Privacy Policy
Last updated: April 14, 2026 · Effective: April 14, 2026
The short version: We collect minimal data to run the site. We use Google Analytics and Google Ads (which set cookies). You can opt out. We don't sell your personal information. Contact
[email protected] with any privacy questions.
1. Who We Are
The Doodle Cast is an AI-animated podcast hosted by Rusty and Oreo, operated as a personal creator project.
2. What Data We Collect and Why
A. Newsletter Subscription
- Data: Email address
- Source: Voluntary signup form on the homepage
- Purpose: Send podcast updates, Gazette posts, and announcements
- Legal basis (GDPR): Consent
- Retention: While you are subscribed; deleted upon unsubscribe or after 2 years of inactivity
- Third party: Emails delivered via Resend (resend.com)
B. Dog Casting Submissions (/apply/)
- Data: Owner name, dog name, breed, personality description, fun fact, email address, up to 25 photo URLs, optional social media handle
- Source: Voluntary submission via the /apply/ form
- Purpose: Evaluate dogs for potential appearance on The Doodle Cast podcast
- Legal basis (GDPR): Consent (by submitting the form)
- Retention: Selected applications: kept for production records. Declined applications: deleted after 12 months
- Note: We store the URLs you provide for photos — we do not host the images directly
C. Comments
- Data: Display name (self-entered) and comment text
- Source: Comment forms on Gazette posts
- Purpose: Community engagement; comments are displayed publicly on the site
- Legal basis (GDPR): Consent (by submitting)
- Retention: Until deleted by admin or upon user request
D. Doodle Stack Game Scores
- Data: Player name (self-entered), score, character selected, timestamp
- Source: In-game submission
- Purpose: Leaderboard display at /leaderboard/
- Legal basis (GDPR): Consent (by submitting your score)
- Retention: Indefinitely for leaderboard history
E. Chat Conversations (Rusty & Oreo Chatbot)
- Data: Your name (self-entered), the full conversation transcript, a partial hashed IP address (SHA-256, first 16 characters only — not reversible), session identifier
- Source: Voluntary use of the chat widget
- Purpose: Improving the chatbot experience and moderation
- Legal basis (GDPR): Legitimate interest (service improvement)
- Retention: Up to 2 years; deletable upon request
- AI Processing: Conversations are processed by a local large language model (Ollama, running on private hardware). Your messages are not sent to OpenAI, Anthropic, or any external AI provider
- IP Address: We never store raw IP addresses. The hash we store cannot be reversed to identify you
F. Google Analytics 4
- Data: Pages visited, device type, browser, approximate location (city-level), time on site, events (button clicks, video plays)
- Source: Automatic — only loaded after you consent to analytics cookies
- Purpose: Understand how visitors use the site so we can improve it
- Legal basis (GDPR): Consent
- Cookies set:
_ga (2 years), _ga_* (2 years)
- Retention: 14 months (Google's default setting)
- Third party: Google LLC (US). Data may be transferred to Google's servers. Google Privacy Policy
G. Google Ads Conversion Tracking
- Data: Conversion events (newsletter signup, etc.), device identifiers
- Source: Automatic — only loaded after you consent to marketing cookies
- Purpose: Measure the performance of any promotional campaigns
- Legal basis (GDPR): Consent
- Third party: Google LLC (US). Google Privacy Policy
H. YouTube Video Embeds
- Data: When you interact with an embedded YouTube video, YouTube may set its own cookies (
VISITOR_INFO1_LIVE, YSC) and collect data per YouTube's own privacy policy
- Purpose: Video playback
- Third party: YouTube / Google LLC. YouTube Privacy Policy
I. OneSignal Web Push Notifications (Functional consent required)
- Data: Browser push notification identifier (if you subscribe)
- Source: Only if you explicitly click "Allow" on the browser push permission prompt
- Purpose: Send you podcast update notifications in your browser
- Legal basis (GDPR): Explicit consent (browser permission dialog)
- Opt-out: Revoke via your browser notification settings at any time
- Third party: OneSignal Inc (US). OneSignal Privacy Policy
J. Cloudflare (Infrastructure)
- Data: IP addresses and request metadata processed in transit
- Purpose: DDoS protection, performance, security
- Legal basis (GDPR): Legitimate interest (security)
- Retention: Per Cloudflare's policy
3. Cookies & Tracking
| Cookie | Provider | Purpose | Duration | Category |
|---|
dc_cookie_prefs | This site | Stores your cookie preferences | 1 year | Necessary |
chat_user_name | This site (sessionStorage) | Remembers your chat name in-session | Session | Functional |
_ga | Google Analytics | Distinguishes users | 2 years | Analytics |
_ga_* | Google Analytics | Session persistence | 2 years | Analytics |
| Google Ads cookies | Google | Conversion tracking | 90 days | Marketing |
OneSignal (__Secure-IP-*, push subscription) | OneSignal | Web push delivery | 1 year | Functional |
Spotify (sp_*) | Spotify | Embedded podcast player (loads only after Functional consent or click) | 1 year | Functional |
You can manage your cookie preferences at any time by clicking Cookie Settings.
4. Your Rights
GDPR / UK & EU Rights
If you are in the EU, UK, or EEA, you have the following rights:
- Access: Request a copy of data we hold about you
- Rectification: Ask us to correct inaccurate data
- Erasure: Ask us to delete your data ("right to be forgotten")
- Restriction: Ask us to limit how we process your data
- Portability: Receive your data in a machine-readable format
- Object: Object to processing based on legitimate interest
- Withdraw consent: Withdraw consent at any time (for consent-based processing)
- Complain: Lodge a complaint with your national data protection authority
CCPA / CPRA (California)
California residents have the right to:
- Know: What personal information we collect and how we use it
- Delete: Request deletion of your personal information
- Opt-out: Opt out of the "sale" or "sharing" of personal information. Note: We do not sell personal information. However, Google Analytics and Google Ads may constitute "sharing" under CCPA. You can opt out via our cookie settings.
- Non-discrimination: We will not discriminate against you for exercising these rights
How to Exercise Your Rights
Email [email protected] with your request. We will respond within 30 days. We may ask you to verify your identity before fulfilling the request.
5. Do Not Sell or Share My Personal Information
We do not sell personal information for money. However, our use of Google Analytics and Google Ads may be considered "sharing" personal information under California law. To opt out, use our Cookie Settings and disable Analytics and Marketing cookies. You can also use Google's Analytics opt-out tool.
6. Children's Privacy
The Doodle Cast is intended for general audiences, primarily adult dog owners and podcast fans. We do not knowingly collect personal information from children under 13 (or under 16 in the EU/UK).
If you are a parent or guardian and believe your child has submitted personal information to this site, please contact us at [email protected] and we will promptly delete it.
7. Data Retention
| Data Type | Retention Period |
|---|
| Newsletter email | While subscribed; deleted on unsubscribe or after 2 years of inactivity |
| Dog submissions (accepted) | Kept for production records |
| Dog submissions (declined/pending) | Deleted after 12 months |
| Comments | Until deleted by admin or upon user request |
| Game scores | Indefinite (leaderboard history) |
| Chat logs | Up to 2 years; sooner upon request |
| Analytics (GA4) | 14 months (Google default) |
| Hashed IP (chat) | Linked to chat log retention above |
8. International Transfers
This site is operated from the United States. If you are accessing from the EU/UK/EEA, your data may be transferred to and processed in the US. For Google Analytics, Google Ads, and OneSignal, these transfers are covered by Standard Contractual Clauses (SCCs) under their respective data processing agreements.
9. Third-Party Services & Consent Categories
We use the following third-party services. Non-essential vendors are only loaded after you grant the relevant consent in our cookie banner. Data transfers to US-based vendors are covered by Standard Contractual Clauses (SCCs).
Necessary (always active)
- Resend — transactional email delivery (US)
- DigitalOcean — site hosting (US company, EU region available)
Functional (opt-in)
- OneSignal — web push notifications (US). Loaded only after Functional consent.
- Spotify — embedded podcast player. The iframe is replaced by a placeholder and only loads on click or after Functional consent.
Analytics (opt-in)
Marketing (opt-in)
- Google Ads (US) — conversion tracking. Loaded only after Marketing consent.
Self-hosted (no third-party data transfer)
For GDPR compliance we self-host all front-end libraries and web fonts: Google Fonts (Chewy, Fredoka, Nunito), Font Awesome 6.5.1, hls.js, and Tailwind CSS are served directly from our own servers — no connection is made to Google Fonts, Cloudflare CDN (cdnjs), or jsDelivr when loading the site.
External content (visitor-initiated)
Links to YouTube, Apple Podcasts, Amazon Music, Instagram, TikTok, Facebook, Discord, and YouTube Music open in a new tab and only share data with those services after you click through — no iframes or tracking pixels from those vendors are loaded on our pages.
10. Security
- All data is transmitted over HTTPS (TLS)
- Database access is restricted; admin portal is token-protected
- IP addresses are hashed (SHA-256) and never stored in plain text
- No payment card data is collected or stored
No system is completely secure. If you discover a security issue, please report it to [email protected].
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will update the "Last updated" date at the top. For material changes, we will notify newsletter subscribers by email. Continued use of the site after changes constitutes acceptance of the updated policy.
12. Contact Us
For any privacy-related questions, requests, or complaints:
The Doodle Cast
Email: [email protected]
We aim to respond to all requests within 30 days.
If you are in the EU/UK and are not satisfied with our response, you have the right to lodge a complaint with your local Data Protection Authority.
The DoodleCast