Website Privacy and Cookie Notice

Sora-P · Effective date: 23 August 2026

This notice explains what happens to your data when you visit the Sora-P website at https://sora-p.gitlab.io/. It is written by Sora ("the Service Provider"), who decides what is collected here and why.

What this notice covers

This notice covers the website only. The apps and games listed on it are separate: each one has its own privacy policy, linked from its project page, describing what that app collects on your device. Installing an app is governed by that app's policy, not by this one.

What is collected

The site is a set of static pages. It has no accounts, no login, no forms, and no comment system, so nothing is collected from you directly.

The site does load Google Analytics 4 through Google Tag Manager. When analytics is active, Google collects on the Service Provider's behalf:

• The pages you view on this site, and when
• The page or search result that referred you here
• Your approximate location (country or region), derived from your IP address
• Your device type, screen size, operating system, browser and language
• A randomly generated identifier stored in a cookie, used to recognise repeat visits to this site

Google Analytics truncates IP addresses and the Service Provider has no access to your full IP address through it. The Service Provider does not attempt to identify individual visitors, does not use the data for advertising, and does not combine it with any other source.

Cookies used

Google Tag Manager sets no cookies of its own. Google Analytics sets the following, and only after you accept:

• _ga — distinguishes visitors. Expires after 2 years.
• _ga_<container id> — keeps the state of a visit for the analytics property. Expires after 2 years.

Your consent choice itself is kept in your browser's local storage under the key sp-consent. It never leaves your device and is not readable by any other site.

Legal basis for processing

Where the GDPR or UK GDPR applies, analytics cookies are set only on the basis of your consent (Article 6(1)(a)), given through the banner described below. Keeping the site available and secure relies on the Service Provider's legitimate interests (Article 6(1)(f)).

How consent works here

The site uses Google Consent Mode v2. Before any tag runs, the page declares a default consent state:

• In the EEA, the United Kingdom and Switzerland, analytics, advertising and personalisation storage all default to denied. No cookies are set and no analytics data is sent until you accept.
• Elsewhere, they default to granted, and the banner lets you decline at any point.

Whichever region you are in, a banner appears on your first visit with an equal Accept and Reject choice. Closing it with the Escape key counts as a rejection — silence is never treated as consent.

To change or withdraw your answer later, use the Cookie settings control in the footer of any page. Withdrawing consent is as easy as giving it and takes effect immediately; it does not affect processing that already happened before you withdrew.

If you decline, no analytics cookies are set, and Google Analytics is limited to cookieless signals that are not used to identify you.

Global Privacy Control

The site honours the Global Privacy Control signal. If your browser or extension sends GPC, advertising and personalisation storage stay denied for the whole visit, even if you press Accept. This is treated as a valid opt-out of the sale or sharing of personal information under the CCPA/CPRA.

The site does not respond to the older Do Not Track header, which has no agreed meaning.

Who the data is shared with

• Google (Google Tag Manager and Google Analytics 4), as a processor for the analytics described above. See the Google Privacy Policy and how Google uses data from sites that use its services.
• GitLab Inc., which hosts the site through GitLab Pages and keeps standard server access logs containing IP addresses for security and abuse prevention. See the GitLab Privacy Statement.

The Service Provider does not sell your personal information, does not share it for cross-context behavioural advertising, and does not disclose it to anyone else except where required by law or legal process.

International data transfers

Google and GitLab may process data outside your country of residence, including in the United States. Those transfers rely on the safeguards those providers maintain, including Standard Contractual Clauses approved by the European Commission and, where applicable, the EU-US Data Privacy Framework.

How long data is kept

• Google Analytics event and user-level data: retained for up to 14 months, then deleted automatically by Google.
• Aggregated reports that no longer identify anyone: retained indefinitely.
• Your consent choice: kept in your browser until you clear your site data or change it.
• GitLab Pages server logs: retained by GitLab under its own policy.

Your rights

Where the GDPR or UK GDPR applies, you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw consent at any time. To exercise any of these, email sorafuyuuu@gmail.com.

You also have the right to complain to your local data protection authority. In the UK this is the Information Commissioner's Office; in the EEA it is the supervisory authority for your country.

The quickest route for analytics data is usually to reject cookies in the banner and clear your site data, since the Service Provider holds no identifier that could link a report back to you. You can also install the Google Analytics opt-out browser add-on.

Your California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information is collected, the right to delete it, the right to correct it, the right to opt out of its sale or sharing, and the right not to be discriminated against for exercising these rights. The Service Provider does not sell or share personal information collected through this website. To exercise your rights, email sorafuyuuu@gmail.com, or send a GPC signal as described above.

Children

This website is not directed at children and the Service Provider does not knowingly collect personal information from children through it. If you believe a child has provided personal information here, contact sorafuyuuu@gmail.com and it will be deleted.

Changes to this notice

The Service Provider may update this notice. Material changes will be published here with a new effective date, and where the law requires it, consent will be sought again before the change takes effect.

This notice is effective as of 2026-08-23

Contact

Questions about this notice, or about privacy on this website, go to sorafuyuuu@gmail.com.