Privacy

Who we are

Glassbox (glassbox.how) is a personal, non-commercial project by Deepankar Biswas. It publishes one interactive explainer (“box”) a day, with its source code. When this page says “we”, it means Deepankar Biswas, who decides how the data described here is used.

Everything, in one table

Google Analytics: understanding visits

We use Google Analytics 4, a service from Google, to count visits and see how people use the site: which boxes they open, how long they stay, where they came from (a search, YouTube, Instagram, another site), and roughly where in the world they are.

When it runs. If your device is set to a time zone in the EU/EEA, the UK or Switzerland, Google Analytics doesn't load until you press “Allow” on the banner. We work this out from your device's time zone, not your IP address. Elsewhere, it loads unless you opt out. Either way, you can change your mind at any time with “Privacy choices” at the bottom of every page, or the “Privacy” link in each box. Choosing “No thanks” deletes the Google Analytics cookies.

We've switched off Google signals and ad personalisation, so this data isn't linked to Google accounts or used for advertising. Google Analytics 4 works out an approximate location from your IP address; Google states that GA4 doesn't log or store IP addresses. We never send Google your name, email or anything you type. Reports reach us as totals and trends, like “a thousand people opened CameraClear yesterday”, and don't identify individuals. We keep analytics data for 14 months.

Google processes this data for us. See how Google safeguards Analytics data and the Google Privacy Policy.

ClickTrust: detecting bots

A lot of web traffic isn't people. It's crawlers, scrapers and bots, some of them harmful. We use ClickTrust (clicktrust.cc), an invalid-traffic detection service, to spot them.

To do that, ClickTrust looks at technical signals from each visit: your IP address, how your browser and device present themselves, and how the page is used (for example, whether interactions look human). It uses them only to judge whether a visit is genuine, which keeps our visitor numbers honest and helps protect the site from abuse. It isn't used for advertising, to build a profile of you, or to identify who you are.

Because this protects the site itself, ClickTrust runs even when your browser asks not to be tracked.

Cookies and what's stored on your device

To clear them, use your browser's “clear site data” option for glassbox.how. Private or incognito windows forget them automatically.

Your choices

• Use “Privacy choices” at the bottom of any page (or “Privacy” in a box's bar) to allow or refuse Google Analytics. Your answer is remembered on your device.
• Send a privacy signal. If your browser sends Global Privacy Control or Do Not Track, Google Analytics doesn't load at all.
• Opt out of Google Analytics everywhere with Google's opt-out browser add-on.
• Block or delete cookies in your browser settings, or use a content blocker. The site works fully without them.
• Use the boxes offline. Every box is open source. Clone it and run it on your own computer, and no analytics run at all.

Why we're allowed to (legal basis)

If you're in the European Economic Area or the United Kingdom, the law asks us to say why we process this data. For bot detection it's our legitimate interest in keeping the site secure and its statistics accurate. For Google Analytics it's your consent: we ask before loading it, and you can withdraw consent at any time from “Privacy choices”. Outside those regions, we rely on our legitimate interest in understanding which explainers are useful, with the opt-outs above always available.

You have the right to ask about, correct, delete or object to the processing of your personal data, and to complain to your data protection authority. Because we only see aggregated reports, we usually can't tell which data is yours. Tell us what you need and we'll help, including with deletion requests to Google and ClickTrust.

Who else gets data

Only the three services above: Google, ClickTrust and GitHub. They process data on our behalf or to deliver the site, and may do so outside your country. We never sell personal data, never share it for advertising, and never combine it with other sources to identify you.

Videos and YouTube

Our own videos (the 40-second clips on each page) are MP4 files served from glassbox.how. Some pages also offer the video on YouTube. That player is not loaded until you press its play button. Only then does your browser connect to youtube-nocookie.com, Google's privacy-enhanced embed, and Google's privacy policy applies to that player.

How we keep this in check

Every page carries a Content Security Policy: a rule that tells your browser to refuse connections to anything except glassbox.how, Google Analytics and ClickTrust (plus the YouTube player once you press play). You can check it yourself: open your browser's developer tools, look at the Network tab, and you'll see only those. Fonts and libraries are hosted on our own domain, so nobody else learns you visited just because a page needed a font. Pages send no “referrer”, so the sites we link to aren't told you came from us.

The site is served only over HTTPS. If you find a security problem, please open an issue at github.com/bdeeps/glassbox/issues.

Our social media accounts

We publish short videos on platforms such as YouTube and Instagram, and schedule them with a tool called Buffer. No data about visitors to this website passes to those platforms or to Buffer. If you follow, like or comment on our posts there, that's governed by the platform's own privacy policy. Platforms show us aggregated statistics such as view counts.

If you contact us

If you open an issue at github.com/bdeeps/glassbox/issues, we'll see whatever you choose to send, such as your GitHub username or email address. We use it only to reply, and we never add you to a list. GitHub issues are public, so don't put anything private in one.

Children

Glassbox is a general-audience site. It isn't directed at children under 13, and we don't knowingly collect personal information from them. Parents and teachers are welcome to use the boxes with children. A box cloned and run locally sends no data at all.

Changes to this policy

If what we measure changes, we'll update this page before the change goes live and change the date at the top. Because the site's source is public, every past version of this policy is visible, word for word. We'll never add a tracker without listing it here first.

Contact

Questions about privacy, or a request about your data? Please open an issue at github.com/bdeeps/glassbox/issues.