Privacy notice

Who we are

For anything on this page, contact fun@projectsxgwen.com.

What we collect, and why

If you never make an account: we store a session record so the site works. It holds a random id, a one-way hash of your IP address, your browser's user-agent string, and the time. It is deleted 30 days after your last visit.

If you make an account: your name or nickname, email address, birth year, password (as an Argon2id hash), and — for under-13s — a parent or guardian's email address. We use these to sign you in, to send account emails, and to know whether guardian approval is required.

If you comment: the text you wrote, and which post it was on.

If you join the newsletter: your email address, when you confirmed, and which form you used.

What we do not collect

No home address, phone number, school, precise location, full date of birth, or payment details. We run no advertising, no third-party analytics, and no social media tracking pixels.

Children under 13

We do not knowingly let anyone under 13 use an account without verifiable parental consent. Where a user tells us they are under 13, the account is created in a locked state and a consent request goes to the guardian email supplied. The account is unusable until the guardian approves it, and is deleted if they refuse.

A guardian may at any time review everything the child has submitted, withdraw consent, or require deletion — using the permanent link we email on approval, or by contacting us. Withdrawing consent stops all further collection.

Cookies

One cookie, named pxg_session. It holds a random identifier, nothing else. It is marked HttpOnly and SameSite=Lax, and it is used only to keep you signed in and to protect forms against cross-site request forgery. There are no advertising or tracking cookies, so there is no consent banner to click.

How long we keep things

• Sessions: 30 days after last use
• Email links (verification, reset, consent): 7 days, or 1 hour for password resets
• Account data: until you or your guardian delete the account
• Newsletter: until you unsubscribe
• Unconfirmed newsletter signups: deleted after 30 days

Who we share it with

Nobody. We do not sell, rent or trade personal data. The site runs on our own private server hosted by GoDaddy, in the United States. If we ever add a separate email delivery service, we will name it here before switching it on.

Your rights

You can ask us for a copy of what we hold, ask us to correct it, or ask us to delete it. Email fun@projectsxgwen.com and we will respond within 30 days. Account holders can also delete their own account from the account page, which erases the record immediately.

Security

Passwords are hashed with Argon2id. Tokens sent by email are stored only as SHA-256 hashes. All database access uses prepared statements. Sign-in attempts are rate limited. We serve the site over HTTPS.

No system is perfect. If you find a security problem, please email fun@projectsxgwen.com and we will fix it quickly.

Changes

If we change this notice in a way that affects what we collect from users, we will email guardians and ask again rather than assume the old consent still applies.