Privacy

Cookies

This site sets no cookies. None at all — not for analytics, not for preferences, not for sessions. It also stores nothing in your browser through localStorage, sessionStorage or IndexedDB. Everything you enter into the app lives in the page's memory and is gone when you close the tab.

That is why you have not been asked to accept anything. A consent banner exists to obtain permission for storage that isn't strictly necessary, and there is no such storage here. If that ever changes, this page changes with it, and the banner arrives before the cookie does.

No third parties on the page

The site is one HTML file, one stylesheet, one script and one typeface, all served from this domain. There is no analytics service, no tag manager, no font fetched from a CDN — the ones this page is set in are files on this server — no social widget and no advertising pixel. The content security policy the server sends enforces this rather than merely promising it: scripts and connections are restricted to this origin, so the page cannot contact anywhere else even if something on it tried to.

Your browser therefore talks to exactly one server while you use Almanac — this one. Nobody else is watching over its shoulder.

What the server logs

Serving a request means seeing it, and what is seen gets written down briefly so that abuse is visible at all. For each request the server records one line:

• your IP address;
• the method and path requested — for example POST /api/predict;
• the response status and how long the request took.

These logs are written to the host's system journal. They are used to keep the service running and to spot abuse, and for nothing else: they are not profiled, not analysed for behaviour, not sold and not shared. They are kept for 30 days and then rotate away.

The lawful basis for this, where UK or EU data protection law applies, is legitimate interest — running a service securely and reliably is not possible without briefly knowing who is connecting to it.

Rate limiting

To stop one caller exhausting the machine, the server counts recent requests per IP address and refuses a caller who exceeds the limit. Those counts live in memory for sixty seconds and are never written to disk. Restarting the process erases them.

What you type into the app

• Fixtures you price. The teams, competition, date, venue and weather you choose are sent to the server, scored, and returned. The result is held in a small in-memory cache keyed by those inputs — so the same fixture is not scored twice — and that cache is not tied to you in any way and does not survive a restart.
• Questions you ask the agent. Your question is parsed on this server by ordinary pattern matching. It is not sent to an external language model or any other third-party service. It is not stored once answered, though the request line for it appears in the server log described above.
• Links in a question. If your question contains an nflweather.com link, the server fetches that page itself to read the forecast. The request goes out from this server, so nflweather.com sees this machine's address rather than yours. No other domain can be fetched this way — the allowlist is enforced on the redirect as well as the original link.

Please don't put personal information into the agent's question box. Nothing about pricing a football match requires it, and the question text does not need to be somewhere it can be read back.

What Almanac never asks for

There is no sign-up, no login and no password. No email address, no name, no payment details. Stargazer membership is not open, and until it is, nothing is being collected in the meantime. Should any of that ever change, it will be described here first.

The server also sends Referrer-Policy: no-referrer, so when you follow a link away from Almanac, the destination is not told you came from here. Geolocation, microphone and camera are switched off for this page at the browser level.

Children

Almanac is not directed at children, and collects nothing from anyone that would identify them, of any age.

Your rights

Where UK GDPR, EU GDPR or the CCPA applies, you have rights of access, correction, deletion, restriction, portability and objection over personal data held about you, and a right not to have it sold — Almanac does not sell or share personal information for advertising, and never has.

In practice the only personal data here is an IP address in a server log that ages out in 30 days. Exercising a right of access or erasure means finding log lines by address, which is possible if you tell us the address and the approximate time. Write to the contact below and it will be handled. If you are in the UK or EU and are unhappy with the response, you can complain to your national supervisory authority; in the UK that is the Information Commissioner's Office.

Where the data is

Almanac runs on a single server. Logs stay on that machine and are not copied to a third-party logging, analytics or backup service. The only other party involved in a page load is the network path between your browser and it. Connections are encrypted, and the certificate is obtained and renewed automatically by the reverse proxy in front of the app.

Contact

Privacy questions, requests about your data, and reports that something on this page is inaccurate: contact@garyqin.com.

Changes

If this policy changes, the date below changes with it. A change that introduces cookies, tracking or any collection beyond what is described here will be announced on the site rather than quietly edited into this page.

Last reviewed 20 August 2026.