Privacy

haruspex is a zero-input art piece: an oracle that watches a place and confabulates meaning from it. It also, by design, reads its watchers — but narrowly, and it never sells, shares, or shows back what it gathers. This page says plainly what is collected, from whom, and how to opt out.

Collected from everyone

• Dwell (how long you watch) — a random, per-visit token and a count of your focused seconds are sent to our own server so the oracle's gaze can drift toward the longest-present watcher. It is kept only in memory, never written to your device, never linked to you, and discarded shortly after you leave. No cookie, no storage, no identity.
• Aggregate web analytics — Cloudflare Web Analytics, which is cookieless, does not fingerprint, does not track you across sites or sessions, and stores no personal data.

Collected only from some visitors

The following apply only if you are not in the EU, EEA, UK, or Switzerland, and you have not sent a Global Privacy Control signal. If either is true, none of this happens — you get only the two consent-free items above, and nothing is stored on your device.

• Returning-visitor recognition — a coarse device signature (your network widened to a /24, plus your browser's User-Agent and language, hashed together) lets the oracle notice when the same watcher returns across visits. Your raw IP address is never stored — only the hash. The record is forgotten after about 90 days of absence.
• Product analytics (PostHog) — page views, the moment you unmute, and how far into the gaze you get. Cookieless (browser local storage only), no session recording, no autocapture of your clicks or inputs. Routed through our own domain, so no third-party host sees your address.

Never done

No selling or sharing of personal information. No advertising. No cross-site tracking. No session recording. No canvas/WebGL or other aggressive fingerprinting. No collection of anything you type (you cannot type anything — the piece takes no input).

Your choices

• Global Privacy Control — if your browser sends GPC, you are never fingerprinted and never sent to PostHog, wherever you are. Enabling GPC is the one-switch opt-out.
• EU / EEA / UK / Switzerland — you are excluded from fingerprinting and PostHog automatically, by location, with no action needed. That is why you are not asked to click a consent banner.
• California (CCPA/CPRA) — we do not sell or share your personal information. You may request to know or delete what little is held; we honor GPC as a valid opt-out signal.

Questions, or a request to know or delete: justin@justinstimatze.com. This notice reflects the current build and may change as the piece does.