PRIVACY

What is collected

Playing the machine itself collects nothing about you. What is collected depends on what you do:

• Your email, only if you claim an artifact. It is used to send you the artifact and, if you keep it, to tell you when a new chapter opens. You can unsubscribe from any email we send, at any time.
• The performance record: which parts of the machine you touched, held, and dragged, and when. It is stored with every artifact, claimed or not. This is what the artifact is made from, and what its replay page plays back.
• Coarse place and time signs: city, region and country, and the local hour and season at the moment an artifact is generated. They are read from Vercel’s edge geolocation headers and your browser’s own timezone. These are folded into the artifact’s generation, not tracked as a location history.
• Analytics: what you do on the site and what you don’t (the pages you open, how far you scroll, what you play on the machine), how you found the site, your device and browser, your location to the city and its approximate coordinates, your IP address, and a random id kept in your browser so that a return visit is counted as you. See “Analytics” below for exactly what is recorded, when it is on, and how to turn it off.
• A sign-in cookie, set only after you open the sign-in link from your own email. It is strictly necessary to keep you signed into your archive on this device and carries no tracking purpose; it is not set for anyone who has not opened that link.

Analytics: on by default, and how to turn it off

We record how people use this site so we can see what works: where visitors come from, what they do on the machine, and where they stop. Outside the European Union and European Economic Area, the United Kingdom and Switzerland, this is on when you arrive, and this page is how we tell you. Inside those places, we ask first, with a prompt at the bottom of the page, and record nothing until you say yes. We tell which applies from the country your connection comes from, and keep only that answer (“ask first” or “on by default”) in a small cookie, zt_consent_mode, that holds no id.

To recognise a return visit, the site keeps a random id in this browser’s local storage. It is not a cookie, it is not shared with any other site or any ad network, and it is not your name or email. Clearing your browser’s site data removes it. No fingerprinting is used. If your browser sends Global Privacy Control, nothing is recorded. You can also turn analytics off yourself, in this browser; your choice is kept in a cookie, zt_consent, that says only yes or no:

Each analytics event is stored with:

• Your browser’s random id, the time, the address of the page you were on, and the page on this site you came from.
• Your browser’s user-agent string, which names your browser, its version and your operating system.
• Where you are, as your connection resolves it: city, region, country, approximate latitude and longitude (the city’s, not your street’s), time zone and postal code where your connection gives one.
• Your IP address, the address your connection comes from. It is kept for 90 days and then deleted; the coarse location above stays.
• Where the visit came from, when that is known: the address you arrived on, with any campaign tags or ad click ids it carried (for example the utm_source tag on our Instagram and TikTok bio links, or the fbclid tag that Instagram and Facebook add to links); the site that sent you, if your browser reports it; a link code (?r=), if the link had one; and the app, if you opened the site in an app’s own browser, such as Instagram’s or TikTok’s. A field with no value is left out.

The events themselves:

• Opening a page, with your screen size and the size of the browser window.
• Scrolling a quarter, half and three quarters of the way down a page, and to the end. Each one records how far you had scrolled and how long the page had been open, to the millisecond.
• Time on a page: a count every 30 seconds while the page is in front of you (at most 20 per page), and how long the page had been open, to the millisecond, when you switched away from it, came back to it or left it. On leaving, it also records which of those scroll marks you had passed.
• Links to other sites you click, such as Spotify or Instagram, with the link’s address and its text.
• How fast each page was, by Google’s Core Web Vitals: how quickly it loaded and appeared, how quickly it responded to a tap or key, and whether its layout jumped around. These come with your window size, your screen’s pixel density and your connection type as the browser reports it (for example “4g”). For a slow response, they also name the part of the page and which of our scripts were involved.
• The steps of the machine described above.

In your browser, the random id sits in local storage until you clear it; where the current visit came from sits in session storage and is cleared when the tab closes. Nothing is recorded at all on a gift link, on the artist’s desk, or on the unsubscribe page, because the address of each of those works like a key.

The team behind Zep Tepi reads this on a private, password-protected page: how many people visited and returned, where they are on a map, how they found the site, and each visit’s steps. It is not sold, not shared with advertisers, and not used to show you ads.

Clicking a LISTEN or FOLLOW link is also counted as one aggregate daily total per service, with no cookie, id, or IP attached to that count at all.

The artifact image

When you claim an artifact, its image is generated by sending a description of your performance to OpenAI’s image model, along with a set of the artist’s own drawings as visual references. Your email address is never included in that request.

A wallet address (optional)

Everything you keep stays in your archive on this site. If you choose to give a wallet address of your own, beside your email when you claim an artifact or keep a gift, or later from your archive, we store it with that request, along with a one-way hash of your IP address used only to limit how many can be sent from one place in a day, and send the piece to that address on the Base network. If on-chain claiming has not opened yet, the address waits with the request until it does. Once sent, that address and the piece it holds are public and permanent on Base, which nobody, including us, can erase. We never create a wallet for you, never hold a key for you, and use no third-party wallet provider. You never need to give one to keep anything.

Public pages

A claimed artifact’s page (/a/000001 and onward) is public: anyone with the link, or who finds it on the wall (/wall), can view and replay that performance and its image. An unclaimed artifact, one nobody has put an email or signed-in account to, is not shown on the wall and carries no name or email to show; its number still resolves if guessed, showing the performance with no claimant attached.

Who processes it

• Supabase: the database and file storage everything above lives in.
• Vercel: hosts the site and resolves the location (city, region, coordinates) and IP address used in artifact generation and analytics.
• OpenAI: generates each artifact’s image from your performance and the artist’s drawings.
• Resend: sends the emails you receive from claiming an artifact or subscribing to chapter announcements, and receives mail sent to our contact address below, which it forwards to a real inbox.

How long it is kept

An artifact and its performance record are kept indefinitely as part of the project’s archive, because that record is the artifact. Your IP address is deleted from analytics records 90 days after the visit. Other analytics records and your email are kept as part of our ordinary records until you ask us to remove them, or you unsubscribe (for email going forward).

Unsubscribe and deletion

Every email we send has an unsubscribe link. Unsubscribing stops all future email to that address; it does not remove an artifact you have already claimed. To ask for your email or another record to be deleted, write to the contact address below and we will act on it.

Children

This site is not directed to children under 13, and Zep Tepi Project does not knowingly collect information from them.

Changes

This notice may change as the project changes. The date at the top of this page is always the last time it did.

Contact

Zep Tepi Project operates Zep Tepi Project and this site. Privacy questions or deletion requests: info@zeptepiproject.com.