Draw My Canvas / studio
Privacy notice · last updated 30 July 2026

What this site measures

Draw My Canvas is eight animations and some static HTML. There is nothing to sign up for and nothing to submit. Exactly one request per page view leaves for a server that is not this one — a page-view counter — and this page describes it line by line.

  • Third-party hosts contacted1 — stats.dankdev.com
  • Cookies setNone
  • Accounts · forms · uploadsNone
  • Stored on your deviceTheme choice + offline cache
  • Ads · ad networksNone

The one third-party request: GoatCounter

Every page you can navigate to here — including this one — carries this snippet in its <head>. The only exception is the 404 page, which does not load the counter at all: 

<script>window.goatcounter={path:function(p){return location.host+p}};</script>
<script data-goatcounter="https://stats.dankdev.com/count" async
        src="https://stats.dankdev.com/count.js"></script>

The counter is GoatCounter, an open-source page-view counter, running at stats.dankdev.com. Your browser fetches https://stats.dankdev.com/count.js and that script then requests https://stats.dankdev.com/count once, to register the view. It is the only host other than drawmycanvas.com that any page here asks your browser to load — no fonts from a CDN (the two typefaces are embedded directly in /assets/site.css as data URLs), no ad network, no tag manager, no embedded video, no social widgets.

The path is prefixed with the hostname

The first line of the snippet overrides GoatCounter's path function with location.host + p. So a view of the Spiral Waves page is recorded as drawmycanvas.com/gallery/spiral-waves/ rather than /gallery/spiral-waves/. That prefix is what lets one counter installation hold more than one site without their paths colliding. It adds nothing about you — it identifies the site, not the visitor.

What the request contains

The part this site's own code sets is the path above; the rest is GoatCounter's standard payload, sent by count.js: the page path, the page title, the referrer (the page you arrived from, if your browser sends one) and your screen size. Then, as with every HTTP request any browser makes to any server, the connection itself carries your IP address and your User-Agent string. What stats.dankdev.com does with those after they arrive is a property of that counter's configuration, not of anything in this repository — so this page will not make a claim about it that you could not check.

One thing worth being explicit about: the standalone embed plates under /embed/ carry the same snippet. If someone puts a plate in an iframe on their own site, that iframe still counts a view, and the referrer it reports is the embedding page — under current default browser referrer policy, that page's origin rather than its full URL.

Cookies and identifiers — measured, not assumed

No cookies, no sign-up, no accounts. That line is on the front page and it is literally true: no code in any HTML file or script this site ships touches document.cookie, sessionStorage or indexedDB — not once. There are exactly two storage writes in the whole site, both in /assets/site.js, and both write the same key:

  • localStorage["dmc-theme"] — the string "dark" or "light", written when you press the theme toggle so the site remembers which one you picked. It is a preference, not an identifier; it contains no ID, and it is never sent anywhere.

GoatCounter is a cookieless counter — it does not write a cookie or an identifier into your browser to recognise you on a later visit. You can verify both halves of that yourself without trusting this page: open your browser's storage inspector on drawmycanvas.com and the only entry you will find is dmc-theme.

The offline cache

The site registers a service worker (/sw.js) so it keeps working without a connection. On install it precaches eight URLs — the four pages /, /gallery/, /about/ and /embed/, plus /assets/site.css, /assets/site.js, /assets/plates.js and /manifest.json — into a cache named drawmycanvas-v2.

After that it is cache-first: for every GET request it answers from the cache if it has a copy, otherwise it fetches from the network and stores a copy of what came back; if the network fails entirely it serves the home page instead of an error. All of that lives in your browser's Cache Storage, on your device. The worker sends nothing anywhere and reads nothing about you. Clearing site data for drawmycanvas.com removes the cache and the theme key together.

What this site does not have

  • No accounts and no sign-in. There is no login, no email capture, no newsletter.
  • No forms of any kind. There is not a single <form>, <input> or <textarea> element on the site — so there is no field you could type into and nothing you could submit.
  • No uploads and no user-generated content. Every animation is generated by code that ships with the page; nothing you do here is stored or published.
  • No ads, no ad network, no affiliate tracking, no fingerprinting script.
  • Nothing sold or shared. There is no data set here to sell.

Why this is allowed under GDPR

The counter runs on legitimate interests, Article 6(1)(f) of the GDPR. The interest is plain: knowing roughly how many people opened a page, and which pages those were, is what tells the person maintaining this site whether the work is worth continuing. It is aggregate counting, not profiling — no account, no cookie, no cross-site identifier, no attempt to build a picture of an individual — which is why it does not need consent under the ePrivacy cookie rules either. If you would rather not be counted, blocking stats.dankdev.com in a content blocker, or in your hosts file, stops the request entirely; the animations do not depend on it and everything else on the site keeps working.

How long anything is kept

The retention period for the counter's records is set on the counter itself, by whoever operates stats.dankdev.com — it is not configured by this site's code, so there is no number here that this repository could prove. Rather than invent one, this page states the honest position: ask the operator below, and they will tell you what the instance is set to. What is on your device — the theme key and the offline cache — stays until you clear your browser's site data.

Your rights, and who to ask

This site is run by Dank Dev, who is also the controller of the counter data. If you are in the EU, UK or a comparable regime you can ask what is held, ask for it to be corrected or deleted, and object to processing based on legitimate interests. Practically speaking there is unlikely to be anything to look up: nothing here is tied to a name, an account or an email address, so a request will usually only be answerable at the level of "these are the aggregate counts". Contact details are on dankdev.com.

Changes to this notice

If the site ever loads a host that is not listed here, this page is wrong. That is not left to good intentions: a test in the repository, test/privacy-hosts.test.cjs, parses every HTML file the site ships, collects every external host any page actually loads, and fails if one of them is not named in the text of this page. This notice was last updated on 30 July 2026.