# Privacy Policy

Last updated: March 09, 2026

**The short version:** floors.js does not use cookies, does not track your visitors, and does not collect personal data from people browsing your site. I only store what's needed to run the service.

## Who I am

floors.js is operated by Vynse ("I", "me"). Contact: [vincent@floorsjs.com](mailto:vincent@floorsjs.com)

## What I collect from site owners

When you sign up and purchase floors.js, I collect:

- **Email address** — to deliver your API key, send purchase confirmations, and contact you about your account.
- **Domain names** — logged automatically when your key is used on a site, to help you manage your keys.
- **Discord webhook URL** — if you configure Discord notifications. Stored server-side, never exposed publicly.

Payment is processed by **DodoPayments**. I do not store credit card numbers, billing addresses, or other payment details on our servers. DodoPayments handles all payment data under their own privacy policy.

## What I collect from site visitors

When someone visits a site that uses floors.js:

- **A random pseudonym and color** are generated and stored in the visitor's browser (localStorage). No account, no prompt, no signup.
- **Chat messages** are relayed in real-time via WebSocket and held in server memory while the connection is active. Messages are not persisted to any database.
- **Page path** (e.g. "/pricing") is used to assign visitors to rooms. No full URLs, no query parameters, no referrer data.

I do **not** use cookies. I do **not** store IP addresses. I do **not** fingerprint browsers. I do **not** track visitors across sites. The embed script does not load any third-party JavaScript on your site — anonymous engagement events are sent to my own server, which forwards aggregated metrics to PostHog EU.

## Analytics on floorsjs.com

Our website (floorsjs.com) uses **DataFast** for analytics — page views, events, and conversion tracking to help me understand how our website is used. DataFast is GDPR-compliant and does not share data with third parties. See [DataFast's privacy policy](https://datafa.st/privacy-policy) for details.

## Third-party services

- **Supabase** — database hosting (stores site owner accounts and API keys)
- **DodoPayments** — payment processing
- **Resend** — transactional email delivery
- **DataFast** — analytics on floorsjs.com ( [their privacy policy](https://datafa.st/privacy-policy))
- **PostHog EU** — receives anonymous engagement events from the embed (no PII, no IP, no cookies). Hosted in the European Union. See [PostHog's privacy policy](https://posthog.com/privacy).
- **esm.sh** — CDN for the Three.js library (loaded client-side)

None of these services receive personally identifiable information about visitors on sites using the floors.js embed.

## Data retention

- **Site owner data** (email, API keys) is retained as long as your account is active.
- **Visitor data** — chat messages exist only in server memory during an active WebSocket connection. When the connection closes, the data is gone. The random pseudonym lives in the visitor's browser only.

## Your rights

You can request deletion of your account and all associated data at any time by emailing [vincent@floorsjs.com](mailto:vincent@floorsjs.com). I will delete your data within 30 days.

## GDPR

floors.js is GDPR-friendly by design. The embed script collects no personal data from site visitors — no cookies, no IP logs, no identifiers that could be tied to a real person. Site owners who provide their email do so on a contractual basis (to receive their API key and service communications).

## Changes

I may update this policy. Significant changes will be communicated via email to registered users. The "last updated" date at the top reflects the latest revision.

## Contact

Questions? Email [vincent@floorsjs.com](mailto:vincent@floorsjs.com).