Privacy notice

This site, borildenstudio.no, is run by Omess as a hobby project. There is no company behind it. Omess is the controller for the data described here and can be reached at post@borildenstudio.no.

This notice describes how this one hobby site handles data. It is not legal advice to anyone.

• To run the "what your browser reveals" demo, which shows you what a website can learn about you.
• To count visits (daily statistics).
• To tell bots from people and to handle abuse.

Level 1, without your consent. On pages that the server builds on request (today mainly the tool page), we record what your browser sends with every request anyway, in pseudonymised form: a shortened IP address (the first three groups), a daily one-way code made from the IP, the country and network operator, the connection type (HTTP and TLS version), a short list of request headers and a bot score. We do not read anything from your device for this level. Ordinary pages are served as finished files and are not recorded in our visitor database at all.

Level 2, only with your consent. We ask once, with a banner at the bottom of the screen on your first visit to any page of this site. Only if you click "Agree and store my data on the demo page" there, or "Store my data: network and location, device and browser details, fingerprint images, a behaviour sample, this site's cookies, and set a 13-month visitor cookie" on the tool page, do we store everything listed in section 4. Your choice is remembered in the bs_consent cookie (see section 6). This data is collected only on the tool page, never on any other page of the site.

With "accepted", every later visit to the tool page is stored automatically, without a new click, until you withdraw (section 9). If you click "Don't store anything" or "Don't store anything", or do nothing, you stay at level 1 and the tool page only shows you the report. The demo works the same either way: everything is shown to you in your browser, and storing it depends only on your choice. If this notice changes in substance and gets a higher version number, a cookie holding an older version counts as no choice and the banner appears again.

• Network: your full IP address and the name your internet provider gives it; your approximate location from the IP (city, region, coordinates with an accuracy radius, postal code); every header your browser sent and the full address of the page you came from (if your browser sent it); your TLS handshake fingerprint if available.
• Browser and device: everything your browser tells JavaScript about itself: browser and operating system versions, your language list, CPU threads, memory class, screen and window sizes, dark mode and accessibility settings, timezone and locale, which fonts from a test list are installed, your graphics card name, an audio test value, speech voices, how many cameras and microphones you have (not their names), the permission states for this site, storage quota, network type, battery (Chrome), timing values, and which privacy tools or extensions we detected.
• Fingerprint images: the two test images your browser drew (canvas and WebGL), stored as images, and a fingerprint code calculated from the stable parts of the above, which can recognise the same browser without a cookie.
• Behaviour sample: a sample of your mouse or pointer path and clicks, scrolling, the typing rhythm in the demo box (never the text), time on the page and tab switches, window resizes, touch counts, and the type and length of anything you paste into the demo box (never the content).
• Cookies and storage: the names and values of the cookies and storage keys this site has set (see section 6). Login and other secret cookies are stored by name only, with the value replaced by "[redacted]".
• Visitor id: a random visitor id in a cookie (signed by our server, so a made-up id is rejected), so we can recognise you next time, together with your first and last visit, the number of visits, the time you consented and the notice version you agreed to.

Even with your consent we never collect:

• your location from GPS or the browser's location feature;
• camera or microphone names or streams;
• your clipboard contents;
• other websites' cookies or your browsing history (a site cannot read these);
• the text you type or paste into the demo box;
• anything that needs a browser permission prompt. The tool page may offer such things as separate one-off demos; their results are shown to you and never sent to us.

We do not try to find out who you are by name, and we use no outside services to enrich the data.

This site cannot read cookies from other websites. A page only sees cookies set for its own address, and current browsers also keep third-party storage separate per site.

The theme switch remembers your light or dark choice in your browser's localStorage (theme). It never leaves your device and is not sent to us.

• Level 1 data: 90 days from the visit. After that only daily totals remain. The full IP address is never stored at this level.
• Level 2 visit data (including the images, the behaviour sample and your full IP address): 365 days (about 12 months) from your last stored visit.
• Your visitor record and the bs_vid cookie: 395 days (about 13 months) from your last stored visit.
• Daily totals (day, country, bot or human, number of visits): kept indefinitely. They contain no personal data.

These periods are our choice; shorter is possible, and you can delete your data earlier at any time (section 8).

• Delete now: use the "forget me" button on the tool page (shown while the visitor cookie exists), or the erase link with the token you were shown the first time you consented. Erasing by token in the browser that holds the bs_vid cookie also clears that cookie and sets your bs_consent preference to declined; from another browser it only deletes the data.
• By e-mail: write to post@borildenstudio.no and include the erase token or the visitor id shown on the tool page. Without one of them we cannot tell which data is yours, and we will tell you so.
• Access, correction, restriction, a copy of your data, or objection: by e-mail to the same address.
• Complaint: you can complain to the Norwegian Data Protection Authority, Datatilsynet.

Withdrawing is one click, as easy as consenting: use "Forget Me" on the tool page. We then delete your rows, clear the bs_vid cookie and the localStorage copy, and set your bs_consent preference to declined; the statistics keep only the daily totals. Until you withdraw, a choice of "accepted" keeps applying: every visit to the tool page is stored without a new click. After withdrawing, future visits are back at level 1 unless you consent again on the tool page.

To stop without deleting, use "Stop Storing (Keep My Data)" on the tool page: it sets your bs_consent preference to declined, so later visits are no longer stored, and keeps what is already stored for the periods in section 7. "Forget Me" still deletes it at any time. Erasing with your token (section 8) in this browser also sets the preference to declined.

Nobody. There is no analytics provider, no CDN, no advertising and no cloud service. Location lookups run on our own server with a local database. To show the name your internet provider gives your address, our server asks the internet's name system (DNS, a "reverse lookup"), so the DNS servers it asks see your IP address. Nothing else about you leaves our server.

This product includes GeoLite2 Data created by MaxMind, available from https://www.maxmind.com.

• Level 1: legitimate interest, GDPR Art. 6(1)(f): statistics, telling bots from people and handling abuse, kept small by the pseudonymisation and the 90-day limit.
• Level 2: consent, GDPR Art. 6(1)(a), and the Norwegian Electronic Communications Act (ekomloven) § 3-15 for the cookie, the localStorage copy and reading your device's details for storage.
• The bs_consent preference cookie: legitimate interest, GDPR Art. 6(1)(f), in remembering your own choice; as a strictly necessary cookie it is exempt from consent under ekomloven § 3-15.

Some of the consented data can hint at health, disability, language or nationality: accessibility settings (reduced motion, high contrast, forced colours), typing and pointer rhythm, installed fonts and speech voices, and your approximate location. We do not collect these special categories on purpose. We store the data only to show it back to you and as visit statistics, never to draw conclusions or make decisions about anyone.

This is version 2, dated 2026-10-01. It is the first published privacy notice of this site; the number matches the notice version stored with your data, so we can always tell which text you agreed to. The wording of this version was updated on 2026-10-01 before first publication (consent is now asked with a banner and remembered in the bs_consent cookie). If the notice changes in substance, the version number goes up and this version stays available in the site's source repository history.