Privacy &
cookies.

Who we are

Yellow Duck Studio is an independent remote design and development studio. We are responsible for the personal information we handle through yellowduck.studio and inquiries sent to us. This policy covers our public portfolio website and those inquiries; a project agreement may set out additional terms for client work.

For privacy questions or requests, email hello@yellowduck.studio. We work remotely and do not publish a physical office address on this website.

What information is involved

When you visit, our hosting and delivery providers receive technical information needed to serve and protect the site. This can include your IP address, requested URL, date and time, browser and device information, referring page, and security or error signals.

When you email us, we receive your email address, the name you provide, your message, and any attachments or project details you choose to send. Our contact links open your email app; there is no inquiry form that silently submits information in the background.

If you allow analytics, Cloudflare receives page-view and performance measurements, such as the page visited, referring site, load times and Core Web Vitals, browser, operating system, device type, and country. Network requests also expose connection information to Cloudflare. These reports help us understand visits and how the site performs.

If you allow analytics, our own measurement also records your visits to this website’s public pages: the page path, the referring site’s hostname, a broad source category (search, social, email, direct or a Yellow Duck shared link), your browser language, viewport size category, reported connection type, and the approximate country, region, city, timezone, network provider and device/browser/operating-system categories that Cloudflare derives from the request. A random first-party browser identifier connects repeat visits for 30 days. It does not store your IP address, raw browser identity string, query strings, form contents or browsing history on other sites, and it cannot see what you do on any other website.

Cloudflare Web Analytics does not use cookies or local storage to identify visitors, fingerprint devices, or track people across websites. The artwork responds to your pointer in your browser; we do not record sessions or send pointer movements to analytics.

Cookies and browser storage

Essential functionality delivers and protects the site. Analytics is optional and is off until you choose Allow analytics or switch it on and save in Cookie settings. Choosing Essential only, closing the popup, or continuing to browse does not enable analytics. Allowing analytics enables both Cloudflare Web Analytics and our own first-party measurement; there is no separate switch. We do not use advertising pixels or targeted advertising cookies.

We store your selection in a local-storage record named yds-privacy-choice. It contains the policy version, whether analytics is allowed, and the saved and expiry times. It has no unique visitor identifier and is not sent to our server. The choice lasts 180 days, after which we ask again. A material change to these choices may also prompt a new decision. If browser storage is blocked, your choice lasts only for the current page visit.

When you allow analytics, our own measurement sets a random first-party cookie named yd_observe for 30 days and yd_attribution, which remembers the most recent shared link or source for up to 30 days. yd_session in session storage lasts for the current tab. yd_observe_consent in local storage and, after a rejection, the yd_measure_off cookie remember your measurement choice for 180 days. Global Privacy Control and Do Not Track browser signals switch this measurement off. Choosing Essential only clears these identifiers; Forget my measurement data in Cookie settings also deletes the events recorded for the current browser identifier, including their copy in our private analytics.

Cloudflare may set strictly necessary security cookies when a protection or challenge is triggered. These help distinguish legitimate visitors from harmful traffic. Their names and lifetimes depend on the security feature used; they are not advertising preferences controlled by our popup.

The embedded animation library may briefly write and immediately remove a local-storage capability test. This checks whether browser storage is available and does not create a persistent visitor profile.

Open Cookie settings in the footer at any time to change your choice. Turning analytics off reloads the page to stop the loaded Cloudflare script and clears our measurement identifiers; it does not undo reports already sent unless you use Forget my measurement data. You can also block or clear browser storage, although blocking essential security cookies may affect access.

Cloudflare's security cookie reference

How Cloudflare Web Analytics works

How our first-party measurement works

Why we use information

We use technical information to deliver the website, investigate errors, prevent abuse, and keep the service secure. We use inquiry information to reply, discuss a potential project, prepare a proposal, and manage our business relationship. With your permission, we use analytics reports to understand visits and improve the portfolio and its performance.

Where data protection law requires a legal basis, essential delivery, security, and business inquiries rely on our legitimate interests, steps at your request before a contract or performance of a contract, or a legal obligation where one applies. Optional browser analytics relies on your consent. Saving a privacy choice does not subscribe you to marketing.

Providers and external links

Cloudflare Pages hosts and delivers this website. Cloudflare processes connection and request information for delivery and security and provides basic server-side traffic statistics. These essential operations are separate from the optional browser analytics controlled by our popup. When you allow browser analytics, Cloudflare also processes the measurements described above. Some portfolio images load from assets.codepen.io, which receives technical request information, including your IP address. Fonts and animation scripts are served with the site.

Our own first-party measurement is collected by a Yellow Duck Studio service running on Cloudflare Workers (go.yellowduck.studio) and stored in a Cloudflare D1 database, then copied into a private, self-hosted Matomo installation operated by Yellow Duck Studio for reporting. Matomo reuses the same permitted event records and adds no browser cookies. Only the studio can see these reports; they are not shared with advertisers or other clients.

Our email provider processes messages you send us. Providers receive information as needed to deliver their services. We may also disclose information when required by law or to protect legal rights and the security of the service. We do not sell inquiry information or share it for targeted advertising.

Providers may process information in countries other than your own. Where applicable, transfers are subject to the safeguards required by data protection law, including contractual safeguards offered by our providers. Contact us for information about safeguards relevant to your request.

Links to another website take you to a service with its own privacy practices. Their policies apply once you visit them.

Cloudflare privacy policy

CodePen privacy policy

Retention and security

Your browser preference expires after 180 days. Cloudflare makes Web Analytics reports available for the previous six months; its documentation describes seven days of unsampled beacon data followed by aggregation and sampling. We keep inquiry correspondence as needed to address the inquiry, manage resulting work, and meet legal, accounting, or dispute-related requirements. Hosting and security data are subject to our providers' retention practices. Our own measurement events, hashed browser and session identifiers and their private Matomo copy are deleted after 90 days.

We use reasonable technical and organizational measures to protect information, including HTTPS delivery and access controls for the services we use. No internet service can guarantee absolute security. Please do not send sensitive personal information that is unnecessary for your inquiry.

Cloudflare analytics retention and reporting

Your choices and rights

Depending on where you live and the law that applies, you may have rights to access, correct, delete, or receive a copy of your personal information, restrict or object to certain processing, and withdraw consent for activities that rely on it. Withdrawal does not affect processing that was lawful before withdrawal. Some rights have legal exceptions.

Send requests to hello@yellowduck.studio. Include enough context to identify the information involved; we may need to verify your identity before disclosing or changing personal information. We will handle requests within the time required by applicable law. You may also complain to your local data protection authority.

The portfolio is intended for people exploring professional creative services and is not directed at children. If you believe a child has sent us personal information, contact us so we can address it.

Changes to this policy

We will update this page when our website or information practices change. The date at the top identifies the current version. A downloadable copy is available on this page and in the cookie settings.