Privacy policy
This policy covers all of filion.se: the blog, the tools and the games. It lists every cookie the site sets, what it counts and logs, and which outside services see your visit.
Cookies
The site sets only the cookies it needs to work, listed in the next four sections. None of them are used for advertising or to follow you to other sites, and no one else reads them. You can delete them in your browser at any time: the site still works, but forgets your theme and starred tools and signs you out.
Your theme
When you choose a light, dark or system theme, the choice is saved in a cookie and in your browser's local storage, so pages open in the theme you picked. The blog uses filion-theme, the tools filion-tools-theme and the games filion-games-theme. Each holds only the theme name and lasts a year.
Starred tools
When you star a tool on the tools page, filion-tools-favorites saves which tools you starred, so they stay at the top of the list. It holds only the names of those tools and lasts a year. Unstarring the last one deletes it.
Signing in
Signing in to the blog sets three cookies: filion_access_token, which proves you are signed in and expires with its token; filion_refresh_token, which keeps you signed in and lasts 30 days; and filion_user_id, your account id, also 30 days. Scripts on the page cannot read them, and signing out deletes them and ends the session on our server.
The cookie notice
filion-cookie-notice records that you closed the cookie notice, so it does not come back. It lasts a year. The blog, tools and games share the filion.se address, so closing the notice in one closes it in all three.
Counting visits
We count visits with Umami, an open-source analytics tool that runs on our own server and loads from filion.se/stats. It sets no cookies and stores nothing on your device. For each page view it records the page, the site that linked to it, your browser, operating system, device type, screen size and language, and the country, region and city your IP address points to. It does not keep your IP address: to tell visits apart it uses a code made from your IP address and browser that changes every month, so it cannot recognise you from one month to the next. On the games it also records each time a game starts, and which game. Only we see the figures; they are not shared or sold.
Server logs
Our servers log the requests they handle, with your IP address, the time, the page asked for, the page that linked to it and your browser's user agent. We use the logs to find faults and stop abuse, and keep them only for a short period of time.
Error reports
When something goes wrong on our servers, a report goes to an outside error-tracking service, along with timings for some requests that show where the site is slow. A report holds the request that failed, the error and related log messages. It does not include cookies or sign-in tokens.
Accounts and comments
There is no public sign-up: we create the accounts. An account holds a username, an email address and a password, stored so that no one can read it back. Comments and likes are stored with the account that made them. If an account is deleted, its comments stay, under the username they were written with. We keep a record of the changes we make to accounts, indefinitely.
Messages you send us
The contact form at filion.se/contact asks for your name, your email address and a message. They reach us by email through an email delivery service, with your address as the one to reply to. The site keeps no copy.
Other services
Two features load something straight from another service, which then sees your IP address: the maps in the tools load their tiles from OpenStreetMap (tile.openstreetmap.org), and the QR code generator draws its code with api.qrserver.com, which also receives the text you encode. The Chat tool passes what you type to an outside AI text service, which sees our server rather than you; we do not save the conversation.
Why we may do this
The cookies serve features you use (a theme you pick, tools you star, an account you sign in to, a notice you close), so they need no consent. Account data is kept to provide the account, and a message you send is used to answer it. Counting visits, server logs and error reports rest on our legitimate interest in running a site that works and is safe, and each collects as little as we could make it.
Changes to this policy
When this policy changes, the new version is posted here with a new effective date at the top.