Privacy.

Last updated: 17 September 2026

The short version

There is nothing here to sign up for: no account, no newsletter, no form, no checkout, no payment. The only visitor data collected is Google Analytics, run through Cloudflare Zaraz, and only if you press Accept. Fonts, images and the video still are served from this site rather than from a third party, so nothing about you reaches anyone else before you ask for it. The YouTube player is not loaded until you press play. No ads, no data selling, no other trackers.

1. Who runs this site

This site (https://prompt-kurogane.vikataylor.com/) is published by Vika Taylor, an independent designer and creator, acting as an individual and not through a company. It exists to publish, in full, the two prompts used to build a demo site shown in a video on the YouTube channel @VikaTaylor.

For anything on this page, including any request under section 5, write to vika.taylor.one@gmail.com. That address is the only way to exercise any right described here. No data protection officer is appointed: the scale and nature of the processing below does not require one under GDPR Art. 37.

2. What is collected, and why

The site itself collects nothing. Every page is static HTML. There is no account to create, no login, no newsletter, no comment field, no form and no upload. If you never accept analytics, this site learns nothing about you beyond what your browser has to reveal to receive the page at all, which is described in section 2a.

a. Request logs at the host

The site is served by Cloudflare. As with any host, the request is processed before a consent question can be asked, because that processing is how the page reaches your browser at all: IP address, user agent, the URL requested and a timestamp. This happens whatever you later choose on the banner, and there is no version of visiting a website where it does not. It is used for delivery, caching and abuse protection. Legal basis: legitimate interest, GDPR Art. 6(1)(f). It is not analytics, it is not joined to the analytics data below, and no report is built from it here.

b. Analytics, and only after you accept

Google Analytics 4 (measurement ID G-VFPV5MZNL2) is the only analytics tool on this site, and it runs through Cloudflare Zaraz, a Cloudflare service that runs such tools on Cloudflare's servers instead of in your browser. Before you click Accept, and after you decline, this page sends nothing to Zaraz, so nothing reaches Google. After you click Accept, /consent.js starts Zaraz, served from this site under /cdn-cgi/zaraz/. Zaraz tells Cloudflare the page address and title, the referring page, your screen and window size, colour depth, character set and time-zone offset, and Cloudflare's servers pass Google the page view, this site's events, your browser's user-agent, your IP address and a random ID kept in a cookie. Your browser makes no request to Google for any of this. Google uses the IP address to estimate an approximate location and states that Google Analytics 4 does not log or store IP addresses.

Cloudflare runs Zaraz as a processor, in the same role it has as the host.

After you accept, the site tells Google, through Zaraz, that analytics_storage is granted and that the advertising signals are denied, because the banner asks about analytics and nothing else. There is no advertising tag, no remarketing tag and no conversion tag on this origin.

Once accepted, it records the pages viewed, the referring source, an approximate location derived from the IP address (a country or a region, never an address), device and browser type, and how long the visit lasts. The purpose is narrow: to see whether anyone reads the prompts and where they came from. Legal basis: your consent, GDPR Art. 6(1)(a).

c. The embedded video

The video block on the front page is a still image with a play button, not an embedded player. The still is a file on this origin. No <iframe> exists in the page that is served to you, so on page load nothing is requested from YouTube, from Google, or from any Google image host, and no YouTube cookie can be set.

When you press play, and only then, a player is created against www.youtube-nocookie.com. From that moment YouTube receives your IP address, your user agent and the fact that this page embedded this video, and it may set storage in your browser under its own domain. That is YouTube's processing, governed by Google's privacy policy, and it is outside this site's control. The nocookie host reduces what is written but does not eliminate it.

Legal basis, where the GDPR applies: consent, Art. 6(1)(a), given by the deliberate act of pressing play after being told on the page what pressing play does. If you would rather not, the link next to the player opens the video on youtube.com directly, which is the same exchange but on YouTube's own page rather than inside this one.

d. Nothing else

No profiling, no advertising, no cross-site tracking, no fingerprinting, and no data sold or shared with anyone.

3. Cookies and local storage

This site's own code sets no cookies. The cookies listed here are set by Cloudflare Zaraz, and only after you accept; the other entries sit in your browser's own storage.

• cfz_google-analytics_v4, cfzs_google-analytics_v4 and cf_zaraz_client: cookies set by Cloudflare Zaraz for Google Analytics, only after you press Accept. The first holds the random ID that tells one visit from another and lasts a year; the second counts page views in the current session; the third is Zaraz's own working cookie and lasts a year. They are set for vikataylor.com, so every site in the network shares them, and they are HttpOnly, so no script on a page can read or delete them.
• _zaraz_google_consent_update: a localStorage entry Zaraz writes after you accept. It holds the consent state passed to Google, analytics allowed and advertising not, and no identifier.
• pk_consent: your consent choice. This is a localStorage entry on this origin, not a cookie, so it is never attached to a request and never leaves your browser. It holds one word, granted or denied, the moment you chose and the version of this policy you answered. It expires after 180 days, or sooner if this policy changes in a way that needs a new answer, and you are then asked again rather than carried forward on an old answer.

You can change or withdraw your choice at any time with the Cookie settings control, which also sits in the footer of every page. It reopens the same banner with the same two buttons, so withdrawing consent is exactly as easy as giving it, which is what GDPR Art. 7(3) requires.

If you declined, there is nothing to delete: Zaraz never ran and no analytics cookie was ever written. If you accepted earlier and have changed your mind, press Cookie settings and choose Decline. It takes effect at once, without a reload: the page stops sending anything to Zaraz and deletes the _zaraz_ entry, and from the next page load Zaraz does not start at all. The Zaraz cookies are HttpOnly, so no page can delete them; they stay until they expire or you clear them, and nothing on this site reads them while your choice is Decline. The page also deletes what the earlier set-up could leave until September 2026: the cookies _ga, _ga_VFPV5MZNL2, _gid and any _gat cookie, and the storage entry _gcl_ls. You can clear cookies and site data for vikataylor.com from your browser settings without asking anyone.

Pressing play on the video may cause YouTube to write storage under its own domain. That is separate from anything listed above, it is not readable by this site, and it is cleared the same way: through your browser's site data controls, for youtube-nocookie.com.

4. Third parties

• Cloudflare, Inc. (USA): hosting for this origin, processing the request data described in section 2a. cloudflare.com/privacypolicy
• Cloudflare Zaraz (Cloudflare, Inc.) and Google Analytics 4 (Google LLC and Google Ireland Limited): analytics, started only after you accept and run on Cloudflare's servers, with the advertising signals denied. Cloudflare acts as a processor, as it does for the hosting. According to Google, GA4 does not log or store IP addresses. Policies: cloudflare.com/privacypolicy, policies.google.com/privacy.
• YouTube (Google LLC and Google Ireland Limited): the video player, created only if you press play, as described in section 2c. Until then YouTube receives nothing at all. policies.google.com/privacy

That is the whole list. There is no payment provider, no email service, no chat widget, no analytics beyond the one measurement ID above, no advertising network and no CDN outside this origin. Fonts (Plus Jakarta Sans and Inter), the video still and every image are served from this site, so no request for them leaves it. No image is loaded from a YouTube or Google image host at any point, before or after you press play.

Both companies above are based in the United States and data may be processed outside the EU and the UK. The transfer mechanisms they rely on are described in their own policies, linked above.

5. Your rights

If you are in the EU, the UK, or anywhere with comparable law, you have the right to access the data held about you, to have it corrected, to have it deleted, to object to processing, to withdraw consent, to receive a copy in a portable format, and to complain to your local data protection authority.

For analytics, withdrawing consent is the Cookie settings control in section 3, which also describes exactly what happens when you use it. For everything else, email vika.taylor.one@gmail.com: that address is the only channel, there is no form and no portal, and a reply comes within 30 days. Be aware that the analytics data described in section 2b carries no name, no account and no email, so a request about it can usually only be answered in general terms.

6. California residents

No personal information is sold or shared, in the CCPA sense or any other. The right to know what is collected and the right to request deletion are exercised the same way as section 5: the email address above.

7. Children

This site is not directed at children under 16 and does not knowingly collect their data.

8. Changes to this page

Changes are dated at the top. Any change that alters what is collected or who receives it will also invalidate the consent choice stored in your browser, so the banner asks again rather than treating an old click as an answer to a new question. Either way the stored choice expires by itself after 180 days.

This policy is a good-faith description of what this build actually does, written by the site's author after reading its own code. It is not legal advice.