Skip to content
Rock Paper Glam

Privacy Policy

What rockpaperglam.com learns about visitors, why, how long it is kept and what you can do about it.

Who is responsible for your data

The controller of personal data collected on this site is the site administration of Rock Paper Glam (rockpaperglam.com). For privacy requests, use the feedback form and choose the topic “Other”.

In short

  • There are no reader accounts and no sign-up. The only form that sends us a message is the feedback form.
  • Our tools — tarot readings, calculators, quizzes and the like — run in your browser: what you enter is not sent to us.
  • We do not store the IP address of people who use the feedback form — only an irreversible hash used to fight spam.
  • We do not sell your personal information and do not share it for cross-context behavioral advertising.

What we collect, why and for how long

Feedback messages

What
the topic and text of your message; your name and contact (e-mail or Telegram) if you provide them; the address of the page you came from; the date; a shortened browser string (User-Agent); a salted hash of your IP address — not the address itself.
Why
to read your message, fix a mistake and reply if you left a contact; to protect the form from spam and abuse.
Legal basis (EU/UK)
your consent, given when you send the form (Art. 6(1)(a) GDPR / UK GDPR); spam protection — our legitimate interests (Art. 6(1)(f)).
How long
365 days after sending; messages marked as spam — 30 days. Then they are deleted automatically, or earlier at your request.

Server logs

What
IP address, date and time of the request, page address, response code, browser string (User-Agent), referring page.
Why
security (blocking attacks and bots), finding errors, keeping the site running.
Legal basis (EU/UK)
our legitimate interests (Art. 6(1)(f) GDPR / UK GDPR).
How long
for the limited time needed for security and debugging; logs are deleted regularly during rotation.

Visit statistics (Matomo)

What
which pages were opened, where visitors came from, device and browser type, approximate region. Matomo runs on our own infrastructure, without cookies; IP addresses are anonymized before they are stored.
Why
to understand which pages and tools are useful and what to improve. We only look at aggregated reports.
Legal basis (EU/UK)
our legitimate interests (Art. 6(1)(f) GDPR / UK GDPR).
How long
aggregated reports are kept without a time limit; raw visit data is deleted on a schedule.

Popularity counters in tools

What
in some tools, which option you picked; together with it, your IP address to filter out repeated votes.
Why
to show the most popular options first. The counter itself is anonymous: it only holds the number of picks per option.
Legal basis (EU/UK)
our legitimate interests (Art. 6(1)(f) GDPR / UK GDPR).
How long
the IP address with the option ID is kept in server memory for up to 2 days (one vote per address per day) and then deleted automatically; the counter has no time limit because it contains no personal data.

Tools that run in your browser

Tarot readings, calculators, quizzes and generators do their work on your device: the dates, names and answers you enter are not sent to our server. Anything a tool needs to remember (for example, your last reading or saved favorites) is kept only in your browser’s local storage, and you can clear it at any time.

Cookies and local storage

  • rock-paper-glam-session, XSRF-TOKEN — ours

    technical site session and protection of form submissions against forgery. Expires: 120 minutes after your last action.

  • tool entries (local storage) — ours

    what you picked or entered in tools that need to remember it. Expires: until you clear site data or press “Clear” in the tool.

You can refuse cookies in your browser settings (block or delete third-party cookies) and — in the EEA, the UK and Switzerland — in the consent window. The site works without cookies; only the feedback form will not send.

Who we share data with

  • YouTube (Google) — when you start an embedded video; until you press play, only the thumbnail is shown.
  • Our hosting and content delivery providers, only for technical storage and protection against attacks.
  • Telegram — when a message arrives through the feedback form, the site team gets a notice from a Telegram bot in a private team chat. The notice contains the message number, its topic, the first 1,500 characters of its text and whether a contact was left; your name and contact are not included. The hash of your IP address, your browser string and the page you came from are never included. This data is processed by Telegram on its servers, including outside your country. The messages themselves are kept on our side for the period given in the “Feedback messages” section above.
  • Public authorities — only where the law requires it and in the way the law sets out.

Our providers may process data outside your country, including in the United States. For transfers of personal data from the EEA or the UK we rely on the safeguards the GDPR and UK GDPR provide for (adequacy decisions or standard contractual clauses).

We do not share feedback messages with anyone and do not use them for mailings.

Your rights and how to use them

Depending on where you live, you may have the right to:

  • know what personal data we hold about you, why and where it came from, and get a copy of it;
  • ask us to correct or delete it;
  • object to processing or restrict it, and withdraw your consent at any time;
  • receive your data in a portable format;
  • not be discriminated against for using any of these rights.

Visitors from the EU and the UK have these rights under Articles 15–21 of the GDPR and the UK GDPR and can complain to their local data protection authority — in the UK, the Information Commissioner’s Office (ICO).

Residents of US states with privacy laws (for example, California under the CCPA as amended by the CPRA) have similar rights to know, delete and correct personal information and to opt out of its sale or sharing. We do not sell or share personal information, so there is nothing to opt out of; you can still send us any request.

How to use them: write to us through the feedback form and leave a contact for the reply. We answer within one month (GDPR/UK GDPR) or 45 days (US state laws). There are no accounts on the site, so to find your message we may ask for its approximate date and topic.

How we protect data

The site works over HTTPS. Only the site team can access feedback messages, from the server console; the IP address in the form is stored only as a salted hash; old messages are deleted automatically. Notices about new messages reach the team in a private Telegram chat (see “Who we share data with”).

Children

The site is not directed at children under 13 and we do not knowingly collect personal information from them (as required by COPPA in the US). If a child has sent us a message with personal details, let us know and we will delete it.

Changes to this policy

When the data we collect, the services we use or the retention periods change, we update this page and the date at the top.

Laws referred to

Links to laws are given for reference; this page is not legal advice. See also our terms of use.