Privacy & California notice

The short version

• Cosmec Artistry does not sell personal information and does not share it for cross-context behavioral advertising.
• We don’t run Google Analytics, ad pixels, or fingerprinting scripts.
• Most play data stays in your browser (localStorage).
• Optional “sky” features use public Nostr relays so stars and the guestbook can sync. You can choose Essential only in the cookie banner to keep those off.
• PayPal / Stripe only appear when you click a buy or tip link.
• Questions: artist@cosmecartistry.com

What stays on this device

These are first-party browser storage items (not third-party marketing cookies):

• Consent choice — so we remember Accept vs Essential only.
• Your star — name + keypair for guestbook / My Star (if you claim one).
• Galax-G balance, badges, pinball scores, coloring / book drafts, secret finds — honor-system play data.
• Redeem session hints — so a Galax-G or pack code doesn’t have to be typed every page.

Clearing site data in your browser resets all of the above. We can’t recover a lost star key from our side.

Third parties (only when you use them)

• PayPal — when you open a shop, tip, or coloring-pack payment link. Their privacy policy applies on their site.
• Stripe — same idea for the card “buy” links on the shop page.
• Netlify Identity — email sign-in on cosmecartistry.com for the soft front door. Auth cookies stay on that host; Neocities visitors are sent there to sign in, then return.
• Nostr public relays — optional sky sync for stars, guestbook, help notes, and (on the hidden Nebula page) peer invites. Your IP reaches those relays when sky is on.
• Recording booth CDNs — on the Nebula booth only, face-filter models may load from jsDelivr / Google Storage when you start the booth and have Accepted. Video stays on-device; nothing is uploaded by Cosmec.
• WebRTC STUN — Nebula calls may briefly contact Google/Cloudflare STUN servers to punch through NAT. No Cosmec call recording leaves your devices unless you save a booth file yourself.

California (CCPA / CPRA)

If you live in California, you have rights to know, delete, and correct personal information we hold, and to opt out of “sale” or “sharing” of personal information.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. There is no “Do Not Sell or Share My Personal Information” switch beyond the cookie banner, because we are not selling or sharing in that sense.

To ask about access, deletion, or correction of anything that might identify you (for example an email you put on a help note, or a PayPal receipt you sent us), email artist@cosmecartistry.com. Please say you’re a California resident making a privacy request. We’ll verify gently and reply as soon as a human can.

Note: public guestbook notes and star names on Nostr relays are public by design — deleting them from every relay is not something one small site can guarantee. We can hide notes from this site’s view when you ask.

Cookie choices

Use the buttons below anytime. Accept all allows optional sky / booth network features. Essential only keeps first-party storage for the playground and turns off automatic Nostr / booth CDN contact until you Accept.

Accept all Essential only Show banner again

Security basics

• Production site is served over HTTPS (Netlify / cosmecartistry.com).
• No payment secrets, Worker tokens, or redeem codes are embedded in public page files.
• Don’t put passwords or card numbers in the guestbook or help modal — those can travel over public relays.