Who we are
embody.tools is operated by The Experiential Company, LLC(“TEC,” “we,” “us”), a California limited liability company, for the Embody & Envoy open-source project. For data-protection purposes TEC is the data controller for this site. The site hosts the Collection — a gallery of transparent TouchDesigner networks (TDN) that anyone can inspect, copy, and remix. Questions about this policy, or any request about your data, can go tolegal@tec.design.
What we collect
Account information
If you create an account, we store your email address, a display handle, an optional display name and bio, and a salted hash of your password — never the password itself. Authentication is handled byBetter Auth. If you instead sign in with GitHub, we receive only the basic profile fields GitHub returns (your account id, name, avatar URL, and the tokens needed to keep the session valid); we do not request access to your repositories or private data.
Sessions and cookies
When you sign in we set a strictly-functional session cookie so the site can recognize you on the next request. We record the session token, its expiry, and the IP address and user-agent string of the request that created it — standard fields used to keep sessions secure and let you sign out. We set no advertising or cross-site tracking cookies, and if you never sign in, no account or session data is created. The full breakdown is on the cookie page.
Content you contribute
When you publish a specimen, we store the TDN network you upload, a generated thumbnail, and the metadata you provide (title, description, category, license, and changelog notes). Contributed networks are scanned for capabilities and unsafe operators before they go live. Your handle is shown publicly as theattribution for anything you publish, and each version is kept as an immutable record so the history of a specimen stays diffable. Don’t upload anything you wouldn’t want public.
Anti-abuse (Cloudflare Turnstile)
Contributing a specimen is protected byCloudflare Turnstile, a privacy-respecting CAPTCHA alternative that confirms you’re a human without the puzzle grids. Turnstile runs a challenge in your browser and returns a token we verify server-side. Per Cloudflare, it is designed not to profile users or track them across sites. Sign-in and sign-up are rate-limited to deter automated abuse.
Analytics
We keep one kind of aggregate, non-identifying count: each specimen has acopy count that increments when anyone copies it — a total attached to the specimen, not to you. Beyond that, this site usesCloudflare Web Analytics, a cookieless, privacy-first analytics tool that reports page-level traffic in aggregate. It does not fingerprint visitors, does not use client-side state, and collects no personal data. If the analytics token isn’t configured for a given deployment, the beacon simply isn’t loaded.
Where your data lives
The site runs on Cloudflare. Account and specimen metadata live in Cloudflare D1; uploaded TDN files and thumbnails live in Cloudflare R2; short-lived anti-abuse counters live in Cloudflare KV. Cloudflare acts as our infrastructure processor and may process request data (such as IP addresses) to deliver and protect the service. Optional account emails — verification and password resets — are sent throughResend only when that service is configured for a deployment.
TEC is based in the United States and Cloudflare is a global network, so your data may be stored or processed outside your own country, including in the United States. Where data is transferred out of the EU, UK, or Switzerland, our providers rely on recognized safeguards such as the Standard Contractual Clauses and the EU–U.S. Data Privacy Framework.
How we use it
We use the data above only to operate the service: to sign you in, to attribute and display the work you publish, to keep the site secure and free of spam and abuse, and to understand aggregate traffic so we can improve the project. We donot sell your data, and we don’t share it with third parties except the infrastructure providers named here who process it on our behalf.
Why we’re allowed to (legal basis)
Under the GDPR and similar laws we only process your data when we have a lawful basis for it. In plain terms:
- To run your account and publish your work — because it’s necessary to provide the service you asked for. That’s the contract formed by our Terms of Service.
- To keep the site secure and free of abuse, and to understand aggregate traffic — because it’s in our legitimate interest to run a safe, working service, weighed against your rights and freedoms.
- To meet legal obligations — for example, responding to a valid legal request or a copyright notice under ourDMCA policy.
We don’t rely on consent for tracking, because there isn’t any tracking — the only cookie we set is strictly necessary to sign you in.
How long we keep it
- Account data — until you delete your account, after which we remove it.
- Sessions — until they expire or you sign out.
- Published specimens — kept as an immutable, diffable history while published, and removed from the Collection on request (copies others already made under your chosen license stay theirs).
- Anti-abuse counters and IP-based rate-limit keys — ephemeral; they expire automatically within minutes.
- Moderation reports — kept while we review them and for a reasonable period afterward as a record.
Your choices and your rights
You can browse the entire Collection without an account, and you can sign out at any time to end a session. If you do have an account, you have the right to:
- Access a copy of the personal data we hold about you.
- Correct anything inaccurate — most profile fields you can edit yourself.
- Delete your account and personal data (the “right to erasure”).
- Export your data in a portable form.
- Restrict or object to processing, including anything we do on the basis of legitimate interest.
To exercise any of these, emaillegal@tec.design and we’ll respond within 30 days. Note that published specimens may carry an open license (for example CC-BY-4.0) — copies others have already made under that license remain theirs to keep, but we will remove your authored entries on request.
If you’re in the EU, UK, or Switzerland, you also have the right to lodge a complaint with your local data-protection supervisory authority — though we’d appreciate the chance to put things right first.If you’re in California, you can ask us to access or delete your data, and for the record: we do not, and never will, sell or “share” your personal information.
Children
This site is not directed at children. You must be at least 13 to create an account, and where local law sets a higher age for consenting to online services (16 in parts of the EU), you must meet that age or have a parent or guardian’s permission. We don’t knowingly collect data from children below these ages; if you believe a child has created an account, contact us and we’ll remove it.
Changes
We may update this policy as the project evolves. When we do, we’ll change the “last updated” date above. Material changes will be noted in the project changelog.
See also the Terms of Service and thecookie page.