Privacy Policy
Summary
- No analytics, no advertising trackers, no tracking pixels, no fingerprinting.
- We do not sell or share your personal information, and we honor Global Privacy Control.
- We only have your email address if you type it into a form. Logging in with your shop account gives us your first name; we do not keep your email address in readable form.
- Games and finds save in your own browser unless you log in.
- If you send Elizabeth your contact details on possum.ing/hi, only she can see them, and they are deleted after a year or when you ask.
- Shopify runs the shop checkout and payments. We never see your full card number.
- To get a copy of your data or have it deleted, email hello@possum.ing.
1. Who we are
PosSum is a small art and fashion brand. The site possum.ing is run by [LEGAL ENTITY NAME], [MAILING ADDRESS], United States ("PosSum", "we", "us"). For data protection law, we are the controller of the personal information described here, except where we say another company is in charge of its own data (Shopify at checkout, for example).
Questions or requests: hello@possum.ing.
2. What we collect and why
Each part of the site is listed below with what it collects, why, and the legal basis we rely on for visitors in the European Economic Area (EEA) and the United Kingdom. "Legitimate interests" means a reason a reasonable visitor would expect, weighed against your rights.
2.1 Every visit
The site runs on Cloudflare. To deliver any page, Cloudflare's network receives the information every web request carries: your IP address, browser and device type (user agent), the page you asked for, the referring page, and a rough location that Cloudflare works out from your IP address (country and city). Cloudflare keeps some of this in its own operational and security logs under its privacy policy.
Our own code does not log requests and does not run analytics. We have not switched on Cloudflare's optional request logging or web analytics for this site. If we ever do, we will update this policy first.
Legal basis: legitimate interests (showing you the site and keeping it running).
2.2 Abuse prevention (rate limits)
When you submit a form (mailing list, member password, or a Parlor line), start a login, or change your shop bag, our server turns your IP address into a one-way code (a SHA-256 hash, shortened) and keeps a short counter under that code. This stops one machine from flooding a form. We never store the raw IP address. The counters expire on their own:
- member password attempts: 15 minutes (8 tries)
- mailing list signups: 1 hour (4 signups)
- Parlor lines: 1 minute and 24 hours
- logins: 15 minutes (30 tries) accounts
- bag changes: 10 minutes (120 changes) shop
- "send me yours" cards: 10 minutes (4 cards) and 24 hours (12 cards)
- the card owner's password: 15 minutes (8 tries)
Saving game progress to an account is limited too (240 saves an hour). That counter is filed under the start of your account id (see 2.10), not your IP address, and expires after an hour.
A hash like this still counts as personal data under GDPR, because someone who already knows an IP address could recompute it. We treat it that way.
Legal basis: legitimate interests (keeping the site usable and safe).
2.3 Mailing list
The call box in the treehouse, the pocket knife stuck in the treehouse trunk, the ADE postcard on the treehouse deck, the "Be Counted" form on the fund page, and the "notify me" form on items in the vending machine let you leave an email address. We store:
- your email address
- which list you joined (for example "town", "fund", "shop", "tree" for the pocket knife or "ade" for the postcard)
- the date and time you signed up
We use it only to send occasional letters about PosSum: new work, drops, and the things the form said we would send. We do not share or sell the list. The record is stored in Cloudflare's key-value database (Workers KV), filed under a hash of the address. The address itself is stored readable so that we can write to you.
When we start sending, we will use an email delivery service ([EMAIL PROVIDER]), which will handle your address on our behalf. Every email will have an unsubscribe link. You can also unsubscribe by emailing us. Joining the list does not create an account and is not required to buy anything.
Free downloads. When you download the free papercraft mask from the vending machine, we add one to a running count, and to a count for that day, so we know how many people took one. To tell repeat clicks from new people, we keep a one-way hash of your IP address mixed with the date for two days, then it expires on its own. We never store the IP address itself, and the count is not linked to an account, an email address or anything else about you.
Carvings on the tree. When you join from the pocket knife or the postcard, the possum carves your initial into the back of the tree: the first character of your email address (a letter or a digit; anything else becomes a star) and the two-digit year, for example "E '26". The carving is stored as its own record that holds only that letter and year. It is shown publicly to everyone who visits the treehouse, among everyone else's. Your email address is never shown and is not part of the carving. So that each address is carved only once, we also keep a one-way hash of the address that points to the carving. That is how we can find and remove your carving if you ask. Unsubscribing does not remove the carving by itself; ask us and we will sand it off. Your browser also remembers your letter and year (see section 4) so the knife knows you already carved.
Every one of these forms contains a hidden field that people cannot see. If a bot fills it in, we discard the submission.
Legal basis: consent. You can withdraw it at any time.
2.4 Member branches and the password gate
Some branches of the tree are for members with a shared password. When you enter the right password, we set a cookie called pg that tells our server you are allowed in. It contains an expiry time and a signature. It contains nothing about you and we do not record who has entered. Wrong guesses are counted against the hashed IP code described in 2.2.
Three member branches (health, music, and manufacturing) show separate PosSum apps inside a frame. They load from their own addresses: helf-jornie.pages.dev, possum-sketch.pseudonomaus.workers.dev and possum-os.pseudonomaus.workers.dev. Those addresses are also hosted on Cloudflare, so Cloudflare receives the request information described in 2.1. The frame lets those apps ask for your microphone, camera or MIDI devices. Your browser asks you first, and you can say no. What each app stores is described inside that app [CONFIRM OR DESCRIBE EACH MEMBER APP'S DATA HANDLING BEFORE THE BRANCHES OPEN].
Legal basis: legitimate interests (giving members the access they asked for).
2.5 Clock and weather in the call box
The call box shows the time and weather for a city you pick: New York, London or Amsterdam. Our server asks Open-Meteo for that city's weather and air quality. Only the city's coordinates are sent, from our server. Your browser does not contact Open-Meteo and Open-Meteo does not receive your IP address.
If a weather request arrives without a city, our server falls back to the approximate location Cloudflare derives from your IP address, rounded to about 11 km (0.1 degree), and asks Open-Meteo about that point. Results are cached for 30 minutes under the rounded coordinates and are not linked to you. Your city choice is remembered in your browser (see section 4).
Legal basis: legitimate interests (showing the feature you opened).
2.6 The Arcade
The quiz cabinets ask our server for questions. Each request includes the ids of questions you have already seen in this session and a difficulty number, so we can pick new ones at your level. We use these to answer the request and do not store them. Your answers and score stay in the open browser tab and disappear when you close it.
Wreck Deck, the fingerboard game, saves your best score and completed goals in your browser. Nothing from Wreck Deck is sent to us.
Legal basis: legitimate interests (running the game you opened).
2.7 The Parlor
The Parlor is a collaborative writing game in which each person adds one line to a page that stays hidden until it fills up. It is not linked from the site right now. If you contribute a line, we store the line, the name you typed (optional), the small drawing you made (optional), and the time. Once a page fills, it is sealed and shown publicly, credited to your typed name or to "anonymous hand". To keep it to one line per person per page, we keep the hashed IP code from 2.2 for 7 days.
Sealed pages are kept as part of the work. Ask us and we will remove your line's text (we replace it with "[folded out by the house]").
Legal basis: consent (you chose to submit a line for public display).
2.8 Game progress and discoveries
Velocity (the space game in the saucer), Wreck Deck, and the treehouse save progress in your own browser using local storage. Items you find while flying are saved the same way, under possum_discoveries, and show up in the treehouse vending machine. This data stays on your device. We cannot see it, and clearing your browser's site data deletes it.
If you log in with a shop account (2.10), the list of items you have found, and a Velocity save if the game sends one, are also stored on our server so they follow you between devices. Finds are merged: anything found on any of your devices stays found. For the game save, the most recent one wins.
Legal basis: legitimate interests (running the game you opened); for the server copy, contract (the account you asked for).
2.9 The shop applies when the shop is live
PosSum products appear inside the games and in the treehouse vending machine. Shopify is our store platform. Our server asks Shopify for product details and keeps a copy for about five minutes. Product photos load from Shopify's image servers (cdn.shopify.com), so Shopify receives your IP address and browser information when a photo is shown.
When you add something to your bag, change it, or check out, your browser talks only to our server, and our server talks to Shopify. With each of those requests our server passes your IP address to Shopify, because Shopify requires it to tell real shoppers from automated traffic. We do not store it. Shopify gives the bag an id; we keep that id in a cookie, __Host-pcart, signed so it cannot be swapped, and do not store your bag on our server. If you are logged in (2.10), the bag is linked to your shop account so checkout can fill in your details.
When you add something to your cart and check out, checkout opens on Shopify's site. Shopify and its payment processors collect what an order needs: name, email, shipping and billing address, phone number if you give one, payment details, and order history. Shopify processes this as our service provider for running the store, and for some purposes (such as fraud prevention and its own payment services) under its own privacy policy. Shopify's checkout sets its own cookies (see section 4).
We receive your order details through Shopify so we can make and ship your order and answer questions about it. The makers and shipping carriers who produce and deliver it receive only what they need: your name, shipping address, the items, and sometimes a phone number or email for delivery updates. We never receive your full card number.
We have not installed advertising pixels or ad-tracking apps on the store. If that ever changes, this policy changes first and we will give you a way to opt out.
Legal basis: contract (filling your order) and legal obligation (keeping tax and accounting records).
2.10 Accounts applies when accounts are live
Accounts are optional. "Log in with your shop account" uses Shopify's customer account login. You sign in on Shopify's page, never on ours, and Shopify tells our server who you are. We receive:
- your Shopify customer id
- your first name
- a signed identity token from Shopify, which contains your customer id and email address
- access and refresh tokens that let our server attach your bag to your shop account
From your Shopify customer id we compute an account id with a secret key (an HMAC). It is not your email address and cannot be turned back into your customer id without our key. In Cloudflare Workers KV we store:
- under that account id: the items you have found, your Velocity save if the game sends one, and the times they were saved
- for each logged-in browser (a session): your first name, the account id, when the session expires, and the Shopify tokens above, encrypted (AES-256-GCM). The identity token inside that encrypted bundle is where your email address sits; we never store it in readable form, and the session and its tokens are deleted when you log out or after 30 days
- a list of your sessions, so they can all be ended at once
We do not store your Shopify customer id or email address in readable form (both appear only inside the encrypted identity token), and we never receive or store your Shopify password. A session cookie keeps you logged in (see section 4); it holds only a random number, and we store a one-way hash of it.
Logging in does not add you to the mailing list. In the account panel (the LOG IN or name button at the top of the treehouse), EXPORT MY DATA downloads everything above as a file, and DELETE MY DATA deletes your saved finds and game save from our server and ends every session. You can also email us. Your Shopify customer account and order history are separate and are managed by the store. Finds saved in your own browser stay there until you clear site data.
Legal basis: contract (providing the account you asked for).
2.11 Elizabeth's contact card (possum.ing/hi) and "send me yours"
possum.ing/hi is the digital business card of Elizabeth, who runs PosSum. You reach it by scanning her QR code, tapping one of her NFC tags, or following a link. Viewing the card and tapping SAVE CONTACT sends us nothing beyond the request information in 2.1. The contact file downloads straight to your phone.
If you fill in "send me yours", we store:
- the name you type
- whichever of these you give: email address, Instagram handle, phone number
- the optional note about where you met
- the date and time, and that it came from the form
Nothing else: no IP address, no device details, no location. The record is stored in Cloudflare Workers KV and only Elizabeth can read it, after signing in on her side of the card. She uses it to get back in touch with you, and may copy it into her own phone's contacts or a spreadsheet. It is not added to the mailing list, and it is never shared or sold. The form has a hidden field that people cannot see; if a bot fills it in, the submission is discarded. Form submissions are rate-limited (see 2.2).
NFC tags. If you hold your own NFC business card or sticker to Elizabeth's phone and she taps TAP THEIR TAG, her phone reads what your tag already broadcasts (typically a link, a contact file or a short text) and saves the name, email, phone, Instagram, link, organization and note it finds to the same list, marked as read from a tag. If her phone has no signal at that moment, the reading waits in her phone's browser storage until it can be saved.
How long. Every entry deletes itself one year after it was saved. Elizabeth can delete an entry sooner, and will if you ask: email possum@posteo.com or hello@possum.ing with the name and the email, handle or number you gave. Copies she has already saved to her own phone's contacts are hers, like any business card someone hands you; ask and she will delete those too.
Legal basis: consent for the form (you tick a box, and you can withdraw it by asking us to delete the entry); legitimate interests for tags you choose to hold to her phone.
2.12 When you email us
If you write to us, we keep the message and your address so we can reply and keep a record of requests. Legal basis: legitimate interests.
2.13 What we do not collect
We do not collect precise location, government ids, health data, biometric data, or any of the other "sensitive" categories defined in privacy laws. We do not build profiles about you, and we make no automated decisions with legal or similarly significant effects.
3. AI-written content
Some quiz questions in the Arcade are written by an AI model. Our server runs gpt-oss-120b (an open-weight model published by OpenAI) on Cloudflare Workers AI. A scheduled job sends the model a list of quiz topics, plus public headlines, short public summaries of news stories and abstracts of new research papers (from techurls.com, the story pages it links to, and arXiv). A second model call answers each question blind, and we keep only the questions where both agree.
No visitor data is sent to the model. Your answers, scores, email address and anything else you type are never part of a prompt. We do not train AI models. Cloudflare states that it does not use Workers AI inputs or outputs to train models. AI-written questions can be wrong. The Arcade marks them as machine-written and treats scores as practice estimates.
If we ever send anything you type to an AI model, we will say so on that feature and in this policy before it goes live.
4. Cookies, browser storage and the app
We use a few cookies and a handful of browser storage entries. Each one exists to make a feature you use work, or to remember a choice you made. None of them track you across other sites, and none are used for analytics or advertising. That is why there is no cookie banner. If we ever add anything optional, we will ask first.
| Name | Type | Purpose | How long |
|---|---|---|---|
pg | Cookie (HttpOnly, Secure, SameSite=Lax) | Remembers that you entered the member password. Holds an expiry time and a signature. | 30 days |
__Host-psess accounts | Cookie (HttpOnly, Secure, SameSite=Lax) | Keeps you logged in to your account. Holds a random session number. | 30 days, or until you log out |
__Host-pauth accounts | Cookie (HttpOnly, Secure, SameSite=Lax) | Only while you are logging in: encrypted one-time values that check the answer from Shopify belongs to the login you started, and the page to return to. | 10 minutes, deleted when the login finishes |
possum_seen2 | Local storage | Skips the opening animation after your first visit. | Until you clear site data |
possum_city | Local storage | Remembers the city you picked for the clock and weather. | Until you clear site data |
possum_velocity_v1 | Local storage | Velocity save game: ship, credits, cargo, missions. | Until you clear site data or start a new game |
possum_velocity_view | Local storage | Whether you last flew Velocity from the top-down view or the cockpit. | Until you clear site data |
possum_velocity_a11y | Local storage | Velocity reading settings you choose: text size, contrast, motion, font. | Until you clear site data |
wd:best, wd:goals | Local storage | Wreck Deck best score and completed goals. | Until you clear site data |
possum_carved | Local storage | The letter and year you carved into the tree (never your email address), so the knife offers to show you the carvings next time. | Until you clear site data |
possum_discoveries | Local storage | The items you have found while flying, shown in the vending machine. Synced to your account if you log in. | Until you clear site data |
__Host-phi | Cookie (HttpOnly, Secure, SameSite=Lax) | Only on Elizabeth's own phone, and only if she sets her own card password: remembers that she signed in to her side of the card. Holds an expiry time and a signature. | 90 days |
possum_hi_pending | Local storage | Only on Elizabeth's own phone: NFC tags she read without signal, waiting to be saved. Emptied as soon as they are saved. | Until the phone has signal again |
possum-shell-*, possum-run-* | Cache storage (service worker) | Copies of the site's pages, scripts, fonts and images so the card and the app open without signal. Never holds anything you typed, form submissions or account data. | Until the next version of the site replaces them, or you clear site data |
__Host-pcart shop | Cookie (HttpOnly, Secure, SameSite=Lax) | Remembers your shop bag between visits. Holds Shopify's id for the bag and a signature. | 14 days, or until you log out |
| Shopify cookies shop | Cookies on Shopify's checkout pages | Cart, checkout, login and fraud prevention, set by Shopify on its own domain. | See Shopify's cookie policy |
To remove them, clear this site's data in your browser settings. The games will start over and the opening animation will play again.
Installing possum.ing as an app. You can add possum.ing to your home screen. That installs no extra software: it is the same website, with a small script (a service worker) that keeps the cache copies above so pages open offline and update when you are back online. It sends us nothing extra. Removing the app or clearing site data deletes the copies.
5. Who else handles data
| Who | What they do for us | What they receive |
|---|---|---|
| Cloudflare, Inc. | Hosting, content delivery, our server code (Workers), storage (Workers KV), AI quiz writing (Workers AI), security. | Request information from every visit; everything we store (mailing list, account data, counters). |
| Shopify shop | Store platform, cart, checkout, payments (with its payment processors), customer account login. | Everything you enter at checkout or login; request information when product images load. |
| [EMAIL PROVIDER] | Sending mailing-list letters (once we start). | Your email address and which list you joined. |
| Makers and shipping carriers shop | Producing and delivering your order. | Name, shipping address, items, and delivery contact details. |
| Open-Meteo | Weather and air-quality data. | City coordinates only. No personal data. |
We may also disclose information if the law requires it (for example a valid court order), to protect people from harm or fraud, or to a buyer or successor if PosSum is ever sold or reorganized, in which case this policy would continue to apply to your data.
6. No selling, no sharing, Global Privacy Control
We do not sell personal information. We do not "share" it for cross-context behavioral advertising, as California law uses that word, and we do not use it for targeted advertising or profiling. This has been true since the site launched.
We honor the Global Privacy Control (GPC) signal. Because we neither sell nor share, there is nothing on our side for it to switch off today. If that ever changes, a GPC signal from your browser will be treated as a valid opt-out with no further steps.
7. How long we keep things
| Data | Kept for |
|---|---|
| Rate-limit counters (hashed IP) | 1 minute to 24 hours, then deleted automatically |
| Parlor one-line-per-page marker (hashed IP) | 7 days |
| Weather cache | 30 minutes (not personal data) |
| "Send me yours" cards and tags Elizabeth read | 1 year, then deleted automatically; sooner if you ask |
| Mailing list entry | Until you unsubscribe or ask us to delete it |
| Carving on the tree (letter and year) and the hash that points to it | Until you ask us to remove it |
| Account and server-side game progress accounts | Until you delete your account or ask us to |
| Login sessions, with the encrypted Shopify tokens accounts | Until you log out, or 30 days |
Login-in-progress values (__Host-pauth) accounts | 10 minutes at most, in your browser only |
| Product details copied from Shopify shop | About 5 minutes (not personal data) |
| Order records shop | As long as tax and accounting law requires [CONFIRM PERIOD, OFTEN 7 YEARS IN THE US] |
| Parlor lines | As part of the published work, until you ask us to remove yours |
| Emails you send us | Up to 3 years after the conversation ends, unless a request needs a longer record |
| Browser storage | On your device, until you clear it |
8. Security
The site is served only over HTTPS. Cookies are HttpOnly and Secure. Pages send security headers that block other sites from framing them and block scripts from unknown sources. IP addresses are hashed before anything is stored. Admin functions need a secret key, and passwords are compared in constant time. Forms are rate-limited.
Logins use Shopify's OAuth 2.0 and OpenID Connect flow with PKCE, a one-time state value and a nonce, and we check the signature, issuer, audience, expiry and nonce of Shopify's identity token before trusting it. Shopify's tokens stay on our server, encrypted at rest, and never reach your browser. Anything that changes your account or bag only works when the request comes from possum.ing itself.
No system is perfectly secure. If a breach affects your personal information, we will tell you and the relevant authorities as the law requires. To report a security problem, see security.txt or email hello@possum.ing.
9. Children
possum.ing is not directed to children under 13, and we do not knowingly collect personal information from them. You must be at least 13 to join the mailing list or create an account (16 in the EEA and UK, or the age your country sets for consenting to online services, unless a parent or guardian consents). Purchases are for adults, or for teens using the store with a parent's or guardian's involvement, as Shopify's terms require.
If you think a child under 13 has given us personal information, email us and we will delete it.
10. International transfers
PosSum is based in the United States. Cloudflare serves the site from data centers around the world, and our stored data and Shopify's are processed in the United States and other countries. If you visit from the EEA, the UK or Switzerland, your information is transferred to countries whose laws differ from yours. We rely on the safeguards our providers offer for these transfers, such as the European Commission's Standard Contractual Clauses (and the UK addendum) and, where a provider is certified, the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. Ask us for details.
11. Your rights and how to use them
Everyone
Wherever you live, you can ask us to:
- tell you what personal information we have about you and give you a copy, in a portable format (JSON or CSV) if you want it
- correct it
- delete it
- stop sending you email
We do not charge for this and we will not treat you differently for asking.
EEA, UK and Switzerland
Under the GDPR and UK GDPR you also have the right to restrict our processing, to object to processing based on legitimate interests, and to withdraw consent at any time (this does not affect processing that already happened). You can complain to your local data protection authority. In the UK that is the Information Commissioner's Office. We would like the chance to fix the problem first.
[EU/UK REPRESENTATIVE (GDPR ARTICLE 27), IF YOUR LAWYER SAYS ONE IS NEEDED]
US states
California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and a growing list of other states give residents rights to know, access, correct, delete and port their personal information, to opt out of sale, sharing, targeted advertising and profiling, and to appeal a refusal. We give these rights to every US visitor, whether or not a particular state law applies to a business our size. We do not sell, share, target ads or profile, so the opt-outs are already in effect.
How to make a request
- Email hello@possum.ing with the subject "Privacy request" and say what you want.
- Send it from the email address the request is about (the one on the mailing list or your shop account). If you can't, we may ask a question or two to confirm it is you. We ask for no more than we need and delete it afterwards.
- We reply within one month (GDPR) or 45 days (US state laws), and tell you if we need more time and why.
You can use an authorized agent. We will ask the agent for your signed permission and may ask you to confirm your identity directly.
Appeals. If we turn down a request, reply with the subject "Appeal" and we will review it within 45 days (60 days in Colorado) and explain the outcome. If you are still unhappy, you can contact your state attorney general.
Data stored only in your browser is already under your control: clearing site data deletes it, and we have no copy.
12. Extra detail for California and other US states
In the last 12 months we collected these categories of personal information, from you directly or from your browser, for the purposes described in section 2:
| Category | Examples | Disclosed to |
|---|---|---|
| Identifiers | Name, email address, Instagram handle, phone number (if you send your card), IP address (processed by Cloudflare), hashed IP code, account id | Cloudflare; email provider; Shopify (shop and accounts) |
| Internet activity | Pages requested, quiz question ids seen in a session | Cloudflare |
| Approximate location | City-level location derived from IP, used only as a weather fallback | Cloudflare; Open-Meteo receives rounded coordinates only |
| Commercial information shop | Orders and order history | Shopify; makers and carriers |
| Customer records shop | Name, address, phone, payment details (held by Shopify) | Shopify and its payment processors; makers and carriers |
We collect no sensitive personal information and draw no inferences about you. All disclosures above are to service providers for business purposes. None are sales or sharing.
13. Changes to this policy
When we change this policy we update the date at the top. If a change affects how we use information we already have, we will tell you on the site, and by email if you are on the mailing list or have an account, before it takes effect. Earlier versions are available on request.
14. Contact
PosSum, operated by [LEGAL ENTITY NAME]
[MAILING ADDRESS]
hello@possum.ing