Privacy

What we count

The episodes count how far readers get: how many reached each moment, how long they stayed there, whether the sound was on, and whether they tapped or scrolled. They also count the end of an episode reached, the offer seen, the unlock button tapped, a payment and a purchase restored, and the follow link tapped.

These are sums only. There is no cookie and no ID, and no network address is kept. If you arrived by one of our ads, the ad's name, from the link you followed, is added to the same sums, so that we can tell which ads bring readers. Previews of the site are not counted.

One exception. If you arrived by one of our ads, and only where Meta's pixel may run (see below), we also keep the path of that visit, so that we can see how the episodes are read and make them better: which moments you reached and when, in order, how you moved on from each (a tap, a swipe, or the episode playing by itself) and how much of its video had played, what you chose and started on the menu, whether the sound was on, whether you tapped or scrolled, a game's score, whether you saw the offer, tapped to unlock or paid, and when you left or came back; with the ad's name, whether the screen was upright, the app the page was opened in (for example Facebook or Instagram), the kind of phone (for example iPhone or Samsung), and the country, region, city and time zone our host places your connection in (never the network address itself or a precise position). It is tied to a random code made by your browser tab and forgotten when the tab closes. There is no cookie, no name and no network address in it, and we keep it for 30 days. Global Privacy Control turns it off.

And to know how many different people read us each day, week and month, where Meta's pixel may run your browser keeps a random code for this site and sends it once with each episode you open. It is added to that day's count in a way that cannot give the code back, and the counts are kept for 40 days. There is no cookie, no name and no network address in it. Global Privacy Control turns it off.

What your browser keeps

A few things are kept in your own browser, in its storage for this site, so that it remembers you on this device:

• which episodes you opened and finished, so that the menu can show where you are.
• your pass, if you paid or restored a purchase.
• the name of the ad you came by, for 30 days, so that the next episodes count you under it; only where Meta's pixel may run (see below).
• which of two ways the series is offered to you, chosen once, so that it stays the same; it is counted with the sums and goes with a payment, so that we can tell which way works better.
• the nickname you last put on a game's board, so that your next scores go on the board under it.
• if you came by one of our ads, a random code for your visit, kept only while the tab is open (see "What we count").
• only where Meta's pixel may run, a random code for this browser, so that it is counted once a day among our readers (see "What we count").
• if you are a member, the key that keeps you signed in on this device (see "Your membership").

Clearing this site's data in your browser removes all of it.

Meta's pixel

We use Meta's pixel to measure our ads on Facebook and Instagram, and to show them to people likely to enjoy the series. Where it runs, it loads a script from Meta and tells Meta when you open the menu or an episode, start an episode, reach its end, see the offer, tap to unlock and pay (the price, never your card). Meta sets its own cookie and may connect these events to your Meta account. It uses them under its own privacy policy.

It never runs:

• for visitors in the United Kingdom, the European Union, the European Economic Area (Iceland, Liechtenstein, Norway) or Switzerland;
• when we cannot tell which country you are in. The country comes from your network address, which our host reads with each request; we do not keep it;
• if your browser sends Global Privacy Control;
• on previews and test copies of the site.

How to say no

• Turn on Global Privacy Control in your browser (Brave and DuckDuckGo send it already; in Firefox it is a privacy setting). The pixel will then not load here.
• Block cookies and trackers for this site in your browser's settings, or clear its data.
• Choose how Meta uses your activity for ads in your Meta ad preferences.
• Or write to us at stan@expansion.sh.

Paying

Payment is taken by Stripe, with Apple Pay, Google Pay or a card, either in Stripe's own payment fields shown on this page or on Stripe's checkout page. Stripe receives your payment details and your email address; we never see your card. Stripe emails you a receipt, with a link that opens the series in any browser. Stripe tells us that the payment went through, and our Stripe account keeps a record of it (the amount, your email address, and what Stripe keeps about the card, such as its country and last four digits). If you came by one of our ads, the checkout also carries the ad's name, and which way the series was offered to you, so that we can see which ads lead to payments. Stripe's privacy policy.

Restoring a purchase

If you type your email address under "Already paid? Restore", we ask Stripe whether that address paid for the series, and if it did, the series opens in your browser. The address is used for that one question and is not kept. To stop guessing, we count tries from each email address and each network address for a few minutes, in memory. Because no password is asked, anyone who knows the email address you paid with could open the series in their own browser this way.

Following us

The "Follow" link at the end of the first episode opens our page at instagram.com/sprayshows. What happens there is under that site's own policy.

The list at the door

Memberships are closed. If you leave your email address at the door, we keep it, with the time you asked, the name of the ad you came by if you came by one, and the country our host places your connection in (never the network address itself). Your place on the list is the order in which people asked. If you leave your email in our form inside Facebook or Instagram instead, Meta hands it to us with the name of the ad, and we keep it the same way. We use the address only to write to you if a place opens (for example a free pack, with a link that opens your membership), and we do not give it to anyone; those emails carry a link to stop them. To stop abuse we count, for ten minutes and in memory only, how often a connection asks, under a short code that cannot be turned back into its address.

To be taken off the list, write to us at stan@expansion.sh from that address.

Your membership

A membership is an email address. When you keep your cards with it (at the end of an episode, with a 6-digit code we email you, or with a link we emailed you), we keep that address with your member number, the time you joined, the name of the ad or email you came by, and the country our host places your connection in (never the network address itself); the cards you hold, the cards you gave and who took them; and the days you took the free pack of the day. The free pack's page counts, as the episodes do, whether a pack was opened, torn and its cards seen.

We write to that address about SPRAY only: your code, news of a card you gave, a free pack, a new episode. The emails we send to many members at once carry a link to stop them; we keep which of these emails went to which address and when, so that nobody gets the same one twice, and, if you stop them, that you did. A link in these emails opens your membership on any device for 14 days without a code, so do not pass it on. The emails go out through Resend (its privacy policy). We do not give your address to anyone else.

To have your membership deleted, write to us at stan@expansion.sh from its address.

Game boards

Some episodes have a game played against the clock, with a board of the best scores. As the game begins, your browser asks our site for a one-time code for that game; it is kept for fifteen minutes and deleted when it is used. If you put a nickname on the board, we keep that nickname with your best score, on a board for all time and on one for the week, which is deleted two weeks later, and we show them to everyone who plays that game. Nothing else is kept with them: no account, no email, no network address. To stop abuse we count, for ten minutes and in memory only, how often a network address asks. The first names on each board are characters from the story, marked "Cast": they are not players.

To have a nickname taken off a board, write to us at stan@expansion.sh with the nickname and the episode. Clearing this site's data in your browser makes it forget the nickname, not the board.

Hosting

The site is hosted by Vercel, which receives every request, with your network address, in order to deliver the pages. The lettering comes from Google Fonts, so your browser also asks Google's servers for it, and some 3D parts load a library from jsDelivr.