Only Elves

Privacy policy.

Effective date: October 15, 2026

Information we collect

You can browse Only Elves without creating an account. While you browse, we record a random visitor identifier and activity associated with it, including artwork views, likes, and wallpaper downloads. We may also process basic request information such as timestamps, IP address, browser information, and rate-limit data to operate and protect the site.

When you sign in with Google or Discord, we receive the basic account information provided by that service, including your name, email address, provider account identifier, and profile image URL when available. We store the account records and sessions needed to keep you signed in. Anonymous activity from your browser may be linked to your account after you sign in.

When a music track reaches the end without being skipped, we record that completion against your visitor identifier. We calculate achievement progress from tracked artwork and completed-track activity and record achievements when they are unlocked. These records may be linked to your account if you sign in.

When you use the contact form, we receive the name, email address, and message you submit. Please do not include sensitive information that is not needed for your request.

How we use information

We use information to provide and secure account access, remember artwork you liked, show download and completed-track history, calculate achievement progress, measure aggregate gallery activity, respond to messages, prevent abuse, diagnose problems, and improve Only Elves. We do not sell personal information or use it for targeted advertising.

Services that process information

Cloudflare hosts the site, database, and server functions and therefore processes requests and stored account or activity data on our behalf. Better Auth manages authentication within our Cloudflare-hosted application. Google and Discord process information when you choose their sign-in options, according to their own privacy policies. Our Cloudflare-hosted contact function processes form submissions, and Cloudflare Email Routing delivers them to us.

We share information only as needed to operate these services, respond to your requests, protect the site, or comply with a valid legal requirement. We do not provide personal information to data brokers.

Cookies and browser storage

We use essential cookies to operate the site. The oe_visitor cookie contains a random identifier, not your name or email, and helps associate views, likes, and wallpaper downloads with the same anonymous browser. When you sign in, activity from that browser may be linked to your account. This cookie is HttpOnly, Secure, and SameSite-protected and may remain for up to 400 days unless cleared earlier.

Better Auth uses an essential session cookie to keep you signed in and protect your account. We do not use advertising or third-party tracking cookies. Browser session storage may temporarily hold your display name and email address to prevent interface flicker, and gallery filters and sorting during a language switch. Initials shown in the interface are derived from your display name and are not stored separately. These caches are cleared when you sign out or the browser session ends and are never treated as proof that you are authenticated.

When you choose a language, we save that preference in a cookie and browser local storage. The About page also keeps a small local history of recently shown portraits and the next portrait to display, so it can avoid repeats. You can remove these values by clearing Only Elves local storage in your browser settings; they do not contain personal profile information.

Retention and deletion

Account information and linked activity are retained while your account remains active. Authentication sessions expire after seven days and may renew while you actively use the site; signing out ends the current session. Anonymous activity records and aggregate counts may be retained to operate and understand the gallery. Rate-limit records are temporary. Contact messages are retained only as long as reasonably needed to respond and maintain relevant correspondence.

You can clear browser cookies, local storage, and session storage through your browser. To request deletion of your account and associated personal information, or to ask what information we hold about you, use our contact page. We may retain non-identifying aggregate statistics and records required to protect the service.

Security and changes

We use reasonable technical measures such as encrypted connections, secure cookies, access controls, and rate-limiting, but no online service can guarantee absolute security. We may update this policy as Only Elves changes. The effective date above will be revised when material changes are published.

Contact

For privacy questions or requests, use the contact page.