Privacy Policy

Last Updated: October 21, 2026

1. Introduction

Welcome to LootCastPuff (“we,” “our,” “us”). We are committed to protecting your privacy and ensuring that your personal information is handled securely and responsibly. This Privacy Policy outlines how we collect, use, disclose, and protect your information when you visit our website lootcastpuff.com (“Site”) or engage with our services.

Cookies on this site, exactly

LootCastPuff is a small, independent site, so here is everything the site stores on your device, and why.

• Your cookie choice (lcp_consent, jnews_cookie_law): remembers whether you pressed Cool or No thanks, so the bar stops asking. Kept 180 days.
• Dark mode (darkmode): set only when you flip the switch, so the site stays the way you like it.
• Google Analytics 4 (_ga, _ga_*, run by Google LLC): counts visits and which pages get read, so I know what to write next. These cookies last up to two years. Google Analytics 4 does not log or store IP addresses, and my Analytics setup keeps Google’s advertising features switched off.
• YouTube videos (the video playlist on the homepage and videos inside some posts): the player is YouTube’s, so as soon as it shows up on a page, YouTube (Google) sets its own cookies, like VISITOR_INFO1_LIVE and YSC, for up to 180 days. Those are Google’s, not mine, and the cookie bar doesn’t switch them off. How Google uses them: policies.google.com/technologies/cookies.
• Comments (WordPress comment_author_*): only if you tick the remember-me box under a comment form. Your name and email, so you don’t retype them. About a year. The Guild Hall guestbook has its own seat cookie, listed next.
• Your seat (lcp_seat): only if you tick “Remember my seat on this device” when you sign the Guild Hall book, or you bring a seat back with its code or the “This is my seat” button in an email. It holds one random number and nothing else: no name, no email. The Guild Hall reads it to say “Welcome back, Seat 12” and to mark your page. A small on-device note (lcp_seat_on, yes or no) keeps the page from jumping while it loads. Neither is used for tracking or ads. Kept 1 year. “Forget this device” on the Guild Hall clears both at once. The site keeps only a scrambled copy of that number and of your seat code, tied to your seat, never shown to anyone.
• Browser storage, not cookies: the tools’ settings (Lure Wheel spins, your Touch Grass streak, the Vault’s last vibe) and 15-minute copies of the river and sky readings live in your browser’s local storage. They stay on your device.

Weather and river readings: to fill the bar at the top of the page and the river panel on Count’s Corner, your browser asks Open-Meteo and the US Geological Survey for Pulaski’s readings, so they see your IP address like any site you visit. The bar keeps a copy in your browser for 15 minutes, so it doesn’t ask on every page.

Near you, in the header bar: the “Show my weather and river” button swaps Pulaski’s conditions for yours. It asks your browser for your location only when you tap it, never on its own. Before anything leaves your device, the location is rounded to about 7 miles. That rounded spot goes to Open-Meteo for the weather, and to this site’s own server, which finds the nearest US Geological Survey river gauge and keeps that answer for 7 days under the rounded spot only, never your exact position. If you type a US ZIP code instead, the ZIP goes to a free lookup service (Zippopotam) to get the same rounded spot. Your choice stays in your browser’s local storage so you don’t have to pick again; I never receive it. “Back to Pulaski” clears it, and so does clearing this site’s data in your browser. The Bite Window page (/bite-window/) uses the same remembered spot and the same services in the same way, and it only asks for your location if you tap “Use my location” there.

Trip Pack List keeps your ticks, your last trip and season in your browser (local storage, lcp-pack). It never leaves your device, and clearing site data wipes it.

Where you are sets the default. In the European Economic Area, the UK and Switzerland, Google Analytics sets no cookies until you press Cool; until then Google may still receive a cookieless signal that a page was viewed, with nothing stored on your device. Everywhere else, Analytics is on unless you press No thanks. If your browser sends a Global Privacy Control signal, I treat it as No thanks. No thanks deletes the Analytics cookies and stops new ones, and GPC stops them from the start. Either way, Google may still get a cookieless signal that a page was viewed, with nothing stored on your device.

Change your mind any time: change your cookie choice brings the bar back. You can also block Google Analytics on every site with Google’s opt-out add-on, or clear cookies in your browser. How Google uses data from sites like this one: policies.google.com/technologies/partner-sites.

2. Information We Collect

a. Personal Information

The only personal information the site asks you for:

• Name and email address, when you join the Guild or leave a comment
• Email address, when you set a River Bell
• Birthday month and day (Guild sign-up only)

b. Non-Personal Information

We may automatically collect non-personal information when you interact with our Site, such as:

• IP address
• Browser type
• Operating system
• Pages visited
• Time and date of visits
• Referring website addresses

c. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on our Site. Cookies are small data files stored on your device that help us understand your preferences and improve our services. The full list of what this site stores, and why, is under “Cookies on this site, exactly” near the top of this page.

d. Affiliate links, counters, comments and email

Affiliate cookies. Some links on this site are Amazon affiliate links (see the Affiliate Disclosure). When you click one, Amazon sets a cookie in your browser so it can credit the visit to LootCastPuff LLC if you buy: 24 hours, or up to 89 days for items you put in your cart during that window. That cookie belongs to Amazon and follows its privacy policy. We never receive your name or what you bought, only that a sale happened.

Affiliate network tags. The homepage also loads a small script from the affiliate network Impact, so it can confirm this site is ours and count visits for brands we partner with. It may set its own cookies and follows its own privacy policy. We never receive your name from it.

The counters. The visitor counter, Leave a Stone, the Skunk Bell, Touch Grass, the download counter and the Armory link counter each count a browser once a day. So they don’t count you twice, the site keeps a scrambled one-way code made from your connection and browser for one day, then it’s gone. Your IP address itself is never stored.

The headcount. The “adventurers in the hall right now” line counts browsers that had the site open in the last five minutes. While a tab is open and in use, it checks in once a minute. To tell visitors apart, the site keeps a scrambled one-way code made from your connection and browser until five minutes after your last check-in, then it’s gone. Your IP address itself is never stored, nothing is saved on your device, and Global Privacy Control turns the check-in off.

Comments and the guestbook. WordPress keeps your name, email, comment, IP address and browser so spam can be caught. Your email is never shown. The little picture next to a comment comes from Gravatar (run by Automattic), which gets a scrambled code made from your email to look it up. While a comment waits for my approval, its name and first 200 characters go to my private Discord moderation channel, never your email or IP address.

Member loadouts. If you post a loadout on the Guild Hall, the site keeps what goes on your card: your handle, the kind of loadout, the gear you picked, where it gets used, the vibe, your one line, your photo if you add one, the boxes you ticked (21 or older, your own gear, your photo) and the date. Photos are shrunk and saved fresh before they’re stored, which drops the location and camera details phones tuck inside them, and nobody sees a photo until I’ve looked at it. So one spot can’t flood the wall, the site also keeps a scrambled one-way code made from your connection. Your IP address itself is never stored, and there’s no email and no account. Your handle, the kind of loadout and whether it went up go to my private Discord moderation channel, never the photo or anything about your connection. Cards are public. To have one taken down, email GoodVibes@LootCastPuff.com with the card number (it’s on the card) and it comes down, photo and all.

Email (the Guild). Joining the Guild sends your email, first name, birthday month and day, your 21+ consent and the page you signed up from to Brevo, which keeps the list and sends the dispatches. We never sell your personal information, and your signup details go only to Brevo. Every email has an unsubscribe link, and unsubscribing takes you off the list.

Email (the River Bell). If you set a River Bell on the Salmon River page, the site keeps your email address, the bell you picked (like “back under 750 cfs”), when it was set, confirmed and last rang, a random code that makes the confirm and off links in your emails work, and a scrambled one-way code made from your connection, so one spot can’t set a pile of bells. Your IP address itself is never stored. Nothing but the confirm email goes out until you tap its link and press “Yes, ring me”. Brevo sends the emails. Your address is never sold or shared, and it never joins the Guild list. To stop, tap the one-click off link in any bell email, or write to privacy@lootcastpuff.com. A bell nobody confirms is deleted after 7 days, and a bell that’s turned off is deleted 30 days later.

Tips. Tips are handled by Ko-fi on its own page under its own policy. We see the tip and the name you gave Ko-fi, never your card.

e. YouTube API Services (our video uploader)

LootCastPuff LLC uses YouTube API Services to upload our own videos to the LootCastPuff YouTube channel from a private, internal tool. When you watch or use LootCastPuff on YouTube, you also agree to the YouTube Terms of Service, and Google’s Privacy Policy covers what Google does with your data.

What it touches. The tool signs in with the channel owner’s Google account and asks for one permission: upload videos to that YouTube account (youtube.upload). It sends videos, titles, descriptions, tags and thumbnails we made to our own channel. It does not read anyone else’s data, does not touch any other channel, and collects nothing about viewers or site visitors through the API.

What it keeps, and for how long. The owner’s sign-in token and the video ID of each upload, kept only on a private company computer and used only to upload to our channel. Never sold, shared, or used for ads or tracking. If access is revoked, we delete the token and the upload log within 7 days.

Revoking access. The channel owner can revoke the tool’s access at any time on Google’s third-party access page. Questions: privacy@lootcastpuff.com.

3. How We Use Your Information

We may use the information we collect for various purposes, including:

• Providing and maintaining our services
• Responding to your comments, questions, and requests
• Sending you technical notices, updates, security alerts, and support messages
• Communicating with you about products, services, offers, promotions, and events
• Monitoring and analyzing trends, usage, and activities to improve our Site and services
• Checking what you post in the guestbook, comments and loadouts for slurs, threats, links and spam before it shows. The check keeps counts, never your words. To catch copy-paste spam it keeps a scrambled fingerprint of each post for 24 hours, then drops it.

4. Sharing Your Information

We never sell your personal information. We may share it only in the following circumstances:

a. With Service Providers

We may share your personal information with third-party vendors and service providers who perform services on our behalf, such as analytics (Google), the Guild email list and River Bell emails (Brevo), hosting (SiteGround) and comment alerts (Discord).

b. Advertising

There are no ads or advertising partners here. If that changes, this page changes first.

c. For Legal Obligations

We may disclose your information if required to do so by law or in response to valid requests by public authorities.

5. Your Rights and Choices

a. Access and Correction

You have the right to access and correct your personal information held by us. You may update your information by contacting us at privacy@lootcastpuff.com.

b. Opt-Out

You may opt-out of receiving promotional communications from us by following the unsubscribe instructions provided in those communications or by contacting us directly.

c. Cookies

Most web browsers are set to accept cookies by default. You can adjust your browser settings to refuse cookies or to alert you when cookies are being sent. However, some parts of our Site may not function properly without cookies.

6. Data Security

We implement appropriate technical and organizational measures to protect your personal information from unauthorized access, use, or disclosure. However, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

7. Children’s Privacy

This site is written for adults, and joining the Guild asks you to confirm you are 21 or older. We don’t knowingly collect personal information from anyone under 21; if we learn we have, we delete it.

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the “Last Updated” date. We encourage you to review this Privacy Policy periodically for any changes.

9. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at:

LootCastPuff LLC, New York

Email: privacy@lootcastpuff.com

By using our Site, you acknowledge that you have read and understood this Privacy Policy and agree to our collection, use, and sharing of your information as described herein.