Privacy at NotThor

Contact form

The contact form is currently hidden. If it is enabled again, the server will process the submitted name, email address, subject, message, privacy acknowledgement, submission timing, and basic request metadata. Valid messages can be sent to a private Discord webhook so Yousef can reply. Full message content is not written to routine application logs.

Visitor notifications

The server notifies the owner when a visitor loads the site. Alerts sent to a private Discord channel can include the IP address, approximate country, page, time, user agent, and referrer. Activity from the same IP is grouped into at most one alert every 30 minutes, and obvious automated crawlers are excluded.

An IP address does not reliably identify a person. Addresses can be shared, reassigned, proxied, or changed by a VPN. Country and region lookups are approximate and may be wrong.

Country Easter eggs

Optional country-based pages use Cloudflare's approximate country code. Nginx accepts that code only from verified Cloudflare proxy ranges. A signed HTTP-only cookie and a temporary server entry prevent repeated effects. The server entry uses an HMAC hash of the normalized IP address rather than retaining the raw address, expires automatically, and is not a long-term visitor history.

Requests approximately located in Norway are refused with HTTP 403 before they reach the application. Country lookup is approximate and does not establish that a specific person made a request.

The Romania-specific page is available only when the trusted approximate country code is RO. Other countries receive a not-found response.

CaloP accounts and nutrition data

CaloP requires an account before it loads or accepts nutrition data. Supabase processes the account email and password authentication, while the NotThor API keeps the resulting session in HTTP-only cookies. Passwords and session tokens are not exposed to the CaloP browser code.

Daily goals and food entries are stored in a Supabase row tied to the authenticated user. Row-level security and the NotThor API both restrict that row to its owner. The integrated app does not store nutrition data in local storage and does not cache private API responses for offline use.

Retention and tracking

This site does not use invasive browser fingerprinting or a third-party analytics dependency. Operational server logs may be retained for a limited period by the server administrator. Contact and visitor notifications remain wherever the owner receives them until they are deleted. CaloP nutrition data remains until the user resets it or the associated account is deleted. Temporary cooldown entries expire automatically.

Questions

A public privacy-contact channel is not currently available. Do not send sensitive information through unrelated channels.