Privacy

This site is not the software

This page is about badlen.fr: the front page and the documentation under /docs/. It is not about Badlen, the software.

Badlen runs on your machine, in your containers, against your database. An installed instance contacts no server of this project’s, sends no measurement anywhere, and there is no access through which this project could read what it holds. Your accounts, your amounts and your history have never passed through this site and will not. There is no public instance of Badlen to visit either: the demonstration account the documentation describes is one your own instance carries.

Who runs this site

badlen.fr is published by the Badlen project, which also maintains the software. The pages are served by Cloudflare on a free plan, and the audience measurement runs on a server the project runs itself. There is no company behind it, no subcontractor, and none of it is handed to a third party.

The project answers for these pages, and its repository is how to reach it.

The project on GitHub →

What is measured of a visit

Every page loads one measurement script, stats.js, served by umami.metalhearf.fr. Each time a page opens it sends a single line, and that line holds this and nothing more: the site’s identifier, the page address, its title, the hostname, the page you came from, the language your browser is set to, and the size of your screen.

That server is one the project runs itself, not a service this site sends its traffic to. It runs Umami, an open-source audience counter whose code is public. Those lines reach no provider, are sold to nobody and are crossed with nothing, because there is no ad network at the other end of them.

The script stores nothing in your browser and sends no identifier of your own, so nothing it sends can recognise you from one visit to the next or follow you to another site. It builds a page counter. Like every server that receives a request, that one sees the IP address the request comes from.

If you would rather not be counted, any content blocker stops the script and the site loses nothing without it. You can also set the key umami.disabled to 1 in this site’s local storage, which the script reads before sending anything.

What Cloudflare sees, and what it adds

Cloudflare serves these pages and shields them from hostile traffic. Answering a request means receiving it, so Cloudflare necessarily sees your IP address, the address you asked for, which browser asked and which country it asked from. No site chooses that: it is what being hosted anywhere means, and a site that promises otherwise is promising something it does not control.

Two things are added to every page without passing through this repository’s code. Both are in the source of any page served here.

Cloudflare injects a bot-detection script into an invisible one-pixel frame on every page it serves. The script questions the browser and leaves the cf_clearance cookie behind. This site did not ask for that script, and the free plan has no switch that turns it off.

Cloudflare also adds prefetching rules, so that the next page arrives faster. Your browser may therefore fetch a page you have not opened.

What a visit leaves in your browser

Five things, and these are all of them.

cf_clearanceOne year

Cookie. Cloudflare’s bot detection puts it there; nothing on this site asks for it.

badlen-vitrine-themeUntil you clear this site’s data

Local storage. Light or dark, for the whole site. Nothing is written until you touch the switch.

starlight-themeUntil you clear this site’s data

Local storage. The same choice again, under the name the documentation’s engine looks for. It is written as soon as you open a documentation page.

sl-sidebar-stateUntil the tab closes

Session storage. Which parts of the documentation menu you folded away.

starlight-synced-tabs__…Until you clear this site’s data

Local storage. Which tab you picked in a tabbed block that remembers your choice.

There is no sixth: no advertising cookie, no tracking pixel, no social button. The typefaces are served from badlen.fr rather than fetched from a font service. And the search box in the documentation sends nothing anywhere. It downloads pieces of an index from this site and searches them inside your browser, so no server ever receives the words you type into it.

Why there is no consent banner

A banner is owed when a site stores or reads something it does not need in order to deliver what you asked for, typically to follow you around or to show you advertising. Nothing here falls under that. The cookie is placed by the host to tell a reader from a robot, the four other keys carry nothing but a display setting (a theme, a folded menu, a chosen tab), and the audience measurement stores nothing at all. A banner asking for “I accept” would be a rite with no object.

How long any of it is kept

Cloudflare’s cookie expires a year after it is placed. You can clear it with this site’s data at any time, and it will be placed again on your next visit. The four settings last until you clear that same data, except the menu state, which goes when the tab closes.

The measurement lines do not expire on their own. The tool purges nothing, so they stay in its database until they are deleted by hand. No retention period is written here, because nothing would enforce one.

Your rights, and what they amount to here

European law gives you a right of access, correction, erasure and objection, and they hold here as everywhere. Exercising a right of access means someone being able to find your data, and there is nothing in these counters that designates you: no account, no identifier, no name, nothing you could be asked to prove you are. A request would find nothing to show you, because there is nothing to find.

If you think otherwise, or want to ask all the same, the channel is the project’s repository. It is public, and it is the only channel this project has.

Ask on GitHub →

What this site does not do

• No account and no sign-in. There is nothing to create here.
• No form. Not one page asks for your name, your address or anything else.
• No newsletter, so no list to be on.
• No advertising, no ad network, no advertiser’s pixel.
• Nothing is sold, rented or shared. There is no buyer, because there is no merchandise.