Privacy policy

Last updated: 17 September 2026

01 Who runs this site

This site (https://3d-scroll-prompts.vikataylor.com) is published by Vika Taylor, an independent designer and creator, acting as an individual and not through a company. It exists to give away four prompts: the ones used in a build video on the YouTube channel @VikaTaylor, printed here in full so anyone can copy them and change them. Nothing is sold here and nothing is charged for.

The page those prompts produced, OPAL, is a separate site that this one links out to. It is a landing page design demo for a nail studio that does not exist: an invented name for an invented business, written as demo content. Mentioning it here is the only role it plays in this policy, and no data of yours is exchanged with it.

For anything on this page, including any request under section 5, write to vika.taylor.one@gmail.com. No data protection officer is appointed, because the scale and nature of the processing described below does not require one under GDPR Art. 37.

02 What data is collected and why

The site itself collects nothing

There is no form on this origin. Nothing can be submitted, no account can be created, no newsletter can be joined and no payment can be made, because there is nothing behind any of it to submit to. The whole page is one column of text with four copy buttons, a video that only loads when you ask for it, and two links out. If you never accept analytics, this site learns nothing about you beyond what your browser must reveal to receive the page at all.

The copy buttons

Copying a prompt happens entirely inside your browser. The button reads the text out of the page you are already looking at and hands it to your clipboard through the browser's own clipboard interface. Nothing is uploaded, and the contents of your clipboard are never read, sent or stored by this site.

One thing is recorded, and only if you accepted analytics: an event named prompt_copy carrying the number of the prompt that was copied (01 to 04, or all). That is the whole payload. It exists to show which of the four people actually take, and it is sent through Google Analytics, which does not run until you press Accept. If you declined, the button still works and nothing is sent anywhere.

Analytics, and only after you accept

Google Analytics 4 (measurement ID G-VFPV5MZNL2) is the single analytics tool on this site, and it runs through Cloudflare Zaraz, a Cloudflare service that runs such tools on Cloudflare's servers instead of in your browser. Before you click Accept, and after you decline, this page sends nothing to Zaraz, so nothing reaches Google. After you click Accept, /consent.js starts Zaraz, served from this site under /cdn-cgi/zaraz/. Zaraz tells Cloudflare the page address and title, the referring page, your screen and window size, colour depth, character set and time-zone offset, and Cloudflare's servers pass Google the page view, the copy events, your browser's user-agent, your IP address and a random ID kept in a cookie. Your browser makes no request to Google for any of this. Google uses the IP address to estimate an approximate location and states that Google Analytics 4 does not log or store IP addresses. After you accept, the site also tells Google, through Zaraz, that analytics is allowed and that the three advertising signals (ad_storage, ad_user_data and ad_personalization) are denied, because the banner asks for analytics and nothing else, and consent taken for one purpose is not spent on another. There is no advertising tag, no remarketing tag and no conversion tag on this origin either, only the one measurement ID above.

Once accepted, it records the pages viewed, the referring source, an approximate location (country or region, not an address), device and browser type, how long the visit lasts, and the copy events described above. The purpose is narrow: to see whether the pack is being read and which prompts get taken. Legal basis: your consent, GDPR Art. 6(1)(a).

Request logs at the host

The site is served by Cloudflare. As with any host, the request itself is processed before a consent question can be asked, because that processing is how the page reaches your browser: IP address, user agent, the URL requested and a timestamp. It is used for delivery, caching and abuse protection. Legal basis: legitimate interest, GDPR Art. 6(1)(f). This is not analytics, it is not connected to the Google Analytics data, and no report is built from it here.

Nothing else is collected. There is no profiling, no advertising, no cross-site tracking and no browser fingerprinting on this origin.

03 Cookies

This site's own code sets no cookies. The cookies listed here are set by Cloudflare Zaraz, and only after you accept; the other entries sit in your browser's own storage.

• cfz_google-analytics_v4, cfzs_google-analytics_v4 and cf_zaraz_client: cookies set by Cloudflare Zaraz for Google Analytics, only after you press Accept. The first holds the random ID that tells one visit from another and lasts a year; the second counts page views in the current session; the third is Zaraz's own working cookie and lasts a year. They are set for vikataylor.com, so every site in the network shares them, and they are HttpOnly, so no script on a page can read or delete them.
• _zaraz_google_consent_update: a localStorage entry Zaraz writes after you accept. It holds the consent state passed to Google, analytics allowed and advertising not, and no identifier.
• p3d_consent: your consent choice. This is a localStorage entry on this origin, not a cookie, so it is never attached to a request and never leaves your browser. It holds one word ("granted" or "denied"), the moment you chose and the version of this policy you answered. It expires after 180 days, or sooner if this policy changes in a way that needs a new answer, and you are then asked again rather than carried forward on an old answer.
• YouTube. If, and only if, you press play on the video, YouTube can set its own cookies and storage in your browser. Those are YouTube's, not this site's, and section 4 describes exactly what pressing play does.

You can change or withdraw your analytics choice at any moment with the Cookie settings control, which is also in the footer of every page on this site. Withdrawing consent is exactly as easy as giving it, as GDPR Art. 7(3) requires: same control, same number of clicks.

If you declined, there is nothing to delete, because Zaraz never ran and no analytics cookie was ever written. If you accepted earlier and have changed your mind, press Cookie settings and choose Decline. That takes effect in the page you are on, without a reload: the page stops sending anything to Zaraz, the copy events included, and deletes the _zaraz_ entry, and on every later visit Zaraz does not start at all. The Zaraz cookies are HttpOnly, so no page can delete them; they stay until they expire or you clear them, and nothing on this site reads them while your choice is Decline. The page also deletes what the earlier set-up could leave until September 2026: the cookies _ga, _ga_VFPV5MZNL2, _gid and any _gat cookie, and the storage entry _gcl_ls. You can still clear cookies and site data for vikataylor.com from your browser settings without asking anyone.

04 Third-party services

• Cloudflare Zaraz (Cloudflare, Inc.) and Google Analytics 4 (Google LLC and Google Ireland Limited): analytics, started only after you accept and run on Cloudflare's servers, with the advertising signals denied. Cloudflare acts as a processor, as it does for the hosting. According to Google, GA4 does not log or store IP addresses. Policies: cloudflare.com/privacypolicy, policies.google.com/privacy.
• Cloudflare (Cloudflare, Inc., USA): hosting and CDN for this origin, processing the request data described in section 2. Cloudflare's policy: cloudflare.com/privacypolicy.
• YouTube (Google LLC and Google Ireland Limited): the video player, and only from the moment you press play. Fully described in the next subsection.
• Fonts are hosted here, not by Google. Bodoni Moda and Space Grotesk are served from this origin as .woff2 files under the SIL Open Font License 1.1. This page makes no request to Google's font servers at all, so your IP address does not reach Google at page load, before consent or after it. Embedding Google Fonts remotely without consent was held to infringe the right to informational self-determination by the Landgericht Muenchen I (judgment of 20 January 2022, case 3 O 17493/20), and self-hosting is the direct answer to that.
• Outbound links. Links to vikataylor.com, to youtube.com and to the OPAL demo hand you over to those sites and their own privacy policies. Nothing about you is passed along beyond the referrer your browser sends by default.

The video: nothing loads until you press play

The home page shows the build video, and it is deliberately not a normal embed. What the server sends you is a button with a still image on it. The still is a file on this origin (/media/video-thumb.webp, with a .jpg for older browsers), not a thumbnail fetched from YouTube's image servers, and there is no iframe anywhere in the delivered HTML. Until you press that button, no request goes to youtube.com, to youtube-nocookie.com, to ytimg.com or to any other Google host. Loading the page costs you nothing in Google's direction.

When you press it, the script builds a player pointing at https://www.youtube-nocookie.com/embed/, Google's privacy enhanced embed domain. If the security policy described below allows that frame, playback starts. From that moment YouTube receives your IP address and your browser's user agent, learns that the player was opened from this page, and may set cookies and other storage in your browser for playback, preferences and its own measurement. That processing is Google's, under Google's privacy policy, and this site neither controls it nor receives any of it back.

Pressing play is the consent, GDPR Art. 6(1)(a): a deliberate act, which is the whole reason the player sits behind a button instead of loading with the page. It is independent of the analytics banner in both directions. Declining analytics does not stop the player if you press it, and accepting analytics does not load the player unless you press it.

If you would rather not load anything from Google here at all, do not press play. Next to the player there is a plain link, "Open the video on YouTube instead", which simply takes you to youtube.com to watch it there under YouTube's own terms, with no embed on this page and nothing loaded into it.

One thing to expect, because it is what the policy on this domain currently does. The content security policy served here sets frame-src 'none': it blocks every frame, including the privacy enhanced YouTube one. So pressing play may not produce an embedded player at all. When that happens the page puts the still image and the button straight back, says so on the button, and opens the video on youtube.com in a new tab instead, which is exactly what the plain link does. Nothing is left half-loaded and nothing has reached Google from the frame that was refused. If the policy is later changed to allow www.youtube-nocookie.com, the player appears in place as described above; no other origin is allowed to frame anything here either way.

There is no map, no chat widget, no advertising network, no A/B testing tool, no comment system and no script CDN on this site. The same policy refuses scripts from any origin except this one and Google's analytics endpoints, so a third-party tracker could not run here even by accident.

Google and Cloudflare are US companies and may process the data above outside the EEA and the UK. Both publish their own transfer safeguards, including Standard Contractual Clauses and, where applicable, certification under the EU-US Data Privacy Framework; the policy links above are the current versions.

05 Your rights (GDPR / UK GDPR / similar)

If you are in the EU, the UK, or any region with comparable privacy law, you have the right to:

• Access the data held about you
• Correct it
• Delete it (the "right to be forgotten")
• Restrict or object to processing
• Withdraw consent at any time, with no effect on processing done before withdrawal
• Receive a copy in a portable format
• Lodge a complaint with your local data protection authority

To exercise any of these, email vika.taylor.one@gmail.com. You will get a reply within 30 days.

One honest caveat: there is very little here to hand over. No name, email or account exists on this site, so an analytics record cannot normally be tied back to you as a person, and I am not able to identify you from it (GDPR Art. 11). The fastest way to remove the analytics identifier attached to your browser is to use the Cookie settings control in section 3, decline, and clear cookies and site data for vikataylor.com. That erases it at the source, which no email to me can do faster. Anything YouTube stored after you pressed play is held by Google, so a request about that data goes to Google, not to me.

06 CCPA / California residents

Personal information is not sold and not shared for cross-context behavioural advertising, and it has not been in the previous twelve months. There is no financial incentive programme attached to any of this. The categories collected in CCPA terms are identifiers (an IP address and, after you opt in, a random analytics ID) and internet activity information: through Cloudflare Zaraz and Google Analytics after you opt in, and as technical request data at the host. You have the right to know what is collected, to request its deletion, and not to be treated differently for asking. Same address as above: vika.taylor.one@gmail.com.

07 Children

This site is not directed at children under 16 and does not knowingly collect their data. Nothing on it is age-gated, because there is nothing to register for and nothing to buy.

08 Changes to this policy

The date at the top of this page is the date of the last change. If what is collected, or who processes it, ever changes materially, this page is updated before that change takes effect. Your stored consent choice expires after 180 days in any case, so the question is put to you at least twice a year rather than being inherited from an answer you have forgotten giving.