Privacy Policy

Last updated: 11 September 2026

openTag is an open-source project. This page describes what this website collects, in plain language. It measures page views and interactions and checks whether you are signed in to show the appropriate app entry. Below are the parties unavoidably involved in serving you a web page at all.

1. What this covers

This policy covers the website at opentag.build, including the Chinese page at /zh. It does not cover the openTag software itself. That software runs on a machine you control, keeps its memory as plain files in a git repository you host (Context Tree), and by default openTag's servers do not store your conversations, code or memory. What this website collects is a separate question, answered below.

2. What we collect

Page views, through Google Analytics 4. Loading a page here sends Google the address of the page, the page you arrived from, your device, browser and language, an approximate location worked out from your IP address, and a randomly generated visitor ID that lets Google recognise the same browser on a later visit. It also records which of a handful of controls you press — the GitHub buttons, the language toggle, the walkthrough steps, the questions you open — so we can tell which parts of the page do any work. There are still no forms, no accounts, no newsletter and no sign-up of any kind.

Concretely, the page loads one external script: gtag.js from www.googletagmanager.com, for the measurement ID G-RMDF361W1B. That script sets the cookies _ga and _ga_RMDF361W1B, and sends what it measures to google-analytics.com. Other scripts are served by this website and handle layout, analytics events, and the session check described below. You can verify this in the source or by opening your browser's network and storage panels.

There is no cookie banner: the tag loads on every page without asking you first. If you would rather not be counted, blocking googletagmanager.com in any content blocker stops it, and nothing else on the page depends on it.

3. Cookies and browser storage

Two cookies, both first-party, both written by the Google Analytics tag. _ga holds the randomly generated visitor ID; _ga_RMDF361W1B holds session state. Neither carries your name, your email address, or anything you typed, and no other site can read them. No third-party cookies. Our own code writes nothing to localStorage, sessionStorage or IndexedDB, and there is no fingerprinting.

On the homepage, your browser also sends any existing openTag app session cookie directly to app.opentag.build to check whether you are signed in. Website scripts cannot read that cookie. The reply contains only a yes/no sign-in status, not your name, email or token. We keep that status in page memory only and do not send it as a separate analytics field. The check does not create a session or extend its lifetime.

4. Third-party requests from this page

One: the Google Analytics tag, fetched from www.googletagmanager.com, which then sends its measurements to google-analytics.com. Both requests carry your IP address to Google, the way any HTTP request carries it to the server it reaches. Typefaces are still self-hosted from this domain. The homepage also makes the first-party session request to app.opentag.build, on arrival, when you return or reconnect, and once per minute while visible. The app receives ordinary request information, including your IP address and browser information, plus its session cookie if present.

5. Who else is involved

Serving a website still requires infrastructure, and those providers see technical data as a by-product. Google is on this list because we put it there; the other two are what serving a page requires at all:

Google (analytics) — receives one measurement for every page you view: the page address, the referrer, your device, browser and language, the visitor ID from the _ga cookie, and your IP address. Google states that it uses the IP address to derive a coarse location and does not log it. It processes this as our processor under the Google Analytics terms, on infrastructure that includes servers in the United States; we see only the aggregated reports. Google's privacy policy.
Vercel (hosting) — serves the static files. Like any web server, it records standard HTTP request logs, which include your IP address and user agent. Vercel holds these as our processor under its own retention policy; we do not access, export or analyse them. Vercel's privacy policy.
Cloudflare (DNS only) — answers the DNS lookup that turns opentag.build into an address. Our records are set to DNS-only and are not proxied, so your actual page requests go straight to Vercel and Cloudflare does not see them. Cloudflare's privacy policy.

If you follow a link from this site to GitHub, you are on GitHub's site and their policy applies.

6. What we do not do

We do not show advertisements.
We do not sell data or hand it to data brokers, and we do not use what analytics collects here for advertising.
We do not track you across other websites. The _ga cookie is first-party to opentag.build and no other site can read it.
We do not use social-media tracking pixels.
We do not build profiles of you as a person. Google Analytics does recognise you as a returning visitor, using the ID in the _ga cookie.

7. Your rights

If you are in the EU, EEA, UK, or California, you have rights to access, correct and delete personal data held about you. There is now something to act on: the visitor ID in the _ga cookie is personal data, even though it carries no name. The quickest remedy is in your own hands — clear this site's cookies, or block googletagmanager.com, and collection stops. To have what has already reached Google deleted, send us the value of your _ga cookie and we will submit the deletion request against it. Server logs sit with Vercel under its policy, linked above.

If you contact us — for example by opening a GitHub issue — you are sharing whatever you choose to write there, publicly, under GitHub's terms.

8. Children

This site is not directed to children under 16, and we do not knowingly collect data from anyone under 16. Analytics cannot tell ages apart, so this remains a statement of intent rather than a control.

9. Changes to this policy

If this changes — if we add another tool that collects something — we will update the "Last updated" date above and describe what changed. Adding anything that collects data is a material change. Adding Google Analytics was one, and it is set out in section 2 rather than folded quietly into a clause.

10. Contact

Questions, requests or complaints are best sent as a GitHub issue, which keeps the answer public and useful to the next person: github.com/first-tree-ai/opentag/issues.

This site is operated by Unispark.