Privacy policy

Last updated: 12 August 2026

The short version

This site is a free prompt pack: four blocks of text to copy, plus the video that shows them being used. There is nothing to sign up for: no form, no newsletter, no account, no payment. The only visitor data collected is Google Analytics, and only if you press Accept. The video loads nothing from YouTube until you press play, and the fonts are served from this site rather than from Google, so nothing about you reaches a third party before you have asked for it. No ads, no data selling, no other trackers.

Who runs this site

This site (https://3d-scroll-prompts.vikataylor.com) is published by Vika Taylor, an independent designer and creator, acting as an individual and not through a company. It exists to give away four prompts: the ones used in a build video on the YouTube channel @VikaTaylor, printed here in full so anyone can copy them and change them. Nothing is sold here and nothing is charged for.

The page those prompts produced, OPAL, is a separate site that this one links out to. It is a landing page design demo for a nail studio that does not exist: an invented name for an invented business, written as demo content. Mentioning it here is the only role it plays in this policy, and no data of yours is exchanged with it.

For anything on this page, including any request under section 5, write to vika.taylor.one@gmail.com. No data protection officer is appointed, because the scale and nature of the processing described below does not require one under GDPR Art. 37.

What data is collected and why

The site itself collects nothing

There is no form on this origin. Nothing can be submitted, no account can be created, no newsletter can be joined and no payment can be made, because there is nothing behind any of it to submit to. The whole page is one column of text with four copy buttons, a video that only loads when you ask for it, and two links out. If you never accept analytics, this site learns nothing about you beyond what your browser must reveal to receive the page at all.

The copy buttons

Copying a prompt happens entirely inside your browser. The button reads the text out of the page you are already looking at and hands it to your clipboard through the browser's own clipboard interface. Nothing is uploaded, and the contents of your clipboard are never read, sent or stored by this site.

One thing is recorded, and only if you accepted analytics: an event named prompt_copy carrying the number of the prompt that was copied (01 to 04, or all). That is the whole payload. It exists to show which of the four people actually take, and it is sent through Google Analytics, which does not exist in the page until you press Accept. If you declined, the button still works and nothing is sent anywhere.

Analytics, and only after you accept

Google Analytics 4 (measurement ID G-VFPV5MZNL2) is the single analytics tool on this site. It runs under Google Consent Mode v2 with every consent signal set to denied by default. Your IP address is not kept in any stored form: Google Analytics 4 does not log or store IP addresses at all, so that protection is unconditional rather than something we switch on. The old anonymize_ip parameter is deliberately not passed; it belongs to Universal Analytics, GA4 ignores it, and sending it would imply a switch on our side that does not exist. The Google script is not in the page: it is fetched by /consent.js only after you click Accept, so if you decline or ignore the banner, no request ever reaches googletagmanager.com from this page. Accept then flips every Consent Mode signal to granted, including the advertising ones, but nothing on this origin can act on those: there is no advertising tag, no remarketing tag and no conversion tag here, only the one measurement ID above.

Once accepted, it records the pages viewed, the referring source, the approximate location derived from a truncated IP address (country or region, not an address), device and browser type, how long the visit lasts, and the copy events described above. The purpose is narrow: to see whether the pack is being read and which prompts get taken. Legal basis: your consent, GDPR Art. 6(1)(a).

Request logs at the host

The site is served by Cloudflare. As with any host, the request itself is processed before a consent question can be asked, because that processing is how the page reaches your browser: IP address, user agent, the URL requested and a timestamp. It is used for delivery, caching and abuse protection. Legal basis: legitimate interest, GDPR Art. 6(1)(f). This is not analytics, it is not connected to the Google Analytics data, and no report is built from it here.

Nothing else is collected. There is no profiling, no advertising, no cross-site tracking and no browser fingerprinting on this origin.

Cookies

This site sets no cookies of its own. Everything listed here is either written by Google Analytics after you accept, or written by the consent script inside your own browser and never sent anywhere.

You can change or withdraw your analytics choice at any moment with the control, which is also in the footer of the home page. Withdrawing consent is exactly as easy as giving it, as GDPR Art. 7(3) requires: same control, same number of clicks.

If you declined, there is nothing to delete, because the Google script was never fetched and no analytics cookie was ever written. If you accepted earlier and have changed your mind, press Cookie settings, choose Decline, and reload: from that point the Google script is not loaded again. Cookies Google already wrote stay in your browser until they expire or until you clear site data for this domain, which you can do from your browser settings without asking anyone.

Third-party services

The video: nothing loads until you press play

The home page shows the build video, and it is deliberately not a normal embed. What the server sends you is a button with a still image on it. The still is a file on this origin (/media/video-thumb.webp, with a .jpg for older browsers), not a thumbnail fetched from YouTube's image servers, and there is no iframe anywhere in the delivered HTML. Until you press that button, no request goes to youtube.com, to youtube-nocookie.com, to ytimg.com or to any other Google host. Loading the page costs you nothing in Google's direction.

When you press it, the script builds a player pointing at https://www.youtube-nocookie.com/embed/, Google's privacy enhanced embed domain, and playback starts. From that moment YouTube receives your IP address and your browser's user agent, learns that the player was opened from this page, and may set cookies and other storage in your browser for playback, preferences and its own measurement. That processing is Google's, under Google's privacy policy, and this site neither controls it nor receives any of it back.

Pressing play is the consent, GDPR Art. 6(1)(a): a deliberate act, which is the whole reason the player sits behind a button instead of loading with the page. It is independent of the analytics banner in both directions. Declining analytics does not stop the player if you press it, and accepting analytics does not load the player unless you press it.

If you would rather not load anything from Google here at all, do not press play. Next to the player there is a plain link, "Open the video on YouTube instead", which simply takes you to youtube.com to watch it there under YouTube's own terms, with no embed on this page and nothing loaded into it. The content security policy served for this domain allows frames from www.youtube-nocookie.com and from nowhere else, so no other embed can appear here even by accident.

There is no map, no chat widget, no advertising network, no A/B testing tool, no comment system and no script CDN on this site. The same policy refuses scripts from any origin except this one and Google's analytics endpoints, so a third-party tracker could not run here even by accident.

Google and Cloudflare are US companies and may process the data above outside the EEA and the UK. Both publish their own transfer safeguards, including Standard Contractual Clauses and, where applicable, certification under the EU-US Data Privacy Framework; the policy links above are the current versions.

Your rights (GDPR / UK GDPR / similar)

If you are in the EU, the UK, or any region with comparable privacy law, you have the right to:

To exercise any of these, email vika.taylor.one@gmail.com. You will get a reply within 30 days.

One honest caveat: there is very little here to hand over. No name, email or account exists on this site, so an analytics record cannot normally be tied back to you as a person, and I am not able to identify you from it (GDPR Art. 11). The fastest way to remove the analytics identifier attached to your browser is to use the Cookie settings control in section 3, decline, and clear site data for this domain. That erases it at the source, which no email to me can do faster. Anything YouTube stored after you pressed play is held by Google, so a request about that data goes to Google, not to me.

CCPA / California residents

Personal information is not sold and not shared for cross-context behavioural advertising, and it has not been in the previous twelve months. There is no financial incentive programme attached to any of this. The only category collected in CCPA terms is internet activity information: through Google Analytics after you opt in, and as technical request data at the host. You have the right to know what is collected, to request its deletion, and not to be treated differently for asking. Same address as above: vika.taylor.one@gmail.com.

Children

This site is not directed at children under 16 and does not knowingly collect their data. Nothing on it is age-gated, because there is nothing to register for and nothing to buy.

Changes to this policy

The date at the top of this page is the date of the last change. If what is collected, or who processes it, ever changes materially, this page is updated before that change takes effect. Your stored consent choice expires after 180 days in any case, so the question is put to you at least twice a year rather than being inherited from an answer you have forgotten giving.

Legal disclaimer

This policy is a good-faith description of what this site actually does, not legal advice. If you are building something similar and want to reuse the text, have it reviewed by qualified counsel for your own jurisdiction and your own data flows.

← Back to the prompts