Privacy Policy
Last updated August 22, 2026
I run this site as a personal project. It costs nothing to use, carries no ads, and I do not sell your information. This page lists what I collect and why.
Who this policy covers
This policy applies to raidenw.com and its subdomains: the dashboard at app.raidenw.com, the Haus coffee kiosk at haus.raidenw.com, and vy.raidenw.com. I refer to them together as "the site".
I am Raiden Williams and I run the site myself, from Seattle, Washington. Send privacy questions and requests to privacy@raidenw.com.
Who may use the site
You need to be 18 or older and in the United States to hold an account. I do not aim the site at children and do not knowingly create accounts for anyone under 18. Email me if you think a minor has an account and I will remove it.
Information you provide
You can read most of the site without an account. The dashboard is the part that requires signing in.
- Account details. Your name, email address, an optional avatar image URL, and your role. I create accounts by invitation, so there is no open self-signup.
- Password. If you sign in with a password, I store a salted
bcrypthash of it. The password itself never reaches the database or the logs. - Single sign-on. If you sign in through single sign-on, an identity provider confirms you control your email address and hands me that address and your name. I store no password for that route. See sign-in providers below.
- Content you create. Blog posts, photo collections, captions, uploaded images, and anything else you add through the dashboard.
- Haus events. Event names and dates, an optional venue location, an optional guest Wi-Fi name and password, and the drink menu you configure.
- Haus drink orders. When someone orders at a kiosk, I store initials of up to five letters and the drink selections. Ordering needs no name, email, or account.
What I collect when you visit
I use Vercel Web Analytics and Vercel Speed Insights to see traffic and page performance. Both are cookie-free and aggregated. Neither one stores your IP address, and neither builds a profile of you across other websites.
Each measurement can include:
- the page path and the referring page
- an approximate location from the request: country, region, city
- device type, operating system, and browser version
- page performance timings
My hosting and database providers also keep short-lived operational logs that can include IP addresses. Running and securing a website requires them.
How I use the information
- to sign you in and keep your session secure
- to show you the content and tools your account reaches
- to run Haus events and display the drink queue
- to publish the content you choose to publish
- to read aggregate traffic and fix performance problems
- to protect the site against abuse and to meet legal obligations
What I do not do
- I do not sell or share your personal information. Not for money, and not for cross-context behavioral advertising.
- I run no advertising trackers and no third-party advertising networks.
- I do not train AI on your data. Your account information and your content go to no machine-learning model and to no AI provider for that purpose.
- I collect no payment data. The site charges nothing, so it asks for no card or bank details.
Sign-in providers
Cloudflare Access brokers single sign-on. You can verify your identity with a one-time PIN that Cloudflare emails you, or by choosing Google.
If you choose Google, Google confirms your identity to Cloudflare, and Cloudflare hands me your email address and name. I ask Google for nothing else: no contacts, no calendar, no files, no Drive access. I keep nothing from Google beyond matching your address to an account that already exists, and your Google credentials never reach the site. You can review or revoke the connection in your Google account permissions.
Signing in through an identity provider does not create an account. If your email address has no account here, I turn the sign-in away.
Service providers
I run the site on infrastructure from other companies. They process data to deliver their service and for nothing else.
- Vercel
- Hosts the website and provides the cookie-free traffic and performance analytics.
- Neon
- Managed PostgreSQL database holding accounts and site content.
- Microsoft Azure
- Blob storage for uploaded images and the sizes generated from them.
- Cloudflare
- Brokers single sign-on and sends the one-time sign-in PINs.
- Apple
- Hosts the privacy@raidenw.com mailbox, so email you send me is stored on iCloud Mail.
- Optional single sign-on identity provider, used only if you choose it.
- Spotify
- Supplies the now-playing track on the kiosk from my own account. No visitor data goes to Spotify.
- Open-Meteo
- City lookup and weather for event locations. Receives a city search term and no personal information.
I may also disclose information when the law requires it, or to investigate abuse or a security incident.
Photographs and image metadata
The site resizes uploaded photographs for display. Those public copies drop the embedded metadata from the original, including any GPS coordinates, and carry a copyright and artist field instead. Camera details such as model, lens, ISO, aperture, and shutter speed can appear beside a photo.
I keep the original file in private storage, where it holds whatever metadata your camera recorded, location included. The site never serves that file. Email me at privacy@raidenw.com to have an original and its metadata deleted.
How long I keep things
- Account records last as long as the account, and I delete them with it.
- Content you create stays until you or an administrator deletes it. Deleting an account also removes the photos, collections, and posts that belong to it.
- Haus orders and events stay in the event record so hosts can look back at past events, and go when the event goes.
- Uploaded files with no matching database record, an abandoned upload for instance, get swept out of storage on a schedule.
- Analytics stays aggregated and ties back to nobody.
Your choices and rights
Wherever you live, you can ask me to show you, correct, export, or delete your personal information. Email privacy@raidenw.com and I will handle it within 45 days at no charge.
- Change your name, email address, avatar, and password yourself in dashboard settings.
- Changing your password or email address signs out every other session.
- Ask me to delete your account whenever you want. Deletion is permanent.
I never sell your information and never share it for advertising, so no "Do Not Sell or Share My Personal Information" process exists for you to use.
Do Not Track and Global Privacy Control
I do not track you across other websites, so a Do Not Track or Global Privacy Control signal has nothing to switch off. The site behaves the same whether you send one or not, because the tracking those signals address never happens here.
Security
I hash passwords with bcrypt. Sessions ride on signed, HTTP-only cookies over HTTPS, and I can revoke them. The server checks dashboard access on every request, and a passkey gates private albums and posts.
Security has limits, and I would rather hear about a problem than read about it. Report a vulnerability to privacy@raidenw.com instead of posting it publicly.
Children’s privacy
I do not aim the site at children under 13 and do not knowingly collect their personal information. Email privacy@raidenw.com if you believe I have, and I will delete it.
Changes to this policy
I update this policy as the site changes, and the date at the top tracks the current version. When a change affects how I handle your information, I will email account holders or post a notice in the dashboard before it takes effect.
Contact
Questions, corrections, and deletion requests go to privacy@raidenw.com.
The Terms of Service cover the rest.