colophon
privacy.
BRAINWORM believes in open and ethical technology. As a small independent operation, we build intentionally: no mass surveillance; no data harvesting; committed to combatting platform decay (opens in a new tab). This page is the honest list of what we collect when you visit brainworm.org, what we do with it, what we never do, and how you can ask for any of it back.
what we collect
Email address. If you subscribe to the dispatch, we ask for your email and which topics you want — drops, shows, fashion, research, collabs, etc. The address and your topic selections are the only personal data the form collects.
Pageviews. When you load a page, our server records one event to Cloudflare's Analytics Engine: which page you visited (the path only — no query parameters, no anchor links), which country (Cloudflare derives this from your IP address before our code sees the request), and a counter. We don't store your IP address, your browser identifier, browser fingerprint, cookies, or use any third-party tracking script.
Click events. A few page interactions get logged with a short name: when you switch channels in the Switchboard, when you click "visit" on a catalog site, when you click an artist card, when a drop teaser appears in view, when you click its main button, and when you scroll all the way to the bottom. Each one records what was clicked (i.e. the channel name, the artist name, the button label). Same page + country information as the pageview; nothing else.
Operational logs. When your browser blocks something on our page because of our security policy, it may send a small report to an endpoint we run. The report describes what was blocked (which security rule, which resource, which source file and line), not who you are. We use these to fix bugs; they rotate out of Cloudflare's logs automatically.
how we use it
Email. We send the dispatch on occasion to share updates on a topic you've opted in to receiving. Whether new music, show announcements, or the occasional research note, your topic selections control which dispatches you receive.
Pageviews and click events. We use them to understand which features visitors actually engage with so that we can make improvements to those features and adapt our products to meet the accessibility needs of users. It's all aggregated by path and country; individual visits aren't tracked back to a person, and we can't reconstruct a session from this data.
do-not-track and global privacy control
Our code checks two browser signals before recording any clicks:
- Do Not Track — if your browser sends
DNT: 1(Firefox's privacy.donottrackheader.enabled pref, the Brave shields default, the macOS Safari "Ask websites not to track me" setting), we record no click events. - Global Privacy Control — if your browser
sends
Sec-GPC: 1(Brave, Firefox, the GPC extension on Chrome), same: no click events recorded.
Neither signal stops the basic pageview counter (country + path). That counter happens on the server side, before your browser knows we're recording anything. If that bothers you, browser-level network blockers (uBlock Origin's domain-block lists, Brave Shields' strict mode) stop the page from loading at all and nothing lands in our logs.
third parties
Two services see your data, both with their own privacy policies:
- Buttondown hosts the email subscription list.
When you submit the subscribe form, Buttondown receives your
email and your topic selections and stores them on their
servers. They also see your IP address and browser identifier
at submit time, and may set cookies on
buttondown.comafter you click the confirmation link in their welcome email. Their privacy policy: buttondown.com/legal/privacy (opens in a new tab). - Cloudflare hosts this site, runs the code that records pageviews and clicks, and handles the secure connection between you and our servers. They see your IP address (to derive the country code) and the content of your requests before our code does. Their privacy policy: cloudflare.com/privacypolicy (opens in a new tab).
We don't sell, share, or hand your email to any third party beyond Buttondown's role as the dispatch host. Analytics live in our Cloudflare account and aren't shared with anyone outside the organization.
your rights
- Unsubscribe: every dispatch email has an unsubscribe link in its footer. One click removes you from the list and clears your topic selections.
- Delete your data: write to hello@brainworm.org. We'll remove your email from Buttondown and confirm.
- Know what we hold: same address. We'll send back what we have on file (an email address, your topic selections, subscription metadata; no profile, no purchase history, no engagement timeline).
- Correct an error: if your email is misspelled or you want to switch addresses, write us.
- Opt out of analytics: turn on Do Not Track or Global Privacy Control in your browser, or use Brave Shields / uBlock Origin / a similar network-blocker. We honor both signals (see above).
You don't need an account, password, or government ID. The single proof we need is access to the email address itself.
scope
This policy covers brainworm.org. Each site in our catalog — Deafiant apparel, pehpeh ASL dictionary, terp+trust, etc — carry their own scope and their own privacy terms. See each site for details (for example, terp+trust's policy is at terptrust.net/privacy (opens in a new tab)).
updates
When this policy changes, the new version replaces this page. We don't keep version history publicly yet — if you want to confirm the policy as of a specific date, write us and we'll send a copy of what was in force.
contact
Same address for privacy questions, data requests, and everything else. We read it.
edition 2026.05.19