Privacy

Privacy Policy

Last updated: 3 August 2026

The short version

This site sets no cookies and runs no advertising, pixels, fingerprinting or profiling of any kind. There is no form, no account, no login and no newsletter — there is nowhere on this site to enter anything about yourself. On page load the site calls one outside service: a cookieless analytics beacon, which costs two requests — the script that measures, and the measurement it posts back. Everything else — fonts, scripts, images, video — is served from our own domain.

Two more things happen, and this page is here to name them honestly rather than claim that nothing does. Serving you a page means our host sees your IP address and writes a standard access log. And if you switch animation off, we keep that one choice in your own browser so the site remembers it.

Below is the long version, including the one item we store in your own browser and why.

Controller

Black Oar Studio L.L.C.
1209 Mountain Road Pl NE, Ste N
Albuquerque, NM 87110
United States of America

Email: hello@blackoarstudio.com · Full company details: Legal Notice

TechPack Ultra is a fictional demonstration project created and operated by Black Oar Studio L.L.C. It is a portfolio piece, not a business of its own: it sells nothing, takes no orders, and is not directed at any particular country or market.

Where the General Data Protection Regulation applies to us under Article 3(2) — because we offer services to people in the European Union — we process personal data in accordance with it, and that includes the processing described on this page. We say this plainly because it would be easy, and wrong, to claim that a demonstration site is beyond the reach of any data protection law. This site itself neither offers anything for sale nor monitors anybody’s behaviour; the company behind it nonetheless applies the same standard here as everywhere else.

Hosting and server logs

This site runs on Cloudflare Workers, operated by Cloudflare, Inc. Serving a page necessarily involves your IP address reaching the server, and Cloudflare records standard access data for delivery, security and abuse prevention: IP address, timestamp, the resource requested, the response status, and the browser’s user-agent and referrer string.

We set Referrer-Policy: no-referrer site-wide, so no referrer is sent when you follow a link away from this site.

Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is delivering the site reliably and defending it against attack.

Cloudflare acts as our processor under a data processing agreement. Cloudflare, Inc. is a US company; transfers rely on the European Commission’s Standard Contractual Clauses and, where applicable, its certification under the EU–US Data Privacy Framework.

Retention: these logs run for the period Cloudflare operates them for the service. We hold no separate copy, we do not analyse them, and we cannot extend them.

Network error reports

Cloudflare adds two headers to responses from this domain, Report-To andNEL, which switch on a browser feature called Network Error Logging. If your browser fails to reach this site — a dropped connection, a DNS failure, a TLS error — it may send a short report about that failure to a.nel.cloudflare.com.

The report covers the request that failed: the URL, the type of error, the server address and timing. It carries your IP address in transit, as any request must. Successful page views are not reported: the configuration sets a success sample rate of zero, so only failures are ever sent.

This is platform diagnostics, not analytics. It assigns no identifier, sets nothing on your device, and cannot follow you anywhere. We do not receive the reports and we do not see them individually.

Legal basis: Article 6(1)(f) GDPR — our legitimate interest in a site that reaches people.

What we store in your browser

One entry. It is functional, it is first-party, it contains no personal data, and it needs no consent, because it exists solely to honour a choice you made yourself.

tpu-motion — local storage, persistent

Written only when you press the MOTION control in the bottom-left corner. It holds a single value, on or off, so the site does not re-enable animation on you on every page. If you have never touched that control, nothing is written at all — the site simply follows your operating system’s “reduce motion” setting without recording anything.

The value never leaves your device. It is not transmitted, not read by any server, and not shared with anyone. Clear your site data to remove it.

Nothing else is written. There are no cookies on this site, no session storage and no IndexedDB.

Analytics

We use Cloudflare Web Analytics. It is the only third-party service this site loads, and it is deliberately the least invasive option available to us:

  • It sets no cookies and writes nothing to your browser storage.
  • It assigns no identifier to you, and cannot follow you across websites.
  • It performs no fingerprinting.
  • We see aggregate figures — page views, referrers, countries, device categories — never individuals, and never a path through the site attributable to one person.

It costs two requests, both to Cloudflare: the script beacon.min.js loads from static.cloudflareinsights.com, and the measurement it takes is posted tocloudflareinsights.com/cdn-cgi/rum. Open your browser’s network panel and reload the page and you will see those two leaving our domain, and nothing else. Both carry your IP address in transit, as any HTTP request must. Neither is used to build a profile of you.

Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is understanding, at the level of totals, whether the site works and where visitors arrive from. Because the technique stores nothing on your device and identifies no one, we take the view that it does not require consent under Article 5(3) of the ePrivacy Directive or § 25 TDDDG. If you disagree, a tracker-blocking extension or browser will stop the beacon and the site will work normally.

Contacting us

There is no contact form on this site. The footer offers an email link, and nothing leaves your computer until you write a message and send it yourself from your own mail program.

When you do write to us, we receive what you send: your email address, the content of your message, and anything else you choose to include. We use it to answer you.

Mail addressed to our domain reaches us in two stages. Cloudflare Email Routing accepts it first and forwards it to our mailbox. It does not keep the message, but it records delivery metadata — sender, recipient, timestamp and outcome. The mailbox itself is Gmail, operated by Google, and that is where the message is stored. Both act as our processors under data processing agreements; both are US companies, and transfers rely on Standard Contractual Clauses and, where applicable, certification under the EU–US Data Privacy Framework.

Legal basis: Article 6(1)(b) GDPR where the correspondence concerns a contract or its negotiation, otherwise Article 6(1)(f) — our legitimate interest in replying to people who write to us.

Retention: enquiries that lead nowhere are deleted within twelve months. Correspondence belonging to a project is kept for the life of the engagement and afterwards for as long as commercial and tax record-keeping obligations require.

What we do not do

For the avoidance of doubt, and verifiable by reading this site’s source:

  • No advertising, retargeting or conversion tracking of any kind.
  • No Google Analytics, Tag Manager, Meta pixel, LinkedIn Insight tag, TikTok pixel, Hotjar, Clarity, Plausible, Fathom, Umami, PostHog or Matomo.
  • No cookies, and therefore no cookie banner — there is nothing to consent to.
  • No fonts, stylesheets, images, video or audio loaded from a third-party CDN. The analytics beacon described above is the only third-party file this site requests.
  • No embedded YouTube, Vimeo, Google Maps or social widgets. No iframes at all.
  • No error-reporting or session-replay SDK.
  • No form, no account, no login, no newsletter and no mailing list.
  • No fingerprinting, no profiling, and no automated decision-making within the meaning of Article 22 GDPR.
  • No record identifying you is created by your visit. The analytics figures exist only as totals; nothing on this site stores an individual profile of you on any server.
  • We do not sell, rent or trade personal data. We never have.

Your rights

Where the GDPR applies, you have the right to obtain confirmation of and access to your data (Art. 15), to have it corrected (Art. 16) or erased (Art. 17), to have processing restricted (Art. 18), to receive it in a portable form (Art. 20), and to object to processing based on legitimate interests (Art. 21). Where we rely on consent, you may withdraw it at any time with effect for the future. Other laws grant comparable rights, and we do not require you to establish which one covers you before we answer.

Write to hello@blackoarstudio.com and we will respond within one month. In practice, the only data we are likely to hold about you is an email you sent us yourself: nothing on this site creates a record otherwise.

You may also complain to a data protection supervisory authority in the EU Member State where you live, work, or where you believe an infringement occurred. Exercising these rights costs you nothing and needs no particular form.

Changes

We will update this page when the site changes. The date at the top always reflects the current version. We do not maintain an archive of superseded versions; if you need to know what it said on a particular date, ask us.