Every outside company your browser talks to when you open a page here, whether we use AI, what happens when you want to leave, and the things we are not going to do. Written against what is running right now, not against what we plan.
Loading a page here makes your browser fetch things. Anything it fetches from somebody else's server tells that server your IP address, roughly where you are, and which page you were on. That happens before you click anything, and no sentence in a policy undoes it. So here is the actual list.
Serves the three typefaces this site is set in. Every visitor's IP address reaches Google on every page load. We are listing this rather than burying it, because plenty of sites pretend a font is not a third party. It is. Self-hosting the fonts removes this entirely and is on the list to do.
The Terminal loads React and Babel from this CDN and runs them. That is a different and larger thing than fetching a price: it is executable code from somebody else's server, so if unpkg is ever compromised or simply down, that page breaks or runs something we did not write. It is listed separately for that reason. Serving these three files from our own host removes the risk entirely and is the next thing to fix on that page.
Public crypto prices and candles. No account, no key, and no order is ever placed.
Public crypto candles. Read-only and unauthenticated.
Public stock quotes and daily history, as CSV. Read-only, no account.
Public prediction-market odds. Read-only. We place nothing and we hold nothing.
Public prediction-market listings. Read-only, unauthenticated, no order ever placed.
Every form here tries to send itself directly first, so you do not have to leave the page and finish the job in your own mail app. That attempt is a request to Netlify, the company already hosting these files, so it is not a new company learning your IP address, only a new thing that company is doing with a request it would receive regardless. If that request fails, for instance this site is not deployed on Netlify or forms have not been turned on there yet, the form falls back to the mail-app method, exactly as before. One case is routed around this on purpose: a Scene Cards crew note names a specific person to write to, and it always goes straight to their mail app, never through Netlify, because it was addressed to them, not to us.
The museum's public collection API, plus its IIIF image service for the pictures themselves. Read-only, no key, no account. It sees your IP address and what you searched for, the same as any website you visit. Nothing about you is sent along with the search.
A free, community-maintained question set, licensed CC BY-SA 4.0. Read-only and no key. It issues a session token so the same question does not repeat at you all night; that token is stored on your device, identifies a run of questions rather than a person, and is not an account. Your score is never sent anywhere.
The database and sign-in behind studio accounts. It is the first thing on this site that stores anything about you on somebody else's computer, so here is exactly what and exactly when.
Only if you sign in. The studio works signed out and saves to your own browser, which is still the primary path. If you never sign in, the only request that reaches Supabase is the library download from the CDN.
If you do sign in, it holds your email address and whatever projects you choose to save: pattern data, tempo, and the name you gave them. Nothing else. No tracking, no analytics, no profile built from what you make.
Nobody else can read it. The table holding your projects has row level security tied to your account: a request carrying somebody else's session, or no session at all, reads an empty list and is refused on write. We tested that against the live database by signing in as two different users and trying to make each one read and delete the other's work. Both attempts failed, which is the result we wanted. The key in our page source is the publishable one, which is designed to be public and grants nothing by itself.
Sign-in is a link by email, not a password. There is no password to leak because there is not one.
That is the whole list, and it was built by watching what the browser actually requests, not by reading our own code and hoping. Everything above Netlify Forms is confined to one page each; open any other page carrying no form and Google Fonts is the only outside company involved.
There is no analytics script, no advertising pixel, no session recorder, no heatmap, no chat widget, no A/B testing service and no tag manager anywhere on this site. If that ever changes, it gets added here in the same change that adds it, not afterwards.
No page on this site sends anything to an AI model. There is no chatbot, no assistant, no generated text presented as fact, no AI scoring of anything you write, and no model trained on your work. Nothing you type, record or upload here goes to any AI company.
Claude was used as a tool by us while writing this software, the way an editor or a compiler is a tool. That is a fact about how the code was built, not a thing that happens to you when you visit.
If an AI feature ever ships here then, before it is switched on: it is labelled where it appears and not only in a policy; it says whose model it uses; you are told what leaves your device to make it work; it can be turned off; and its output is never presented as verified fact. Nothing you make in the Studio, and nothing you write in the Still Room or The Wrack, will be used to train a model, by us or by anybody we work with.
Signed out, which is the default: nothing. No account, no cookies we set, nothing of yours on a server of ours. Your projects, your Still Room favourites and your Wrack reports live in your own browser's storage, on your device, and we cannot read them. Clearing your browser data deletes them, and if you have not exported first they are gone. That is a real cost of having no server, and it cuts both ways.
Signed in, which is always optional: your email address, the studio projects you chose to save, and — if you vote — a record that you voted in a particular ballot. That is the whole list. It is described in full under Supabase above, including the fact that nobody without your session can read any of it.
Which option you chose is not stored against you anywhere. One table records that you voted. A separate table records what was chosen. They share no column that could connect them, and neither points at the other, so there is no query anybody can run — us included, with full access to our own database — that reconstructs your ballot. It is not hidden behind a permission. It was never written down.
Both of those tables store a date rather than a timestamp, on purpose. If one held the second you were marked as having voted and the other held the second a vote arrived, matching them up would rebuild the whole ballot. Everyone who votes on the same day sits in the same bucket instead.
The honest limit: somebody watching our database as writes happen could still correlate them in real time. Defending against that needs infrastructure we do not have, so we are saying it rather than implying otherwise. The claim we will stand behind is narrower and true — after the fact, our own database cannot tell anyone who voted for whom. One consequence we accept: we cannot show you your own ballot after you cast it, and no future feature will, because there is nothing to look up.
Every form on this site tries to send directly through Netlify first and falls back to your own mail app only if that fails, so what you submit lands either in Netlify's form dashboard for this site, or in an ordinary inbox, depending on which path actually worked that time. Either way it goes to us, not to a list. It is not enriched and not sold. If you are signed in, nothing in a form submission is joined to your account either — those two paths never meet.
Anything new we collect gets named on this page and in the privacy policy before it starts: what it is, why it exists, how long it is kept, and how to get it deleted. We do not collect something because it might be useful one day.
A bucket is a folder on a hosting company's storage service. Left public by accident it is readable by the whole internet, and that single mistake is behind a very large share of the data leaks you read about. It is almost always carelessness rather than an attack.
Today Brokehella has no buckets and no database. It is static files on a host. If storage ever exists here the rule is: private by default; nothing containing anyone's personal information ever goes in a public bucket; anything genuinely meant to be public, like a poster or a track somebody chose to release, lives in a separate bucket that holds nothing else; and no unlisted-but-public URLs treated as though they were a password.
There is nothing to buy on this site today. No subscription, no trial, no card stored anywhere, no payment processor connected. The rules below are written now, while nobody is paying us and being strict costs us nothing.
Cancelling takes the same number of clicks as signing up, on the same device, in the same place. If you can subscribe on a web page you can cancel on a web page. No phone call, no chat with our team, no retention offer you have to decline three times, no hunting through settings. You get an email confirming it, and access runs to the end of what you already paid for.
If a free trial ever exists we email you before it converts, not after, and early enough to actually do something about it, saying the date, the amount and how to stop it in one click. A trial that quietly becomes a charge is a trap, and it is the most common complaint there is about software billing.
Any recurring charge gets a reminder before it happens, with the amount and the date. Prices do not rise silently. If we ever raise one you are told beforehand and you can leave without penalty.
We have been asked about giving in cryptocurrency, specifically toward under-resourced areas, education, and community help. That is a real goal worth stating plainly rather than quietly building around: no wallet exists on this site, we do not hold or generate one for anybody, and there is no token, coin, or cryptocurrency of our own, and none is planned. A donation address only ever goes up once a real person here actually controls that wallet, and a payment mechanism of any kind only ships after the legal and tax review that real money deserves, the same rule that already governs the Reservoir and Copper Patron above. This line exists so the goal is on the record before the capability is, not the other way around.
Parts of this site are deliberately built for four in the morning. The Still Room exists for people having a bad one. That comes with a duty.
Nothing here is a treatment. No sound treats a condition, reverses intoxication, or manages a withdrawal. The beds are named for situations and never for diagnoses, and they never will be. If an AI feature ever ships here it will not give advice about self-harm, about suicide, or about how to use a substance. It will say it is not the right thing to be talking to and point at a human, every time, without exception and without a "but".
If somebody cannot be woken, is struggling to breathe, has a seizure, or is burning up, call 911. Florida has a law that protects people who call for help in an overdose. Stay with them.
988 is the Suicide and Crisis Lifeline, by call or text, any hour. 1-800-662-4357 is the SAMHSA national helpline, free and confidential. Neither of those is us, and both of them are better at this than a website.
Tell us, and we will fix it and say what happened: info@brokehella.com. A page like this is only worth something if it can be proved wrong, so if you find anything on this site that contradicts it, that is a bug and we want it.
This page describes the site as built and deployed. It is not legal advice and it has not been reviewed by a lawyer. The commitments above are ours; the statutes they touch are somebody else's, and where the two disagree, the law wins.