Privacy Policy

2. Who operates Slowbit?

Slowbit is operated by Souhail EL MAHDANI, an individual based in Morocco.

Privacy questions and requests can be sent to elmahdanisouhail@gmail.com.

3. Information Slowbit processes

Slowbit can process browser preferences, optional product analytics, public board messages, and ordinary technical request data needed to deliver and secure the service. Slowbit does not require an account.

Pseudonymous identifiers and technical request metadata can still be personal information under applicable law, even when they do not contain a visitor's name.

Slowbit does not contain advertising, sell personal information, or embed YouTube, Spotify, SoundCloud, external radio players, feedback widgets, third-party iframes, or hosted web fonts.

Where a legal basis is required, Slowbit relies on explicit consent for optional analytics. Local preferences and technical request handling are used to provide the functionality you request, operate the service, and protect it. The appropriate basis can vary by jurisdiction and by the specific processing involved.

4. Browser storage and local preferences

Slowbit uses browser storage to remember favorite and hidden scenes, sound and volume settings, onboarding state, optional analytics consent, and other application preferences. Temporary session state may also be kept in session storage until the tab is closed.

These settings are not uploaded to a Slowbit account. You can remove them through your browser's site-data controls, though doing so will reset your saved Slowbit preferences.

5. Optional PostHog analytics

Slowbit uses PostHog Cloud EU only after you select Allow. Analytics help us understand use of modes, scenes, sessions, playlists, and controls. Events may include a pseudonymous browser identifier and basic browser, device, page, referral, screen, and viewport context automatically attached by the analytics software.

Analytics are disabled by default. Declining does not reduce any Slowbit feature and your choice remains in your browser until you change it or clear site data. You can change or withdraw your choice at any time in Settings.

Slowbit disables PostHog autocapture, session recording, heatmaps, surveys, exception capture, performance capture, dead-click capture, and rage-click capture. Slowbit does not call PostHog's identified profile function and does not send board-message text to PostHog. Where consent is the applicable legal basis, analytics are processed only after that consent.

6. Anonymous public message board

The message board is public. A message can be read by anyone who opens it and may remain visible indefinitely. Do not include personal, confidential, or sensitive information.

The D1 database stores the message text, a random message ID, its creation time, and a submission key derived from a posting token. Posting-token hashes expire after 24 hours; expired token rows are removed opportunistically when new tokens are issued rather than by a guaranteed scheduled job.

Slowbit does not intentionally write IP addresses, names, accounts, cookies, or browser fingerprints to the board database. Cloudflare still receives ordinary network information such as IP addresses and request headers to deliver and protect the board service.

Board messages have no automatic expiry and are retained indefinitely unless manually removed. To request removal, contact the operator with the message text and approximate posting time. Because there are no user accounts, Slowbit may be unable to prove who submitted a message; each request must be assessed using the information available.

7. Hosting and third-party service providers

• Vercel Hobby hosts the website and processes requests to deliver it.
• Cloudflare delivers audio and visual assets from R2 and provides the board's Worker and D1 database.
• PostHog Cloud EU processes optional analytics only after consent.

These providers can process technical request information under their own infrastructure and security practices. GitHub is linked as an ordinary external website; it is not embedded in Slowbit.

8. Data retention

• Browser preferences remain until you clear site data or Slowbit changes or removes the stored setting.
• PostHog's current free-plan event retention is a one-year query window. This is not a guarantee that every underlying record is permanently erased at exactly one year.
• Vercel Hobby runtime logs are currently retained for one hour. Build, deployment, security, and other operational records can follow different retention rules.
• Cloudflare Workers Logs are enabled and currently retained for three days. They can include technical request information, errors, and execution metadata.
• Cloudflare R2 Data Access Logs are disabled.
• Public D1 board messages are retained indefinitely unless manually removed. Posting-token hashes expire after 24 hours and are cleaned up opportunistically.

Providers may keep separate security, billing, abuse-prevention, or legal records according to their own terms and obligations.

9. International data processing and transfers

Slowbit is operated from Morocco and is available worldwide. Vercel, Cloudflare, and PostHog operate infrastructure in multiple countries, so information may be processed outside your country. Their contractual and technical safeguards apply to those transfers where required.

10. Privacy choices and rights

You can use Slowbit without analytics, change analytics consent in Settings, clear locally stored preferences, and request access, correction, restriction, objection, portability, or deletion where the law applicable to your request provides those rights.

You may also have the right to complain to a relevant data-protection authority. Slowbit will assess requests according to the law that applies and the information it can reasonably connect to the request.

11. Historical data-deletion requests

Withdrawing analytics consent stops future optional collection and clears local PostHog identifiers where supported. It does not itself delete analytics events previously received by PostHog.

If an existing analytics browser ID is available, Settings lets you copy it before withdrawing. You can email that ID with a deletion request. A browser ID is pseudonymous and is not conclusive proof of identity or ownership, so Slowbit may need to validate the request before asking PostHog to delete matching events.

12. Security

Slowbit uses established infrastructure providers and applies reasonable technical and organizational measures for this public beta. No website or internet transmission can be guaranteed completely secure.

13. Children's privacy

Slowbit is a general-audience service and is not directed to children. It does not knowingly request names, accounts, or other direct contact information from children. If you believe a child has submitted personal information on the public board, contact the operator.

14. Changes to this policy

This policy may change as Slowbit evolves. The date at the top will be updated when the policy changes materially. Where appropriate, Slowbit may also present an in-product notice.

15. Contact

Questions and privacy or deletion requests can be sent to elmahdanisouhail@gmail.com.

Website: slowbit.vercel.app