Privacy Policy
last updated 22 august 2026
What we keep
If you release a butterfly as a guest, we store the butterfly and nothing about you: two colours, a number that decides how it looks and flies, and the day it was let go. The one-a-day limit is kept in a cookie in your own browser, not in a record here. If you have an account, we store your email address, your password as a hash that cannot be read back, the name and colour you chose for your profile, the day you joined, and the butterflies you have released. If you write to us from the contact page, we store the message together with the name and address you typed, and a one-way fingerprint of the address the request came from — not the address itself.
Why
The email address is how you sign back in, and how we answer you. The password is never kept as you typed it; what we hold cannot be turned back into it. The profile name and colour appear next to your own butterflies. The butterfly records are what let you see how long each one has left to fly. The fingerprint on a message is only ever compared with other fingerprints, so that the form cannot be flooded from one place; it cannot be turned back into an address either.
How long
After seven days a butterfly stops flying. If it came from an account, what is left of it is a line in your own history: the name you gave it and the day you released it. Its colours and its place in the meadow are erased within a day. A butterfly released by a guest leaves nothing at all — the record itself goes. Your history stays until you delete your account, which removes your profile, your history and every butterfly attached to it at once and for good, and ends every session you have open; there is no recovery period. A message you have sent us is kept so that we can answer it, and if you delete your account it stays without being attached to anyone. The only thing that outlives all of this is the number on the meadow counter, which did not begin at zero and belongs to no one.
Where it lives
The site runs on Vercel, and the database is an ordinary Postgres hosted by Neon in Frankfurt. Email is sent through Google’s mail servers. The check that tells people from scripts on the contact form is Cloudflare’s. Signing in is ours: your password never leaves our own database. You may also choose to sign in with Google instead; if you do, Google tells us your email address and nothing else — not your name, not your picture — and Google learns that you signed in here. You can always use a password instead and never involve them. Each of these services sees the technical information it needs to do its job, such as your IP address, and nothing more.
Your rights
You can ask for a copy of what we hold about you, ask us to correct it, or delete your account yourself from Settings at any time. Write to us on the contact page and we will answer.