Privacy policy

Who is responsible

newt239, acting as an individual, decides how this site handles data. Questions and requests go to the GitHub issue tracker. Issues there are public, so please do not post personal details in them.

• Open an issue on GitHub

What stays in your browser

The site has no accounts, no database and no server-side storage. Your collection and your filter settings are kept in your own browser and are never sent anywhere.

• oxlint-gacha:collection in localStorage — the rules you have drawn
• oxlint-gacha:filter in localStorage — the categories and plugins you excluded
• oxlint-gacha:consent in localStorage — your analytics choice
• oxlint-gacha:auto-draw in sessionStorage — a one-shot flag that starts a draw after navigation

Clearing site data for this domain removes all of them.

Analytics

With your consent, the site loads Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Consent Mode is configured so that analytics storage starts out denied. Before you accept, no analytics cookies are set and no analytics identifier is created for you. Google does still receive a cookieless signal containing your IP address, the page address and the referring page, which it uses to model aggregate traffic.

After you accept, Google sets two first-party cookies, _ga and _ga_<stream id>. They expire after two years and hold a randomly generated identifier for this browser.

What is measured: the pages you view, the referring page, an approximate location derived from your IP address, and your device, browser and screen size. These interactions are reported as events:

• gacha_draw
• gacha_draw_empty
• filter_change
• rule_share
• rule_docs_click
• rule_obtained_from_link
• rule_draw_again
• collection_clear
• collection_export_copy

They carry the rule identifier, its category and plugin, which filter you changed, and how many rules you exported. No form input and no personal identifiers are sent.

Legal basis: your consent, under Article 6(1)(a) of the GDPR. Retention: Google deletes the user-level and event-level data after two months. International transfers: Google may process the data in the United States under the EU-US Data Privacy Framework and the European Commission standard contractual clauses.

• Google privacy policy
• How Google uses data from sites that use its services
• Google Analytics opt-out add-on

Your choice

Withdrawing consent is as easy as giving it. Turning analytics off here also deletes the Google Analytics cookies this browser already holds. It does not delete data Google has already collected; for that, get in touch through the issue tracker above.

Hosting

The site runs on Lolipop! Deploy Now, operated by GMO Pepabo, Inc. in Japan. Their servers process ordinary request data — your IP address, the user agent string, the address requested and the time — to deliver pages and keep the site available. Legal basis: the legitimate interest in running a working and secure website, under Article 6(1)(f). Japan is covered by an adequacy decision of the European Commission, so no extra transfer safeguards are needed.

No other third parties

Fonts are downloaded at build time and served from this domain, so your browser never contacts Google Fonts. There are no ads, no embeds, no social widgets and no trackers other than the analytics described above. Links to oxc.rs, GitHub and X are ordinary links; once you follow one, the privacy policy of that site applies.

The API

GET /api/random returns one random rule as JSON and is readable from any origin. It stores nothing and reads no cookies.

Your rights

Under the GDPR you can ask for access to your data, for it to be corrected or erased, for processing to be restricted, and for a copy in a portable form, and you can object to processing. Because the site keeps no accounts and no server-side records, nothing held here identifies you by name. The analytics identifier is held by Google as a processor; turning analytics off or clearing your browser data removes it. You also have the right to lodge a complaint with the data protection authority in your country.

Children

The site is not directed at children under 16 and does not knowingly collect their data.

Changes

Any change to this policy is published on this page together with a new date at the top.