# Privacy Policy — man1k.xyz # Machine-readable format # Human-readable version: https://man1k.xyz/legal/privacy # Last-Updated: 2026-09-30 # Site-Version: v2.2 / build 26.10 / JS v2.1 # Format: plain text, UTF-8 Contact: legal@man1k.xyz Owner: Yaroslav Boruk (MAN1K) Domain: man1k.xyz Language: en Policy-URL: https://man1k.xyz/legal/privacy Related: https://man1k.xyz/.well-known/dnt-policy.txt Related: https://man1k.xyz/.well-known/gpc.json Related: https://man1k.xyz/.well-known/copyright.txt Related: https://man1k.xyz/.well-known/security.txt Related: https://man1k.xyz/.well-known/security-policy.txt Related: https://man1k.xyz/.well-known/ai.txt Related: https://man1k.xyz/legal/cookies Related: https://man1k.xyz/legal/terms Related: https://man1k.xyz/legal/copyright Related: https://man1k.xyz/llms.txt Related: https://man1k.xyz/artist.json # ----------------------------------------------- # SUMMARY # ----------------------------------------------- No-First-Party-Cookies: true No-User-Accounts: true No-Personal-Data-Collected-By-Site: true DNT-Respected: true GPC-Respected: true GDPR-Measures-Implemented: true Analytics-Suppressed-When-DNT-Active: true # ----------------------------------------------- # SIMPLE ANALYTICS # ----------------------------------------------- SimpleAnalytics-Active: true SimpleAnalytics-Method: script (scripts.simpleanalyticscdn.com) SimpleAnalytics-Cookies: none SimpleAnalytics-Fingerprinting: false SimpleAnalytics-PersonalData: false SimpleAnalytics-DNT-Respected: true SimpleAnalytics-GPC-Respected: true SimpleAnalytics-GDPR-Consent-Required: false SimpleAnalytics-Pages: all pages # ----------------------------------------------- # ANALYTICS # ----------------------------------------------- Analytics-Provider: Google Analytics 4 Analytics-Measurement-ID: G-5M1G8HHZW4 Analytics-Processor: Google Ireland Limited Analytics-Config-Anonymize-IP: true Analytics-Config-Ad-Personalization: true Analytics-Config-Google-Signals: true Analytics-Config-Restricted-Data-Processing: false Analytics-Config-Cookie-Flags: SameSite=Lax;Secure Analytics-Config-Cookie-Expires: 15552000 Analytics-DataSharing-Google-Products: enabled (aggregated, de-identified) Analytics-DataSharing-Modeling-Insights: enabled (aggregated, de-identified) Analytics-DataSharing-Technical-Support: enabled Analytics-DataSharing-Recommendations: enabled Analytics-Active-When: DNT not set AND GPC not set AND not localhost Analytics-Suppressed-When: navigator.doNotTrack === "1" OR navigator.globalPrivacyControl === true OR localhost/127.0.0.1/*.local Analytics-Opt-Out: https://tools.google.com/dlpage/gaoptout # Custom GA4 Events (tracked when analytics is active) GA4-Event: page_view — on every page load (page_location, page_title) GA4-Event: scroll_depth — when user scrolls past 25/50/75/90% of page GA4-Event: time_on_page — at 30s, 60s, 120s, 300s milestones GA4-Event: outbound_click — any click on an external link (domain, link_text, page) GA4-Event: platform_click — click on Spotify/Bandcamp/SoundCloud/YouTube/Instagram/TikTok/Bandsintown GA4-Event: email_click — click on a mailto: link (link_text, page) GA4-Event: file_download — download of PDF or other file (file_name, page) GA4-Event: content_copy — text copy event on any page (page) GA4-Event: visitor_context — once per session (visitor_type, user_language, screen_category, timezone) GA4-Event: newsletter_submit — newsletter form submitted (/subscribe) GA4-Event: newsletter_form_focus — email field focused (/subscribe) GA4-Event: event_rsvp_click — Bandsintown RSVP/ticket button clicked (/lives) GA4-Event: contact_page_view — /contact page viewed GA4-Event: faq_expand — FAQ item expanded (question text, /press and /press/faq) GA4-Event: web_vitals — LCP metric (value in ms) GA4-Event: js_error — JavaScript error (message, source, line, col) GA4-User-Property: site_version — current JS version (e.g. "2.1") # ----------------------------------------------- # TIKTOK PIXEL # ----------------------------------------------- TikTok-Pixel-ID: D7958NBC77U5V754BC6G TikTok-Provider: TikTok Technology Limited TikTok-Status: installed, not currently used TikTok-Suppressed-When: navigator.doNotTrack === "1" OR navigator.globalPrivacyControl === true OR localhost/127.0.0.1/*.local TikTok-Privacy-Policy: https://www.tiktok.com/legal/privacy-policy # ----------------------------------------------- # LOCAL STORAGE & INDEXEDDB # ----------------------------------------------- Browser-Storage: non-personal technical values only — visit counter (homepage), rate-limiter state (all pages), game high score (/game/, IndexedDB with localStorage fallback) Browser-Storage-Transmitted: false Browser-Storage-Details: https://man1k.xyz/legal/cookies # ----------------------------------------------- # PRECONNECT & DNS-PREFETCH # ----------------------------------------------- # global.js automatically injects the following resource hints on all pages: Preconnect: fonts.cdnfonts.com (all pages, crossorigin) Preconnect: cdnjs.cloudflare.com (all pages, crossorigin) DNS-Prefetch: soundcloud.com (pages with SoundCloud embed) DNS-Prefetch: bandsintown.com (/lives) # These hints inform the browser to resolve DNS early; no data is transmitted # to these domains unless the user navigates to a page that embeds their content. # ----------------------------------------------- # THIRD-PARTY SERVICES # ----------------------------------------------- # Bandsintown Service: Bandsintown Page: /lives Purpose: Live events widget Loading: Async script (loads immediately on page load) Privacy-Policy: https://corp.bandsintown.com/privacy # YouTube (youtube-nocookie.com) Service: YouTube Page: / (homepage) Purpose: Promo video embed Loading: Iframe (youtube-nocookie.com, privacy-enhanced mode), loads on page load, lazy-loaded until scrolled into view Note: On other pages (e.g. /music), YouTube appears as an external link only — no iframe is loaded Privacy-Policy: https://policies.google.com/privacy # SoundCloud Service: SoundCloud Page: /game/ Purpose: Background music for mini-game Loading-game: Iframe loaded with auto_play=false; playback starts only on explicit PLAY action Privacy-Policy: https://soundcloud.com/pages/privacy # Cloudflare R2 (pics.man1k.xyz) Service: Cloudflare R2 Page: /gallery /about Purpose: Artist photo hosting via Cloudflare R2 object storage Loading: First images eager, rest lazy-loaded via browser native lazy loading Privacy-Policy: https://www.cloudflare.com/privacypolicy/ # Buttondown Service: Buttondown Page: /subscribe Purpose: Email newsletter subscription Loading: No iframe — HTTP POST on explicit form submit only Data-Collected: Email address (on opt-in only) Additional-Sources: Third-party ticket/merch platforms where you opted in to email updates at purchase; manual addition by the data controller when you personally agreed (e.g. at concerts, promo campaigns, personal conversation) Data-Collected-Ongoing: Internal subscriber ID, open/click engagement per email, email domain, open rate, click rate, subscription status, occasional internal notes Unsubscribe: Via link in each newsletter email, or by direct request at legal@man1k.xyz Data-Processing-Agreement: https://buttondown.com/legal/data-processing-agreement # AlphaSMS (Interconnect Solutions Pte. Ltd.) Service: AlphaSMS (alphasms.net) Page: Not embedded on site — off-site SMS delivery platform Purpose: SMS updates (releases, live shows, merchandise) sent to a phone contact database Data-Collected: Phone number, country, name, city, source (how contact was acquired) Data-Collected-Per-Campaign: Recipient country and mobile operator (aggregate), click rate on links, campaign start/end time, Mailing ID Compiled-By: Yaroslav Boruk (MAN1K), from multiple sources over time (not a single opt-in form) Account-Contract-No: 118134 Verification: HLR (Home Location Register) lookup before sending, to check number is active/reachable Unsubscribe: Block the sender ID on your phone, or request removal at legal@man1k.xyz Privacy-Policy: https://alphasms.net/legal/privacy/ # Bandcamp (mailing list export) Service: Bandcamp Page: Off-site — follow/mailing-list feature Purpose: Email addresses collected via Bandcamp may be periodically exported into the Buttondown newsletter list Privacy-Policy: https://bandcamp.com/privacy # ReverbNation (mailing list export) Service: ReverbNation Page: Off-site — fan mailing-list feature Purpose: Email addresses collected via ReverbNation may be periodically exported into the Buttondown newsletter list Privacy-Policy: https://www.reverbnation.com/privacy # Cloud AI / LLM tools Service: Cloud-based AI/LLM providers Page: Not embedded on site Purpose: Campaign optimisation (segmentation, timing, content) — may process email addresses, phone numbers and related campaign data as processors # Font Awesome (cdnjs.cloudflare.com) Service: Font Awesome via Cloudflare CDN (cdnjs.cloudflare.com) Page: / (homepage) /music Purpose: Icon font (social and platform icons) Loading: Stylesheet loaded on page load Privacy-Policy: https://www.cloudflare.com/privacypolicy/ # Cloudflare Pages Service: Cloudflare Pages Page: all Purpose: Static site hosting and CDN — all site files are served from Cloudflare Pages infrastructure Privacy-Policy: https://www.cloudflare.com/privacypolicy/ # Simple Analytics Service: Simple Analytics Page: all pages Purpose: Privacy-first, cookie-free analytics — no cookies, no fingerprinting, no personal data collection. Respects DNT and GPC signals. Status: Active Privacy-Policy: https://simpleanalytics.com/privacy # CDN Fonts Service: cdnfonts.com Page: all Purpose: VCR OSD Mono typeface Loading: preconnect on page load Privacy-Policy: https://cdnfonts.com # Google Fonts Service: Google Fonts Page: /game/ Purpose: DotGothic16 typeface (game UI only) Privacy-Policy: https://policies.google.com/privacy # ----------------------------------------------- # GDPR # ----------------------------------------------- GDPR-Status: Partial GDPR-Status-Note: Data minimisation, DNT/GPC opt-out, and no sale of data are implemented sitewide; analytics rely on DNT/GPC opt-out rather than prior opt-in consent GDPR-Regulation: EU 2016/679 Applies-To: EU and EEA residents Definitions: https://man1k.xyz/legal/terms#definitions Data-Controller: Yaroslav Boruk (MAN1K) — legal@man1k.xyz Data-Processors: Buttondown LLC (newsletter), Interconnect Solutions Pte. Ltd. / AlphaSMS (SMS delivery), cloud AI/LLM providers (campaign optimisation), Google Ireland Limited (analytics), Simple Analytics BV (analytics), Cloudflare Inc. (CDN/hosting), nic.ua (domain registrar) Data-Sold-Or-Rented: false Contact-Data-Sources: /subscribe form; exports from Fourthwall (shop.man1k.xyz), Bandcamp, ReverbNation and ticket platforms where the user opted in; direct personal consent (concerts, promo campaigns, personal conversation) Third-Party-Data-Accuracy: Data from third-party platforms is used as supplied and not verified — see https://man1k.xyz/legal/terms (Section 04) Cross-Channel-Combination: Email, SMS and other channel data may be combined for internal analytics, deduplication and segmentation AI-Processing: Email addresses and phone numbers may be processed by cloud AI/LLM tools for campaign optimisation Local-Backups: Email and SMS contact data are additionally kept in a secured local backup by the data controller, for GDPR request fulfilment and processor migration Data-Retention: As long as reasonably necessary for the stated purposes; third-party retention per their own policies Processor-Change-Notice: none — changes are published on https://man1k.xyz/legal/privacy; details provided on individual GDPR request Legal-Basis-Analytics: Legitimate interest (with DNT/GPC opt-out) Legal-Basis-Newsletter-SMS: Consent (opt-in via /subscribe, third-party platform opt-in, or direct personal consent) Legal-Basis-Campaign-Optimisation: Legitimate interest Your-Rights: access, rectification, erasure, restriction, portability, objection, withdrawal of consent (Articles 15–22 GDPR) Rights-Contact: legal@man1k.xyz # ----------------------------------------------- # DNT / GPC IMPLEMENTATION # ----------------------------------------------- DNT-Header-Respected: true GPC-Signal-Respected: true Implementation-File: /global.js DNT-Check: navigator.doNotTrack === "1" GPC-Check: navigator.globalPrivacyControl === true Effect-When-Active: GTM not loaded; no dataLayer; no cookies; no page_view events; no network requests to googletagmanager.com or analytics.tiktok.com; TikTok Pixel not initialised # ----------------------------------------------- # /game/ DISCLOSURE (VOID SIGNAL) # ----------------------------------------------- Game-Page: /game/ Game-Title: VOID SIGNAL — VHS Arcade SoundCloud-Loading: Iframe loaded with auto_play=false; playback controlled programmatically via SC Widget API; music starts only on explicit PLAY action WebAudio-API: Used for procedural sound effects (oscillator-based SFX: shoot, hit, die, boss, combo, dash, shield, etc.) — no audio files loaded IndexedDB-Database: vxd (version 1) IndexedDB-Store: s (keyPath: id) IndexedDB-Data: Single record {id: "b", v: best_score} — stores highest game score. Fallback: localStorage key "vxb" IndexedDB-Personal-Data: false Vibration-API: Used on mobile touch controls for brief haptic feedback (5ms pulse on button press) VisualViewport-API: Used to resize game container to match visual viewport height on mobile Game-Canvas: Full-screen Canvas 2D rendering with VHS post-processing overlays # ----------------------------------------------- # ERROR TRACKING # ----------------------------------------------- Error-Tracking: window.onerror + unhandledrejection Data-Collected: error message (max 200 chars), filename, line, col, page path, JS version, timestamp, stack trace (max 500 chars) Transmitted-To: Google Analytics 4 (same GA4 instance, only when active) Transmitted-When: DNT not set AND GPC not set # ----------------------------------------------- # REFERRER POLICY # ----------------------------------------------- Referrer-Policy: strict-origin-when-cross-origin Effect: Full URL sent same-origin only; cross-origin receives https://man1k.xyz only; no referrer on HTTPS-to-HTTP downgrade # ----------------------------------------------- # RATE LIMITING # ----------------------------------------------- Rate-Limit-Soft: 300 events per 60-second window (warning threshold) Rate-Limit-Hard: 600 events per 60-second window (interaction blocked) Monitored-Events: click, keydown Rate-State-Storage: localStorage (keys mk_r and mk_b) Rate-Data-Transmitted: false # ----------------------------------------------- # CONTACT # ----------------------------------------------- Contact: legal@man1k.xyz Subject-Prefix: Privacy — man1k.xyz Response-Time: best effort --- © 2026 Yaroslav Boruk (MAN1K). This policy document is provided for informational and legal compliance purposes.