Overview
Orboro.net is a personal site operated by JD. You can read its public pages without an account. An optional member account lets you comment and vote. The site uses Cloudflare for hosting, security checks and account email, and Google Analytics for usage measurement. This policy describes the information involved in those services, member accounts and comments, administrator login, and requests to external image providers.
Information collected
Hosting and diagnostics
Cloudflare processes requests to deliver pages and images and operate its network. Request information can include your IP address, the requested URL, browser details, and referring information. Worker request/error logging and sampled tracing are enabled to diagnose failures and monitor operation. On the site's current Cloudflare plan, Worker logs are kept for 7 days, and no log export to other services is configured. Cloudflare's own network records follow its service terms, and plan or setting changes can change these periods, so this site does not promise a fixed deletion period for those records.
Analytics
Google Analytics measures visits and pages viewed and can collect browser/device details, referring information and approximate location. Google's tag uses cookies and browser identifiers to distinguish visits. These identifiers mean the collection should not be treated as completely anonymous, even when reports show aggregate statistics.
Analytics loads on public pages only after you accept analytics cookies in the consent banner. Declining keeps the analytics tag from loading. Your choice is saved in this browser's local storage until you change it or clear that storage. Without JavaScript, the analytics tag does not load. Page-view events send the page title, the page address without any query parameters or fragment, and the previous page address in the same reduced form. Google's tag can still collect other browser details described above. The administrator login screen, the administration interface and sign-in endpoints do not load the analytics tag.
The site's tag configuration keeps advertising storage, advertising user data, and advertising personalization consent denied, even when you accept analytics. The site code does not include a separate advertising pixel.
As of the date of this policy, the Google Analytics property keeps event-level data for 2 months and user-level data for 14 months, extended while a returning browser stays active. Google signals is off, and the property is linked to no advertising product; its only product link is Google Search Console. Sharing analytics data with Google to improve Google's products is off. Google may still use aggregated, de-identified data for modeling and benchmarks, Google support staff may access the account when asked to help, and Google may use account usage information to make recommendations. Reports built from aggregated data can be kept longer than these periods.
After you accept, your browser loads Google's current analytics script directly from Google. Google updates that script, so the site cannot pin or verify its exact contents the way it does its own files. The site's security policy only accepts that script from Google's tag domain, so a script from another host cannot take its place.
You can opt out of Google Analytics tracking usingGoogle's browser opt-out add-on, or with any browser extension that blocks third-party analytics scripts.
Member accounts
Creating an account stores, in Cloudflare D1, your username, email address, a password hash, the account's creation date and whether the email is confirmed, plus an optional display name and bio if you add them. Your email address is never shown publicly and is used only to confirm the address, to confirm a change of address, to send password-reset links, and to tell you if someone tries to register with it. Those emails are sent through Cloudflare's Email Service. Links in them carry a single-use token that expires (48 hours to confirm a sign-up address, 24 hours for an address change, 1 hour for a password reset); the database keeps only a one-way digest of each token.
When you choose a password, its strength is checked against thePwned Passwordsservice, which receives only the first five characters of the password's SHA-1 hash and never the password itself. The registration and password-reset forms useCloudflare Turnstileto tell people from automated sign-ups; it runs a check in your browser and may process browser and device signals to do so. To limit abuse, the site counts sign-in, registration, email and commenting attempts per IP address, account or member in windows of up to an hour; the counters store only one-way digests of those values and are deleted after their window ends.
Signing in sets an __Host-orboro_member cookie that keeps you signed in for up to 14 days. It is HttpOnly, Secure, and uses SameSite=Lax. Signing out revokes that session, andSign out everywhere on your account page revokes all of them.
Comments, votes and profiles
Comments are public. Each one shows your display name or username and when it was posted or edited, and your profile page at /u/your-username shows your display name, bio, join date, comment count, karma (the net votes other members gave your comments) and recent comments. Votes are stored with your account so you can change them, but who voted on what is not shown to other members. Reports you file are visible only to the administrator.
You can edit or delete your comments, and change your profile, email or password, on your account page. Deleting a comment that has replies leaves an empty [deleted] placeholder so the thread still reads; a comment without replies is removed. Deleting your account removes your email address, password hash, profile, votes, reports and sessions, and erases the text of your comments, which remain in their threads as [deleted] without your name. The administrator can remove comments that break the site's rules, and suspend or delete accounts.
Administrator account and session
The administrator account belongs to JD and is separate from member accounts; members can't sign in to the administration area. Cloudflare D1 stores the administrator's email, a password hash, and session records that hold a one-way digest of each session token. Successful login sets an__Host-orboro_session cookie to keep the administrator signed in for up to 14 days. It is HttpOnly, Secure, and uses SameSite=Lax. Logging out revokes that session and removes the cookie. Reading public pages does not require either login cookie.
Third-party links
This site contains links to external platforms (Reddit, Discord, official game sites, and similar resources). Once you leave this site, this privacy policy no longer applies. Please review the privacy practices of those platforms directly.
Bookmark lists (Tagstash)
Various "Useful Links" pages (for individual games, FOSS software, and similar topics) display bookmarks pulled fromTagstash, a bookmarking service. Bookmark data is fetched by this site's server and cached for ten minutes. That API request does not forward your browser cookies, IP address or request headers. Your browser loads bookmark favicons directly from the image URLs supplied by Tagstash; the Tagstash credit icon uses Google's favicon service. Those image hosts receive your IP address and browser request details. The favicon requests omit the referring page URL.
Images and publication updates
Site uploads are stored in Cloudflare R2 and served through media.orboro.net. Articles may also display images hosted elsewhere; loading them contacts their hosts. Images published on the site are publicly accessible. When content is published, the server notifies IndexNow of its public URL and a WebSub hub of the public RSS feed URL. These publication notifications do not forward visitor request information.
Service providers and storage
Cloudflare hosts the site, its D1 database and R2 images, sends member account email and runs the Turnstile check. ItsPrivacy Policydescribes its handling of information. Google processes analytics information underGoogle's Privacy Policy.
Choices and contact
Use Cookie preferences in the footer to change your analytics choice. Withdrawing consent removes this site's Google Analytics cookies and reloads the page to stop the running tag. If local storage is unavailable, your choice lasts only for the current page session, including in-site navigation, and is lost on a full reload. When local storage is available, changing the choice also updates other open tabs. This choice controls analytics; necessary member and administrator session cookies, the Turnstile check on account forms, and external images described above are not controlled by the banner.
You can also block analytics scripts using the tools linked above and manage cookies through your browser. Blocking analytics does not stop Cloudflare from processing the requests needed to serve the site. For questions or requests about your information, contact JD through the platform profiles linked on the homepage. What can be located or deleted depends on the information held and the relevant provider's controls.
Changes to this policy
This policy may be updated occasionally. The "last updated" date at the top of the page will reflect any changes.