Privacy-First Architecture
ratelslop.studio is a non-commercial hobby project hub maintained by independent individual developers under the informal creative name 'RatelSlop'. RatelSlop is not a company or legal entity; 'RatelSlop Studios' is the informal display name of our GitHub organization. We do not install advertising networks, analytics scripts, tracking cookies, or behavioural tracking on this hub. Technical connection data and messages sent to us are processed as described below.
✓ 0 TRACKING COOKIES ⚖ NON-COMMERCIAL HOBBY PORTFOLIOFunctional Local Storage
The site's code does not set cookies. Browser localStorage is used to remember display choices after you select them. The controls tell you that your choices are saved on this device.
• theme: Your selected light or dark theme.
• lang: Your selected language (EN or NL).
These values are not sent to our APIs and remain until you change them or clear this site's browser data. If storage is blocked, the controls still work for the current page. Repository information is not read from or written to localStorage or sessionStorage. Older site versions may have left unused ratelslop_repos_cache_* and ratelslop_repos_cache_time_* entries, which you can remove by clearing site data. Your browser may cache files and API responses through its standard HTTP cache.
Remembering your explicitly selected display preferences supports the functionality you request. We rely on the functional-storage exceptions in Article 11.7a of the Dutch Telecommunications Act and § 25(2)(2) TDDDG, read with the EU ePrivacy Directive. This does not provide an exemption for unrelated tracking or additional storage purposes.
⚙ FUNCTIONAL STORAGE ONLYHosting & Server Logs
The hub's HTML, images and fonts are served through GitHub Pages (GitHub, Inc., United States, a Microsoft affiliate). GitHub processes technical connection data such as your IP address, browser headers, requested resource and request time to provide and secure the hosting service. We do not operate a separate visitor-account, marketing or profiling database on this hub.
Purpose, legal basis and retention: We use this hosting on the basis of our legitimate interest in making a secure, reliable public project overview available (Article 6(1)(f) GDPR). GitHub also processes data for its own service and security purposes under its own policy. Its log retention depends on the processing purpose and applicable legal obligations; the repository does not establish a fixed retention period for GitHub server logs. See the GitHub Privacy Statement for provider processing, retention and international-transfer information.
Cloudflare Edge Proxy, GitHub API & Project Hosting
Repository requests: The homepage requests public project metadata from https://api.ratelslop.studio/repos, hosted by Cloudflare Workers (Cloudflare, Inc., United States). Cloudflare receives your IP address, request time, requested URL and technical headers to deliver and secure the response. Our legal basis is Article 6(1)(f) GDPR: a reliable, current project overview with fewer upstream requests. The Worker queries public GitHub repositories and languages and uses a shared edge cache with a three-minute freshness period. It also keeps validated public metadata and change validators (ETags) for up to one hour to check for unchanged GitHub responses, and numeric rate-limit information for up to one hour to pause requests during throttling. Cloudflare may add visitor-IP headers to server-to-server subrequests; the proxy is not a guarantee of anonymity towards GitHub. If the proxy request fails or returns invalid data, the browser requests repository and language data directly from api.github.com (GitHub, Inc., United States), which then receives your IP address and technical browser headers. Those fallback requests serve the same purpose and legal basis. The browser API requests omit credentials and the Referer header. These caches contain public project metadata, validators and numeric rate-limit information; they contain no visitor identifiers or authentication tokens.
Logs and international transfers: The three-minute response cache is separate from provider logs. Cloudflare processes network and security data under the Cloudflare Privacy Policy. We use Workers Logs in the Cloudflare dashboard to investigate bots, abuse and security incidents. Cloudflare stores these logs on our behalf; they can include request URLs and methods, timestamps, request and response metadata, and runtime diagnostics. Our purpose is protecting the endpoint, based on legitimate interest (Article 6(1)(f) GDPR). We do not use these logs for advertising or marketing profiles. Cloudflare currently documents retention of three days on Workers Free and seven days on Workers Paid; these periods concern Workers Logs and do not establish the retention of Cloudflare's own network and security data. See the Workers Logs documentation. GitHub and Cloudflare may process data outside the EEA, including in the United States. Their published safeguards include the EU-U.S. Data Privacy Framework for covered transfers and standard contractual clauses where applicable. Information about the applicable safeguards can be requested through our contact point. Our source code contains no custom logging of visitor IP addresses or request headers.
Project links: Links to repositories and live demos are ordinary links; project pages are loaded after you click. Projects may use separate domains and providers and have their own terms and privacy notices. Responsibility depends on who actually operates each project and determines its processing, rather than its domain name or inclusion in this overview. These notices describe this hub and its repository-data endpoint; consult the relevant project's notice before using it.
Responsibility, Contact and Your Privacy Rights
Responsibility: The individual maintainers who determine how this hub and its repository-data endpoint operate are responsible for the processing they arrange. RatelSlop is their informal creative name, not a separate legal entity. The shared contact point for privacy requests and operator enquiries is support@ratelslop.studio. Using hosting and email providers does not remove the maintainers' responsibilities for processing on their behalf.
Contact by email: Messages to support@ratelslop.studio are forwarded by Cloudflare Email Routing (Cloudflare, Inc., United States) to our Proton Mail mailbox (Proton AG, Switzerland). Replies are sent from ratelslop@proton.me with the display name RatelSlop. This processes sender and recipient addresses, message subjects and contents, attachments and delivery metadata, such as mail-server IP addresses and delivery times. The maintainer uses these data to answer enquiries and handle support, security reports or legal requests, on the basis of legitimate interest (Article 6(1)(f) GDPR) or, where a legal duty applies, Article 6(1)(c) GDPR. Correspondence is retained while needed to resolve the request and necessary follow-up, comply with legal obligations, or establish, exercise or defend legal claims. Cloudflare may process data outside the EEA, including in the United States. Proton states that its Mail servers are located in Switzerland, Germany and Norway. Provider processing, retention and international-transfer information are described in the Cloudflare Privacy Policy and Proton Mail Privacy Policy, read with the Proton Privacy Policy. Ordinary messages forwarded through Cloudflare are not automatically end-to-end encrypted. Sending an email is optional; without relevant contact information we may be unable to answer the request.
Your rights: Where applicable, you may request access, correction, erasure, restriction of processing or data portability. You may object to processing based on legitimate interest. Any consent used for a particular processing activity can be withdrawn for the future. Send a request to support@ratelslop.studio; we respond within the GDPR time limits, normally one month, and may ask for proportionate information to verify your identity. Rights depend on the circumstances and statutory exceptions. We do not use visitor data for automated decisions with legal or similarly significant effects.
Complaints: You may lodge a complaint with a competent supervisory authority, including the Autoriteit Persoonsgegevens in the Netherlands or the relevant Landesdatenschutzbehörde in Germany, particularly in the country of your habitual residence, work or the alleged infringement (Article 77 GDPR).