# Privacy

> What https://joyco.studio collects, who processes it, and how to ask about it.

## In short

https://joyco.studio is a portfolio site. It has no accounts, no sign-in, no shopping cart and no contact form, so there is nothing to fill in and nothing to store about you. It sets no cookies of its own, runs no analytics or advertising script, and shows no consent banner because it has nothing to ask consent for.

The exceptions are the ordinary ones — a web server logs the requests it answers, and two vendors deliver parts of the page. Both are named below.

## What is collected

- Server logs. Like any web server, the host records the request path, the response status, the time, the IP address and the user-agent string of each request. They are used to serve pages, to keep the site available and to investigate abuse.
- Nothing else, by this site. No cookie is set by this site's code, no identifier is stored in your browser by it, and no behavioural or advertising profile is built.

## Who processes it

Three parties are involved in delivering this site. Each one is limited to what its job needs.

| | |
| --- | --- |
| Vercel | Hosting and CDN. Receives every request to this domain, including the IP address and user agent, and holds the server logs described above. |
| Cloudflare R2 | Serves the images on this site from the studio's own bucket at r2.joyco.studio. Receives the request for each image file. |
| Mux | Delivers the video embedded in the case studies under /showcase. Loaded only on those pages; it receives the IP address and technical playback data needed to stream and measure the video, and may store playback state in your browser. |

## Fonts and assets

The typefaces are compiled into the site's own asset bundle at build time and served from this domain. No request is made to a font CDN while you read the page, so no third party learns you visited from loading type.

## If you email the studio

Writing to hey@joyco.studio means the studio holds your message and your address for as long as it takes to reply and to keep a record of the conversation. It is not added to a mailing list, and it is not passed on or sold.

## The public API

The read-only API described at https://joyco.studio/developers takes no authentication and accepts no personal data. Requests to it are covered by the same server logs as any other request. A best-effort rate limit hashes the requesting address into one of a fixed set of in-memory counters; the address itself is never stored, nothing is written to disk, and nothing survives the process.

## Children

The site is a studio portfolio. It is not directed at children and knowingly collects nothing from them.

## Your rights

Where the GDPR, the Argentine Personal Data Protection Act or a comparable law applies, you can ask what is held about you, ask for it to be corrected or deleted, and object to its processing. Email hey@joyco.studio and the studio will answer. Because the site stores no identifier for you, a request will usually be about server logs or an email thread.

## Changes

This page is versioned with the site's source. When what the site does changes, this page changes in the same commit — there is no separate policy document that can fall behind the code. Questions about any of it go to hey@joyco.studio.