Site Privacy

Last updated: October 12, 2026

This notice covers the website at sofritoconrecao.com: the home page, blog, gallery, about page, the app pages, and the three web toys, Pueblo Canvas (/pueblos), La Montana (/fortaleza) and Isla Gamma (/gamma). SofritoConRecao ("we", "us") is a one-person studio in Puerto Rico.

The apps work differently from the website, so each has its own policy:

• Lucky Split: privacy policy and terms
• Garden Journal: privacy policy and terms
• Carrier: privacy policy

The pr newsroom (news.sofritoconrecao.com) and ley 60 (ley60.sofritoconrecao.com) are separate projects and aren't covered here.

The short version

• The website has no accounts, forms, comments, newsletter or ads.
• Most pages ask before using Google Analytics, which sets cookies, to count visits. Nothing from Google Analytics loads unless you accept.
• Cloudflare hosts the site and measures page speed without cookies.
• Most pages load their fonts from Google.
• The web toys use cookies with a random player ID, and keep a scrambled code (a hash) made from your IP address, to enforce daily limits and stop abuse. What you make in the toys is public.
• We don't sell information about you.

Google Analytics

Every page except the Garden Journal pages and the web toys can use Google Analytics 4, but only if you say yes. A cookie banner asks the first time you visit. Until you click Accept, nothing from Google Analytics loads: no script, no cookies, and nothing sent to Google.

If you accept, your browser sends Google the address and title of each page you open, the page you came from, how long each page stays open, how far down you scroll, which links to other sites or files you click, your screen size, browser language, browser and operating system, and a random ID. Google says Google Analytics 4 doesn't log or store IP addresses. We use the reports to see which pages people read. Our setup tells Google not to use this data for advertising: Google signals and ad personalization are off.

Google Analytics keeps the random ID in two cookies on this site, _ga and _ga_1KSMW8JWHX. They're set only after you accept, and they last 13 months from your last visit unless you delete them. Until you accept, the site deletes any Google Analytics cookies left from visits before it asked.

We remember your answer for six months, then ask again. If your browser sends a Global Privacy Control or Do Not Track signal, we take that as a no: Google Analytics stays off and the banner doesn't appear.

You can change your answer anytime with "cookie settings" at the bottom of each page, or here:

Declining after you accepted turns Google Analytics off right away and deletes its cookies. Data already sent stays with Google; to have it deleted, email us the Google Analytics ID shown above before you decline. Google explains how it uses information from sites that use its services.

Cloudflare, our host

Cloudflare delivers every page of the site. Like any web host, it handles your IP address, the address you asked for, and the details your browser sends with each request, so it can deliver the page and protect the site. It does this under the Cloudflare privacy policy. Cloudflare also adds three things to our pages:

• Web Analytics. A small script that counts page views and measures how fast pages load. Cloudflare says it doesn't use cookies or local storage, doesn't fingerprint visitors, and doesn't collect personal data. We keep it off the Garden Journal pages.
• A bot check. A script that helps Cloudflare tell people from bots. Cloudflare may set a security cookie for it, such as cf_clearance or __cf_bm.
• Error reports. If a page fails to load, your browser may send Cloudflare a short report with the address, the type of error and the page you came from. Cloudflare says it doesn't log your IP address from these reports.

Fonts from Google

Most pages, the web toys included, load their fonts from Google Fonts, so your browser connects to Google, which receives your IP address and browser details. Google says Google Fonts doesn't set cookies and doesn't use this data to build profiles or target ads. The Garden Journal privacy and terms pages use their own copy of their font instead.

The video on the Lucky Split page

The Lucky Split page shows a YouTube video in YouTube's privacy-enhanced mode (youtube-nocookie.com). The player loads when you scroll near it, before you press play, so your browser contacts YouTube and Google, and the player may store data in your browser. YouTube says views in this mode aren't used to personalize what you see on YouTube or the ads you see outside this site.

What the site stores in your browser

• Your cookie banner answer, in a cookie named scrConsent with a copy in local storage: accept or decline, the date, and which version of the banner you answered, so we don't ask on every page. The cookie lasts six months and covers both sofritoconrecao.com and www.sofritoconrecao.com. Only the site's own script reads it; our server ignores it, and it's never sent to Google.
• The home page remembers which pot animation played last (scrPotAnim, in local storage), so the same one doesn't play twice in a row.
• Each web toy remembers your language (pueblo-lang, fortress-lang or gamma-lang, in local storage).

Apart from these and the toy cookies below, the site's own code stores nothing in your browser.

The web toys

Pueblo Canvas, La Montana and Isla Gamma are shared games: everyone plays on the same map. They don't ask for an account, an email address or your name.

Cookies

• pueblo_painter holds a random player ID. It lasts one year and is renewed each time you start a session.
• pueblo_session holds your current session for 24 hours.
• pueblo_quiz and pueblo_quiz_fail: Pueblo Canvas first asks visitors connecting from outside Puerto Rico a short quiz. Passing saves pueblo_quiz for one year, so you aren't asked again. A failed try is remembered for a waiting period of 20 minutes to about two days.

Pueblo Canvas sets the first two when its page loads, after the bot check below. La Montana sets them on your first move. Isla Gamma uses them if you already have them. All three toys share the same player ID, so your activity in each one is linked. Scripts on the page can't read these cookies, and only the toys use them.

Cloudflare tells us which country you're connecting from. Pueblo Canvas uses that only to decide whether to show the quiz, and doesn't keep it.

Bot check

Before starting a session, Pueblo Canvas and La Montana run Cloudflare Turnstile, which checks that you're a person using signals such as your IP address and browser details. We send your IP address to Cloudflare to confirm the result. See the Turnstile privacy addendum.

Your IP address

The toys don't store your IP address. They store a hash of it: a code made with a secret key, so the same address always gives the same code, but the code can't be turned back into the address without that key. For IPv6 addresses, only the first four groups of the address are used. The hash is used for daily limits, for bans, and to find and undo abuse.

What the toys keep

• Pueblo Canvas: your player ID, a made-up name (like DoradoCoquí123), your pixel counts, and for each pixel you change: the spot, the color, the time, your player ID and your IP hash.
• La Montana: each move you make (what and where), with the time, your player ID and your IP hash, plus the game's chronicle of events.
• Isla Gamma: each species you found (its name, its traits and the 16×16 drawing you made) and each nudge, with the time, your player ID and your IP hash.
• All three: counters for the daily limits, and bans.

What's public

• Pueblo Canvas: the canvas and the leaderboard (made-up names and pixel counts). Your player ID isn't shown.
• La Montana: the chronicle names players by their player ID, for example when someone finds a relic or wakes a monster.
• Isla Gamma: every species with its name and drawing, and the island's history. The island's data includes each species founder's player ID.

Drawings aren't reviewed before they appear, so don't draw anything personal.

Logs

Cloudflare keeps a log of requests to the toys for up to seven days. On Pueblo Canvas, each paint attempt also logs your IP hash and the name and number of your internet provider's network.

Who can see it, and for how long

Only the site's admin can see player IDs and IP hashes in the stored records, through admin pages protected by Cloudflare Access. The toys don't delete game records on a schedule; they keep them for as long as the toys run. Cloudflare can restore the toys' databases to any point in the last 30 days, so a deleted record can survive in that backup for up to 30 days.

Email

If you email us, we get your address and whatever you write. We use it to reply to you and don't add you to any list. Our email is Gmail, which Google runs.

Sharing

We don't sell or rent information about you, and the website shows no ads. Information goes only to the services named above, Google (including YouTube) and Cloudflare, which run parts of the site, or to others when the law requires it.

Your choices

• Block or delete cookies in your browser settings. The website still works without them; the toys need their cookies to let you play.
• Accept or decline Google Analytics in the cookie banner, and change your answer anytime with "cookie settings" at the bottom of each page or in the choice box in the Google Analytics section. A content blocker or Google's opt-out add-on also keeps it off.
• Ask us what we hold about you, or ask us to delete your toy records. Tell us your made-up name, or what you made and roughly when, so we can find it. We'll remove or anonymize what we can match to you.

Depending on where you live, you may have more rights over your data. Email us and we'll help.

Children

The site isn't aimed at children under 13, and we don't knowingly collect information from them. If you think a child has shared personal information here, email us and we'll remove it.

Changes

If what the site collects changes, we'll update this page and the date at the top.

Contact

Email: sofritoconrecao@gmail.com