Last updated: 2026-10-23 · Contact: hi@rory.pics
The short version: we collect almost nothing. Cloudflare and Google hold the little there is, mostly network information. We sell and share nothing, and the site is for adults only.
Rory the Red Panda Bamboo Thicket (“the Bamboo Thicket”, “we”) is the umbrella name for personal projects run by Rory, an individual, including rory.pics, redpanda.pet and the tools and infrastructure behind them. It is not operated by Shutterpaws, which is a separate organization with its own policy.
What we collect
- Visiting the site. Cloudflare, which hosts our sites, processes your IP address and request details to deliver pages and defend against abuse. We use Cloudflare Web Analytics, which logs analytics only for infrastructure analysis and management. We do not sell or share that data. Cloudflare’s Web Analytics documentation describes what it collects and says it does not track individual visitors across sites.
- Widgets and map pages. Some widgets call our own server routes (
/api/...), which fetch public data on your behalf (map tiles, game stats, satellite positions, photo feeds), so those providers do not see your IP address. Others run in your browser and contact third-party services directly, so those services see your IP address and browser details under their own policies: GitHub, GitLab, Bluesky, Lanyard, rss2json (for Pixelfed and Mastodon feeds), Open-Meteo, wttr.in, Last.fm, the ISS position API, and Discord and Steam for avatar and game images. We do not control or receive that data. - Email you send us. If you write to us we keep the message as long as needed to reply and for our records.
- Signing in with Google. Visitors do not get accounts. Sign-in exists only for approved logins (Rory and any authorized team members). When an approved person signs in with Google we receive their name, email address and profile picture, through the
openid,emailandprofilescopes, and nothing else. We do not request access to Calendar, Drive, Gmail or any other Google service. We do not store Google passwords; the sign-in flow keeps only the tokens and related keys it needs to work.
We do not run advertising, sell data, or build advertising profiles.
Google user data
The Bamboo Thicket’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- We use Google data only to identify the signed-in person and show their name in the app.
- We do not transfer it to others except to operate that feature, to follow the law, or as part of a merger, with consent.
- We do not use it for advertising, and we do not allow humans to read it unless the person asks, it is needed for security or abuse investigation, or the law requires.
- We do not use it to train AI or machine learning models.
Where data lives
We keep no visitor databases of our own. Everything lives on Cloudflare (hosting, delivery and analytics, under the Cloudflare Privacy Policy) and Google (sign-in for approved logins, under the Google Privacy Policy). The little personal information involved is mostly network information, such as IP addresses in those services’ logs. Development and operational telemetry about our own systems (build status, tool usage, error counts) is private and contains no visitor data.
Retention and deletion
Because we hold no visitor data of our own, there is generally nothing for us to delete. Records kept by Cloudflare and Google are held under those companies’ own retention and policies, and we cannot delete them for you. We keep the details Google gives us at sign-in only while a login is on the approved list, and we do not share them. If you signed in with Google you can ask to be removed from the approved list, or remove the app’s access yourself at myaccount.google.com/permissions. The one thing we do hold is email you send us: write to hi@rory.pics and we will delete it on request, within 30 days.
Your rights
Depending on where you live (for example the EU/UK or California) you may have rights to access, correct, delete or export your data and to object to its use. Because the data lives with Cloudflare and Google, many of these requests have to go to them; email us and we will help where we can or point you to the right place.
Children
The Bamboo Thicket is for adults only and is not for minors, and we do not knowingly collect data from anyone under 18. If you believe a minor has sent us their data, email hi@rory.pics and we will delete it.
Security
We use HTTPS everywhere, a strict content security policy, and encrypted platform secrets, and we handle security reports privately. No system is perfectly secure.
Changes
We will post changes here and update the date above. Material changes to how Google data is used will be announced on the site before they take effect.