BLANCO

Who Operates This Site

blancodagoat.dev is operated by an individual using the public handle Blanco / blancodagoat. The operator is based in Hungary. There is no company behind the site. A home address and full legal name are not published on this public page for personal safety. Privacy and legal requests can be sent to [email protected]. If identity verification or legally required private details are necessary for a valid request, they can be handled through an appropriate private channel.

Short Version

Most tools here are designed to work without accounts. Chatlog Magician is the exception: since September 2026 it needs a paid Patreon membership, so opening it means signing in with Patreon. Patreon takes the payment and no card details reach this site. Because a membership is meant for one person, each sign-in records the network block your IP sits in, never the full address, for seven days; if an account turns up on more than four networks I get an alert to look at, and that count blocks nothing automatically; separately, signing in from a second network while the account is already in use waits about 15 minutes (details). Chatlog Magician and the portfolio home stay ad-free. Most Chatlog Magician work stays in your browser. Data leaves your device when you choose a feature that sends it, such as cloud sync, font backup, preset sharing, suggestions, screenshot upload, donations, BlancoKit server-proxied Discord lookups, a DLC Builder problem report, or external donation links. A few requests happen on their own, without any action from you. Every BlancoKit tool page asks the server how many daily lookup credits you have left, which sends your browser's BlancoKit client ID. The BlancoKit status page fetches Discord's public status feed, and the Chatlog Magician footer fetches the public thanks wall. One feature uses AI: BlancoKit Server Builder sends the description you write to a third-party AI model and shows you an AI-generated server plan, which you review before anything is applied. BlancoKit may show optional Google AdSense ads below the tool if you accept cookies.

Data Stored In Your Browser

Chatlog Magician uses localStorage, sessionStorage, and IndexedDB for preferences and project convenience features. This can include chat display settings, character names, recent chatlog history, autosaved projects, finished export images in the Stack panel, custom font files, cloud bucket IDs, disclosure flags, tutorial/help state, and temporary UI state. BlancoKit stores a random browser client ID in localStorage (bk_client_id) so daily server-proxied lookup limits can follow your browser across IP changes. This information is stored by your browser on your device unless you explicitly use an upload, sync, backup, or share feature.

The DLC Builder keeps a short activity history in localStorage (dlc:activity) so the “Report a problem” button can point at a specific moment. It records which files you loaded and how big they were, what you built and with which settings, what you downloaded, any errors, and which tool you opened. It does include the names of the files you dropped in. Entries are deleted automatically after 10 days, which is long enough to build a pack, go and test it in the game, and still find it when you come back. The history stays on your device. Nothing in it is sent anywhere unless you open the report dialog and press Send, and you can erase it at any time with the “Clear history” button in that dialog, or by clearing your browser storage for this site. Your files themselves are never part of it. If you type a Discord username or user ID into the report, it is sent with that one report and used only so the site’s bot can send you a single direct message when the bug you reported is fixed.

Optional Cloud Sync And Font Backup

If you use cloud project sync or cloud font backup, the browser encrypts the project or font backup with the passphrase you enter before upload. The passphrase is not saved by the site and is not sent to the server. The server stores the encrypted blob, generated bucket/object IDs, upload/list/delete requests, and quota counters. Cloud blobs are stored on the VPS filesystem under the Chatlog Cloud service.

Preset Gallery

If you submit a community preset, the site sends the preset name, optional description, cleaned tool settings, generated preview image, and submission timestamp to the preset API. "Cleaned tool settings" means the site tries to keep only the preset options needed to recreate the look. Submissions go into a review queue and are listed publicly only after approval. Rejected ones are deleted. The generated preview image can be fetched by its ID before review, although the preset itself stays unlisted until approved. Presets are meant to hold tool settings, not private chat text, character names, background images, or overlay files.

Suggestions And Contact

The in-app suggestion form sends your summary, description, and priority to the site API, which forwards them to a Discord webhook so I can read and triage it. You can attach your identity in two ways if you want to: type a Discord username by hand, or sign in with Discord using the identify scope. Signing in means the site briefly holds your Discord user ID, username, and display name in order to attach them, then deletes them, and the forwarded message credits you by Discord mention, which stays in that channel. Both are optional and the form works without either. If you contact me by email, Discord, GitHub, or another external channel, that service handles your message under its own privacy policy.

Chatlog Magician Membership And Sign-In

Chatlog Magician was free until September 2026. It now requires a paid membership on Patreon, starting at $2 per month, and opening the tool means signing in with Patreon OAuth. The sign-in uses the plain identity scope, which returns your Patreon user ID, the display name on your Patreon profile, your avatar image URL, and your membership to this project's campaign only. It does not return your email address, your payment details, or what else you support on Patreon. Patreon handles authentication; this site never receives your Patreon password.

After sign-in the server stores a session record holding those profile fields, the result of the membership check (your tier, your pledge amount in cents, and whether your last charge went through), and the Patreon access and refresh tokens so the membership can be re-checked without sending you through the sign-in popup again. Those tokens stay on the server and are never exposed to your browser. Your browser gets an HttpOnly first-party cookie (cm_session) that expires after seven days, plus a short-lived cm_oauth_state cookie for the couple of minutes the Patreon login is in progress. Both are strictly necessary to serve a tool you have paid for, so neither is part of the cookie banner. One session is allowed per account at a time; signing in on another device ends the previous session.

There is a second way in that involves no Patreon account at all, for people Patreon cannot reach. An access code unlocks the tool on its own, and when you sign in with one the server holds no profile data about you whatsoever: no name, no avatar, no email, no Patreon ID. The session is keyed to the code itself. What is stored against a code is the code, how many days it is worth, when it was redeemed and when it expires, and a short note written by me recording where it came from, such as which payment it was issued for. Everywhere the identifier is shown outside the server, including the staff alerting channel, it appears as a one-way hash rather than the code itself, so a log line cannot be used to take somebody's access.

If you pay in USDC on Solana, the parts of that payment recorded here are the transaction signature, the amount, and the wallet address the payment came from. All three are already public: they are written on a public blockchain by the act of paying, and this site reads them rather than collects them. The sending wallet is kept so that a later payment from the same wallet can extend your access without you doing anything. No card number, bank detail, or billing address is involved at any point, and none could reach this site even in principle.

Renewal reminders are optional and off unless you ask for them. If you press "Remind me on Discord", you are sent through Discord's own authorisation screen using the plain identify scope, and the only thing kept is your numeric Discord user ID, stored against your code so the bot can send you one direct message before the access runs out. No email address is requested or stored for this, there is no mailing list, and the ID is discarded with the code record when it expires. You can have it removed sooner by emailing [email protected].

A sign-in is also tied to the browser it was created in. The session record stores a short hash of your browser's identification string (the User-Agent that every browser sends with each request), never the string itself, and a request whose hash does not match is treated as signed out. That way a copied cm_session cookie does not work anywhere else. Because that string changes when your browser updates itself, a browser update may ask you to sign in again.

The membership check is cached for six hours. After that, the next time you open the tool the server re-checks your pledge with Patreon rather than trusting the stored answer. Patreon also sends a webhook when a pledge is created, changed, or cancelled.

Checking for shared accounts. A membership is meant for one person, so the site keeps a rough count of how many different networks an account signs in from. On each sign-in the server takes your IP address, reduces it to the surrounding network block, and stores only that block with a timestamp. For IPv4 that is the /24, so 203.0.113.47 is recorded as 203.0.113.0/24; for IPv6 it is the /48. Your full IP address is not stored, and the block covers up to 256 addresses, so it identifies a network rather than a device. At most the 32 most recent blocks are kept per account, and every entry is deleted seven days after it was recorded.

If more than four distinct network blocks show up for one account inside that rolling seven days, the site raises an internal alert for me to look at, at most once per account per day. That is all the count does. No account is blocked, throttled, suspended, or cancelled because of it, and the count never feeds an automated decision about you. Four networks is normal for one person with a phone, home wifi, work, and a cafe, which is exactly why the number only starts a human looking rather than triggering anything. If a shared account is ever acted on, a person decides it and you can contact me about it at [email protected].

Waiting out a second network. One anti-sharing rule does act on its own, so it is worth stating plainly. If the account was used from a different network block within the last 15 minutes, a new sign-in from a third network is refused, and sign-ins from other networks stay refused for about 15 minutes. It uses only the network block described above and stores nothing else: one entry recording which network holds the account, which deletes itself when the 15 minutes are up. Nothing about the session already running changes, nothing is deleted, and the account is not banned or suspended. Signing in again from the network already using the account works normally, and after the wait any network can sign in again.

Patreon is the merchant of record for the membership. Payment is taken on Patreon, and no card number, bank detail, or billing address ever reaches this site. Pricing, renewals, cancellation, and refunds are handled by Patreon under Patreon's own privacy policy and terms. If your membership lapses, the session stops granting access at the next check and the stored session record expires on its own.

Patreon And The Thanks Wall

Payments are handled by Patreon. This site does not process or store card numbers. Patreon sends a webhook to this site when a pledge is created, changes, or ends, and the site also checks your pledge when you sign in. The site stores your Patreon user ID, pledge amount, and the display name Patreon supplies for you. Only the first word of that display name is shown on the thanks wall in the site footer, length-capped, and withheld pending review if it contains blocked language. This applies to pledges of $5 a month and above; the $2 Access tier keeps full access but is not listed. Because it is the first word rather than a first name, a single-word display name is shown in full, and a name written surname first shows the surname. If you would rather not be listed, email [email protected] and it is removed.

That wall is public. It is part of the page footer, so anyone opening the tool can read it and search engines can index it. Being listed is not a condition of the membership and you can opt out of it at any time: email [email protected] and the name comes off. Wall entries stay up until your pledge ends or you ask for removal.

Screenshot Uploads

If you upload a Stack screenshot, the image is sent to this site's own server (blancodagoat.dev), not to a third-party image host, and no separate account or API key is required beyond being signed in to the tool. The server stores the image on the VPS filesystem under a filename derived from a hash of the image contents, so identical uploads are stored only once. It returns a public link on blancodagoat.dev; anyone who has the link can view the image. Uploaded images are kept indefinitely and are not tied to an account. The site may remove images, for example in response to an abuse report. Uploads are also mirrored to a private Discord monitoring channel, described under Analytics, Logs, And Security. Only upload images you are comfortable making publicly accessible.

BlancoKit Sign-In And Lookup Credits

BlancoKit (/discord/) offers optional sign-in with Discord OAuth using the identify scope only. That returns your Discord user ID, username, display name, and avatar hash so the site can show who is signed in and attach daily lookup credits to your account instead of only your browser or IP address. Discord handles authentication; this site does not receive your Discord password. After sign-in, the server stores a random session token in Redis and sets an HttpOnly first-party cookie (bk_session) in your browser.

BlancoKit is fully free: there are no paid tiers, subscriptions, or billing records, and none are planned. Every visitor gets the same daily lookup limit whether signed in or not. Signing in only moves that limit from your browser to your Discord account. The Chatlog Magician membership described above does not apply here and buys nothing on BlancoKit; the two sign-ins are separate and neither is required for the other.

When you are signed in, BlancoKit may store a short lookup history (tool name, ID you looked up, optional label, timestamp) and optional pinned favorites in Redis for up to 30 days to power the account dashboard. Any signed-in user may create API keys (bk_…); key hashes and metadata are stored server-side. API keys use the same daily credit pool as the web UI. You can revoke keys from the account page.

BlancoKit And Discord Tools

BlancoKit (/discord/) is a separate browser toolkit with utilities such as user lookup, invite resolution, webhook checks, presence lookup, embed builders, and other Discord-related helpers. Most BlancoKit tools run entirely in your browser. A smaller set of features call this site's API so a server-side Discord bot token or third-party presence service can fetch public data on your behalf.

When you use a server-proxied BlancoKit lookup (such as user, invite, webhook, or presence), the browser sends the identifier you entered plus a first-party client ID header (X-BK-Client-Id) derived from the bk_client_id value stored in your browser when you are not signed in. If you are signed in with Discord, lookup credits are tracked against your Discord user ID instead. The server uses that identity and your IP address to enforce daily lookup credit limits and abuse prevention. Credit counters are stored in Redis with a short automatic expiry. Limits reset at midnight UTC. Failed validation does not spend a credit; successful or attempted proxied lookups may spend one credit even if Discord or a third-party API returns an error.

For user lookups, the server uses a Discord bot token to request public profile data from Discord and returns items such as usernames, display names, avatar or banner URLs, badges, account age, public flags, accent or banner colors, and other public fields exposed by Discord. Presence lookup may call the third-party Lanyard API with the user ID you enter. Webhook checks send the webhook URL you enter to Discord for a read-only validation request.

Two tools talk to Discord straight from your browser without passing through this site: the Guild Shard Calculator's optional “fetch gateway” button, which uses the bot token you paste, and the Embed Builder's optional send, which posts to the Discord webhook URL you supply. Both values stay in your browser. This site never receives or stores them.

BlancoKit also has a small analytics endpoint that records events such as page views, tool actions, user lookups, and support clicks with path, referrer host, language, viewport, timestamp, and event details. These events are forwarded to private Discord channels used to monitor the tools. Two points are easy to miss. The cookie banner does not control the events the server writes when a proxied lookup runs: declining cookies stops what your browser sends, not what the server records about its own API calls. And for a lookup, the details include a snapshot of the public data that came back. For a user lookup that means the looked-up account's ID, username, display name, avatar and banner images, badges, public flags, and creation date. If you look someone up, it is their public Discord profile that gets logged, not yours. The log exists to show how the tools are used and to protect the server, not to build user accounts.

For some browser-only BlancoKit tools the event details include the value you typed, since that is what makes the record readable later: a snowflake ID, a guild or channel ID, a permissions client ID, or a short hash input. Those are only sent if you accepted analytics cookies.

Chatlog Magician has a similar analytics endpoint that only records if you accept analytics cookies. It logs anonymous usage events (such as support-prompt interactions and which tool features you use, for example export format or entering canvas mode) with path, language, viewport, timestamp, and limited event details. It is used to understand which features matter so I know what to improve, not to identify you. It does not include your chat text, character names, or uploaded images.

The DLC Builder records the same kind of anonymous usage events, and only if you accept analytics cookies: that the page was opened, that a pack build ran (how many input files, their total size and types, and whether it passed validation), that a file was downloaded (its type only), and when something went wrong — an error message, a crash, or a file type the tool doesn't support yet. Error text has file names stripped out of it before it is sent. Your files are never uploaded — the builder still runs entirely in your browser — and file names, pack names, and file contents are not logged.

The DLC Builder’s “Report a problem” button sends a report when you press Send, and not before. It contains the options you ticked (what went wrong, and whether you could finish), which tool you were in, and the ten or so steps of local history you picked. The dialog has no free-text box, so there is nothing you can type into it. Before the report is sent, file names in that history are replaced with <file> and any name you gave a pack is replaced with <name>, and the dialog then shows you the finished report so you can read what will be sent. A report carries no account, no email address, and no identifier that links it back to you, which is also why we cannot reply to one. Reports are sent even if you declined analytics cookies, because pressing Send is the consent for that one submission.

When you upload a Chatlog Magician screenshot to get a shareable link, the server records the upload with its public link, size, and image type, then posts that record to a private Discord channel used to watch the image host for abuse. The post includes a preview of the image itself. The record does not include your IP address or any account identifier. The server writes it rather than your browser, so it happens even if you declined analytics cookies, and Discord keeps that message under its own policy. It is one more reason to upload only images you are happy to have public.

AI Features And AI-Generated Content

One feature on this site uses artificial intelligence: BlancoKit Server Builder (/discord/server-builder), free with Discord sign-in. Everything else — Chatlog Magician, the DLC Builder, the portfolio pages, and the other 34 BlancoKit tools — contains no AI features and generates nothing with AI.

In Server Builder you describe the community you want in your own words. That description is sent to a third-party AI language model, which drafts a proposed server layout: role names, colors, channel names, categories, channel topics, and permission settings. Everything in that plan is AI-generated content. It is labelled as AI-generated in the tool itself, both before you write the description and on the preview of the result.

AI output can be wrong, incomplete, or not what you intended. The plan is a draft, not professional advice, and it is not a security configuration you should trust unreviewed. The tool never applies a plan on its own: you see the full plan, run preflight checks, and then choose to apply it. Before each apply, the server saves a snapshot of your server's current structure so the change can be undone. That snapshot holds the guild name, description, icon and banner, every role with its color and permissions, and every channel with its topic and permission overwrites. It contains no messages and no member data. Snapshots are stored against your Discord user ID and guild ID, the last three per server are kept, and each one expires after 30 days. There is no automated decision-making that produces legal effects or similarly significant effects for you — you decide whether anything is applied.

The models used, in order:

• Groq (Groq, Inc., United States) running an open-weight Llama model, used first when configured.
• Google Gemini (Google LLC) via the Generative Language API, used as a fallback when Groq is unavailable or rate-limited.

The tool shows you which of the two produced your plan. The request is made server-to-server from the VPS, so the provider receives the server's IP address, not yours.

What is sent to the model provider: the free-text description you write, plus the guided answers next to it (kind of group, community size, vibe, whether you want voice channels, must-have channels or roles, and the server name if you fill that in), truncated to 4,000 characters. What is not sent: your Discord account or user ID, your email, your guild ID, your existing server's roles, channels, members, or messages, and your IP address. Do not put personal data or anything confidential in the description — it is prompt text sent to a third party, and the providers apply their own retention and abuse-monitoring practices to it, which this site does not control. This site does not store your prompt text after the plan is generated, and does not use your prompts or generated plans to train any model.

The generated plan is also marked in machine-readable form: the response that carries it includes a provenance record stating that the content is AI-generated, which model and provider produced it, and when. This follows Article 50(2) of the EU AI Act and Sub-measure 1.1.1 of the Commission's Code of Practice on Transparency of AI-Generated Content. No imperceptible watermark is applied, because the plan is short structured names rather than free-form prose, which is the case that measure exempts.

Server Builder is only reachable after you sign in with Discord, which is free, so the AI feature is never triggered by simply visiting a page.

Analytics, Logs, And Security

The site uses Cloudflare and a Hetzner VPS. The live VPS is hosted in Hetzner's Nuremberg, Germany region. These providers and the nginx/Express servers can receive ordinary request data such as IP address, user agent, requested URL, referrer, timestamps, and error/security events. BlancoKit lookup credit counters (client ID, IP address, usage count, and day bucket) are stored in Redis for abuse prevention. If Cloudflare Web Analytics is enabled at the edge, it can collect privacy-preserving traffic metrics. Google Analytics 4 (G-WPNCDS433D) may collect page views and usage metrics on production pages via cookies set by Google. Local scripts also keep aggregate Cloudflare and search-performance CSV snapshots for site operations. Server-side nginx logs, systemd service logs, and local Chatlog Cloud backups are retained for 14 days unless a longer retention period is required for security, abuse investigation, payment verification, or legal obligations.

Anonymous Usage Measurement

Chatlog Magician, the DLC builder, and BlancoKit send a small first-party usage ping when a feature is used (for example "a chatlog was generated", "a pack was built", or "a lookup ran"). Each ping carries only the event name, the page path, your browser language, viewport size, and a timestamp. It sets no cookie, stores nothing on your device, contains no account or device identifier, and the server does not keep your IP address or user agent with it — so the stored data is anonymous and cannot be linked to you or across visits. It is used solely to see which features are worth improving, never for advertising or profiling, and is never shared with third parties. Because nothing is stored on your device and no personal data is kept, these pings do not require consent; they run on an opt-out basis instead. If your browser sends a Global Privacy Control signal, the pings are disabled automatically. You can also opt out here at any time (the choice is saved in your browser as bk_analytics_optout):

Opt out of anonymous usage stats

Cookies

Chatlog Magician and portfolio pages do not use advertising cookies. A cookie banner appears across the whole site, on Chatlog Magician and the portfolio pages as well as BlancoKit, and lets you accept or reject optional analytics cookies (Google Analytics) together with ad cookies (Google AdSense), which apply on BlancoKit if ads are ever switched on. Your choice applies site-wide and is stored in localStorage as bk_analytics_consent (granted or denied). Google Analytics and AdSense load only if you accept. The first-party anonymous usage pings described above are separate from this banner and follow their own opt-out. Rejecting cookies keeps tools usable; Chatlog Magician and the portfolio pages show no ads either way. Browser ad blockers may still block third-party scripts even after you accept; first-party server logs and optional Cloudflare Web Analytics are separate. BlancoKit sign-in uses an HttpOnly bk_session cookie when you log in with Discord, and a short-lived bk_oauth_state cookie for the few minutes the Discord login is in progress, to protect against cross-site request forgery. Chatlog Magician sign-in works the same way with Patreon: an HttpOnly cm_session cookie once you are signed in, and a short-lived cm_oauth_state cookie while the Patreon login is in progress. Both are strictly necessary to serve a tool you have paid for, so neither is covered by the banner. The only other first-party cookie in the code is an admin-only cm_gallery_admin session cookie for the private preset gallery admin page. It is HttpOnly, SameSite=Lax, Secure in production, and expires after 30 days. Third-party sites you visit from links may set their own cookies.

Third-Party Services

This project can interact with these services, depending on which pages or features you use:

• Cloudflare for DNS, edge security, possible Web Analytics, and email routing for the [email protected] address (incoming mail is forwarded to a Google mailbox); Cloudflare may process data internationally.
• Resend, Inc. for outbound email sent from [email protected], such as replies to privacy or support requests; Resend may process data internationally.
• Google Analytics (Google LLC) for site traffic measurement on production pages; Google may process data internationally.
• Hetzner Online GmbH for VPS hosting of the static site and API services; the live VPS is in Hetzner's Nuremberg, Germany region.
• Discord for suggestion webhooks, release webhooks, Discord profile lookup, and webhook validation.
• Lanyard (api.lanyard.rest) for optional BlancoKit presence lookup when a user has opted into that third-party service.
• Google AdSense (Google LLC) on BlancoKit only, when you accept cookies; Google may process data internationally for ad delivery and measurement.
• Groq, Inc. and Google LLC (Gemini) as AI model providers for BlancoKit Server Builder only; both may process data internationally.
• Patreon (Patreon, Inc., United States) as the payment processor and merchant of record for the Chatlog Magician membership, and as the sign-in provider for it; Patreon processes data in the United States.
• Google Fonts, cdnjs, jsDelivr, and code.jquery.com for fonts and JavaScript libraries on some pages.
• Discord Status (Atlassian Statuspage) when you open the BlancoKit status page; that page fetches Discord's public status feed directly from your browser.
• WidgetBot (e.widgetbot.io) only if you click "Load third-party preview" in the Website Discord Widget tool; the preview is a frame served by WidgetBot, which sees your IP address.
• top.gg, for the public BlancoKit API's bot lookup endpoint.
• GitHub, mail clients, and social/contact links when you choose to open them.

Why Data Is Used

Data is used to provide the tools you request, remember local preferences, sync encrypted backups when you ask for them, publish submitted presets, process suggestions, show the thanks wall, check that a Chatlog Magician membership is active, enforce BlancoKit lookup credits and other quotas, secure the service, measure aggregate traffic, and respond to contact or legal requests.

Legal Basis For EU/UK Visitors

Where EU or UK data protection law applies, the usual legal bases are your consent for optional submissions and uploads, performance of a requested service for cloud sync, Server Builder plan generation, and contact replies, performance of a contract for the Chatlog Magician membership, the sign-in that checks it, and the thanks wall listing included in the $5 and $10 levels, legitimate interests for security, abuse prevention, debugging, and aggregate analytics, and legal obligations for valid legal or payment-related records. The wall listing is not based on your consent: once a pledge reaches $5 a month the first word of your Patreon display name is published automatically, because that listing is part of what those levels include. It comes off when your pledge ends, and you can object at any time by emailing [email protected] to have it removed.

Other Visitors

The request rights described in "Your Rights" are handled as a general practice for all visitors, not only EU/UK visitors, when the request can be reasonably verified and matched to data this site actually holds.

For California visitors, the CCPA/CPRA generally applies to for-profit businesses doing business in California that meet thresholds such as over $26,625,000 in annual gross revenue (the inflation-adjusted 2026 threshold, up from the original $25 million figure in the statute), buying, selling, or sharing the personal information of 100,000 or more California residents or households, or deriving 50% or more of annual revenue from selling or sharing California residents' personal information. Based on the current solo, ad-free setup, whose only revenue is the Chatlog Magician membership and voluntary donations, both far below the revenue threshold, and no sale of personal data or sharing for targeted advertising, this site appears below those thresholds; the practical request rights above are still honored where possible.

Visitors from Turkey, Indonesia, Hong Kong, and other jurisdictions have their own data protection laws, including KVKK, Indonesia's UU PDP, and Hong Kong's PDPO. Instead of a country-by-country legal breakdown, this site aims to honor the same privacy principles for everyone: no ad tracking, no data sales, minimal collection, reasonable security, and access, correction, or deletion requests handled on request.

Retention And Deletion

Browser-stored data remains until you clear it in your browser or use the tool's delete controls. One thing expires on its own: the DLC Builder's local activity history is deleted 10 days after each entry was recorded, and you can erase it sooner from the “Report a problem” dialog. Cloud projects can be deleted from the cloud sync UI. Font backups can be overwritten by making a new backup. Presets and thanks wall names require a manual request for removal. Donation records are kept indefinitely for payment verification, abuse prevention, accounting, and to stop the same transaction being claimed twice. For Chatlog Magician: sign-in sessions expire seven days after they are created, or sooner if you sign out or a newer device pushes them out; the network-block records used for the shared-account check (above) are deleted seven days after each sign-in; and the cached answer to "is this pledge active" is re-checked against Patreon after six hours. Thanks wall entries stay until your pledge ends or you ask for removal. No card or billing record is held here, because Patreon takes the payment. BlancoKit keeps no billing records. API key hashes and their metadata are kept until you revoke the key. Server Builder revert snapshots expire 30 days after the apply they belong to, and BlancoKit lookup credit counters in Redis expire after about 48 hours. The analytics event logs described above (Chatlog Magician usage events, BlancoKit and DLC Builder events, and screenshot-upload records) are append-only files kept indefinitely. They contain no IP address and no cookie. Two kinds of entry do carry an account identifier: pledge lifecycle events, written when a pledge is created, changes, or ends, and the shared-account alerts described above. Both record your Patreon user ID, a pledge event also records the amount and tier name, and an alert also records how many networks were counted. Neither records your name or your IP address. Both are appended to the same log files, forwarded to a private Discord channel only I can read, and kept under the same indefinite retention and backup as every other entry. Copies are downloaded to the operator's own machine as an off-site backup on every deploy. Nginx logs, systemd service logs, and local Chatlog Cloud backup archives are retained for 14 days, except where a longer period is needed for security, abuse investigation, payment verification, or legal obligations.

Your Rights

You can request access, correction, deletion, restriction, objection, or portability for personal data connected to you. Send requests to [email protected] and include enough detail to identify the data, such as a cloud bucket/project ID, preset name, donation transaction ID, BlancoKit browser client ID, suggestion details, or public wall display name. I may need to verify that you control the relevant identifier before making changes.

You also have the right to lodge a complaint with a data protection supervisory authority. In Hungary, this is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH). Current NAIH contact details include email [email protected], postal address 1363 Budapest, Pf. 9., office address 1055 Budapest, Falk Miksa utca 9-11, and phone +36 (1) 391 1400. If you live elsewhere in the EU or UK, you can also contact your local supervisory authority.

International Transfers

The operator is based in Hungary, the live VPS is hosted by Hetzner in Germany, backup copies of the server's analytics logs are held on the operator's own machine in Hungary, and Cloudflare and other third-party providers may process data internationally.

• Cloudflare states that, for EEA/UK transfers to the United States, it relies on its EU-U.S. Data Privacy Framework certification and uses Standard Contractual Clauses if that certification lapses or for other international transfers.
• Discord states that it uses the European Commission's Standard Contractual Clauses, adequacy decisions where available, and the EU-U.S. Data Privacy Framework for its U.S. entities.
• GitHub states that it generally relies on the European Commission's Standard Contractual Clauses and also participates in the EU-U.S. Data Privacy Framework.
• Google states that it relies on adequacy decisions, the EU-U.S. Data Privacy Framework, and Standard Contractual Clauses where required.
• Groq states that it uses the European Commission's Standard Contractual Clauses for transfers to the United States, adds the UK ICO International Data Transfer Addendum for UK transfers, and otherwise relies on approved contractual protections or a third party's Data Privacy Framework certification.
• Patreon (United States) receives your sign-in when you open Chatlog Magician and holds the payment relationship for the membership, so your Patreon identity and pledge data are processed there. Patreon publishes international-transfer language, but I could not confirm a specific SCC, adequacy, or Data Privacy Framework mechanism from its current public page.

Security

The site uses HTTPS, security headers, origin checks, body-size limits, rate limits or quota counters on sensitive endpoints, local-only backend binding behind nginx, and passphrase-based browser-side encryption for cloud project/font backups. No website can promise perfect security, so avoid submitting secrets or private chat content unless you are intentionally using an encrypted backup feature and understand what you are sending. If a data breach creates a risk to affected users' rights or safety, I will investigate and notify affected users or the appropriate authority without undue delay where required.

Children

The site is not directed at children and does not knowingly collect children's personal data. If you believe a child submitted personal data, contact me and I will review it.

Newsletters And BlancoKit Ads

The site does not operate a newsletter or account-based marketing list. Chatlog Magician, portfolio pages, and legal docs stay ad-free. BlancoKit may show one below-the-fold Google AdSense unit per page when you accept cookies. There is no Meta Pixel, TikTok Pixel, Hotjar, Microsoft Clarity, or LogRocket integration. Optional Google Analytics runs on production pages when you accept cookies.

Changes To This Policy

This policy may be updated when features, providers, or hosting arrangements change. The "Last updated" date at the top shows when the page was last revised.

Contact

For privacy requests, email [email protected]. You can also reach the project owner via GitHub.

Back to home