Privacy

What stays here

Scenes, uploads, custom themes, preferences, and the unsaved draft live in this browser (localStorage and IndexedDB). Exports download to your computer. Create → Icon search uses Phosphor icons bundled with the app — no Phosphor network request. We do not run an account system. Projects are not stored on our servers unless you create a Share link.

What we contact

• Google Fonts — the editor loads typefaces from Google’s servers.
• Unsplash — photo search and chosen images go through Unsplash’s API and CDN. The public access key is restricted to this site when possible.
• Giphy — GIF search and chosen files go through Giphy’s API and CDN. The public API key is restricted to this site when possible.
• YouTube — pasted clips load as privacy-enhanced YouTube embeds (youtube-nocookie.com). YouTube may still set cookies.
• Issue reports — the report form posts category, severity, and your message to a shared Orby inbox. No contact details are collected. When configured, a Cloudflare Turnstile security check may run before send; Cloudflare may process technical data under its own policy.
• Microphone — only if you turn on Audio react. Audio is processed in the browser and is not uploaded.
• Local fonts — listing fonts on your computer uses the browser’s font access prompt. Font files stay local.

There is no advertising SDK and no analytics tracker in the app.

Guestbook

Signing the guestbook is optional. It sends the name and message you type to guestbook.ultrapilled.com, a small Isso server we run on Fly.io in Stockholm. We don’t ask for an email address or website. Each entry is stored with its date and a shortened IP address (the last part removed) to stop spam and rate-limit abuse. A Cloudflare Turnstile security check runs before you sign; Cloudflare may process technical data under its own policy.

New entries go to a moderation inbox and stay hidden until approved. Once approved, your name, message, and date are public. Entries that are never approved are deleted after 30 days. To remove an approved entry, use the issue report form and tell us the name and date.

Share links

Share link is optional. Nothing is uploaded until you confirm and pass a Cloudflare Turnstile check (Cloudflare may process technical data under its own policy). The current scene is packed as a .pill project and sent to share.ultrapilled.com, a small server we run on Fly.io in Stockholm.

Uploads, custom images, and most GIFs you added yourself are embedded in that file. Unsplash photos and Giphy GIFs stay as links to those CDNs when possible, so the share stays smaller and those hosts still serve the media. We may also store a small JPEG canvas preview so messengers can show a link card.

Anyone with the link can open and remake the scene. There is no public gallery or index — links are unlisted random IDs. Public URLs look like share.ultrapilled.com/o/… (preview card) and ultrapilled.com/r/… (the scene). On a phone, a shared link opens a minimal viewer (play physics / pinch) instead of the full editor.

Shares expire after 14 days and are then deleted. A size limit applies (about 8 MB). We store a shortened IP address with each share to stop spam and rate-limit abuse (a few creates per hour / day per IP).

If you never use Share link, your projects stay only in this browser (plus any .pill files you download yourself).

Cookies

Ultrapilled does not set cookies. Drafts, preferences, and custom themes use required browser storage (localStorage and IndexedDB) so the editor can reopen your last session. If you paste a YouTube clip, YouTube may set its own cookies on that embed.

Terms in brief

The Ultrapilled app is licensed under the MIT License. Files you export are yours. Third-party fonts, icons, photos, sounds, and video remain under their own licenses.

Desktop browsers only for the editor. Phones and most tablets cannot open Create — except via a Share link, which opens a minimal viewer.