)(a), and it is asked for before anything runs rather than after. You can withdraw it at any time using the switch below, and withdrawing is as easy as giving it.

One company. Base44 hosts Areabake and processes the server logs and, if you opted in, the page counts, acting on my instructions as a processor. Nobody else receives anything.

There are no advertisers, no data brokers, and no analytics companies beyond the host. Nothing about you is sold, rented, or shared in exchange for money or anything else of value, and it never will be.

The one outbound link that leaves the site is the Buy Me a Coffee button in the footer. Clicking it takes you to their website, where their privacy policy applies, not this one. Nothing is embedded from them, so simply loading an Areabake page tells them nothing.

Areabake's hosting infrastructure is in the United States, so a visit from outside the US involves an international transfer of the request data described above. Where that transfer leaves the UK or the EEA it relies on the standard contractual clauses adopted by the European Commission, which is the mechanism the host operates under.

• Server logs: retained by the host for a short operational period, on the order of weeks rather than years, then deleted automatically.
• Page counts, if you opted in: kept in aggregate by the host. They carry no identifier of any kind, so nothing in them could be traced back to you and there is nothing to delete on request.
• Storage on your device: until you clear your browser data, or use the button at the bottom of this page. I have no copy and no way to reach it.

Under the UK and EU GDPR you have the right to ask for a copy of your personal data, to have it corrected or erased, to restrict or object to how it is used, to receive it in a portable form, and to withdraw consent at any time.

In practice there is very little for those rights to bite on here, and I would rather say that plainly than pretend otherwise. I hold no account, no email address and no profile for you. If you want the data on your own device gone, the button below does it instantly and completely, which is faster than any request I could process.

If you think I have handled something badly, please tell me first. You also have the right to complain to a supervisory authority: in the UK that is the Information Commissioner's Office, and in the EU it is the authority in the country where you live.

The CCPA, as amended by the CPRA, applies to businesses above certain thresholds: broadly, more than 25 million dollars in annual revenue, or handling the personal information of 100,000 or more California residents or households in a year, or making at least half of revenue from selling or sharing personal information. Areabake is a free site run by one person and meets none of them, so the statute does not currently apply to it.

I am telling you the substance anyway, because it is what you would actually want to know: Areabake does not sell your personal information, does not share it for cross-context behavioural advertising, and does not use it to build a profile of you. There is no financial incentive attached to your data and no discrimination for exercising any right. If the site ever grows past those thresholds, this section will be replaced with a real one rather than quietly left as it is.

Areabake is a general-audience site. It is not directed at children under 13, it has no accounts, no messaging and no way for anyone to submit personal information, so it does not knowingly collect anything from a child. If you are a parent and believe otherwise, email me and I will look into it.

Because analytics is off until you switch it on, a browser sending a Do Not Track or Global Privacy Control signal is already in the state those signals ask for. Nothing is collected from anyone who has not explicitly agreed, regardless of what their browser sends.

If what the site does changes, this page changes with it and the date at the top moves. If a change ever meant collecting something genuinely new, the question at the bottom of the screen would be asked again rather than an old yes being reused.