Besley’s Lab (the “Site”) is operated by Samuel Besley, an individual based in Georgia, United States (“we,” “us,” or “the Site operator”). This policy explains what information the Site collects, how it’s used, who it’s shared with, and the choices and rights you have, whether you’re just browsing or have created an account.
This policy applies only to besleyslab.com and does not cover third-party sites we link to (GitHub, LinkedIn, Instagram, and similar), which are governed by their own privacy policies.
1. Information We Collect
Account information
If you create an account (to save arcade progress, build Hunger Games rosters, or write book reviews), we collect the email address, username, and optional display name you provide, and store your password as a salted bcrypt hash — we never store or have access to your plaintext password.
Content associated with your account
Content you choose to create is stored against your account: saved game progress and results, simulator rosters and run history, achievements, and book reviews. This content is only as identifying as what you choose to put in it.
Correspondence
If you email us through the contact page, we receive your email address and whatever you send us, and may keep that correspondence to respond to you and maintain a record of the exchange.
Automatically collected information (analytics)
The Site uses Vercel Web Analytics to understand how it’s used — which pages get read, roughly how visitors arrive, and whether the Site works well across browsers and devices. It is cookieless: it does not set cookies or store a persistent identifier for you, and it does not track you across other websites. For each visit it may receive:
- The page URL you visited
- The referring site or link, if any
- A broad, coarse location (typically country or region — not a precise location)
- Browser and device type
- The timestamp of the visit
This data is aggregated and anonymized for reporting rather than reviewed as individual visitor records, and is not linked to your account. We do not send names, email addresses, account or user IDs, order IDs, authentication tokens, or other directly identifying information to analytics — whether in a custom event or embedded in a page URL — and any dynamic route segment or query parameter that could carry identifying information is excluded from what analytics is given.
Cookies
We use exactly one cookie: a strictly necessary session cookie set by our authentication provider (NextAuth) that keeps you signed in if you have an account. It is required for account features to function and is not used for tracking or advertising. Because our analytics is cookieless and we use no advertising, tracking, or cross-site cookies, the Site does not show a cookie-consent banner — one generally isn’t required for a strictly necessary cookie and cookieless analytics of this kind.
Local storage
The Site uses your browser’s local storage to remember interface preferences (like light/dark theme) and progress in on-site games and easter eggs. This information stays on your device, is never transmitted to us or any third party, and is not analytics or tracking.
2. How We Use Information
We use the information above to:
- Provide, maintain, and secure your account and the features tied to it
- Authenticate you when you sign in
- Operate, maintain, and improve the Site, including understanding aggregate usage patterns through analytics
- Respond to messages you send us
- Detect, prevent, and address fraud, abuse, or security issues
3. Legal Bases for Processing (EEA/UK visitors)
If you’re located in the EEA, UK, or another jurisdiction requiring a legal basis, we process your information under:
- Performance of a contract — to provide account features you request, like saved games and reviews
- Legitimate interests — to operate, secure, and understand usage of the Site through aggregated analytics, balanced against your rights and interests
- Consent — where a specific feature requires it
4. How We Share Information
We do not sell or rent your personal information. We share information only with:
- Service providers — hosting, database, and analytics infrastructure provided by Vercel Inc. (“Vercel”), which processes data on our behalf to operate the Site and is not permitted to use it for its own marketing purposes. See Vercel’s Privacy Policy (opens in a new tab).
- Legal reasons — if required by law, subpoena, or other legal process, or to protect the rights, property, or safety of the Site, its users, or others
- Business transfer — if the Site or its assets are ever transferred, information may transfer as part of that transaction, subject to this policy or a successor policy you’re notified of
5. International Data Transfers
Our infrastructure provider, Vercel, may process and store information in the United States and other countries. Where required by applicable law, we rely on appropriate safeguards for such transfers.
6. Data Retention
We retain account information and its associated content for as long as your account is active, and delete or anonymize it upon a verified deletion request or account closure. Correspondence is kept as long as needed to address the inquiry it relates to. Aggregated analytics data is not linked to an identifiable person and is retained according to Vercel’s own analytics retention practices.
7. Your Privacy Rights
Regardless of where you’re located, you can request access to, correction of, or deletion of your account and its associated data at any time by contacting us. We’ll verify your request and act on it promptly.
If you’re in the EEA or UK, the GDPR/UK GDPR additionally gives you the right to rectify, restrict, or object to processing, to receive a copy of your data in a portable format, and to lodge a complaint with your local supervisory authority.
If you’re a California resident, the CCPA/CPRA gives you the right to know what personal information we’ve collected, to delete it, to correct it, and to opt out of the sale or sharing of personal information — we do not sell or share personal information for cross-context behavioral advertising, so no opt-out is necessary. We will not discriminate against you for exercising any of these rights.
8. Children’s Privacy
The Site is not directed to children under 13 (or under 16 in the EEA/UK), and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.
9. Security
We use reasonable technical measures to protect your information, including bcrypt-hashed passwords, encrypted transport (HTTPS/TLS), and access controls on administrative functions. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
10. Do Not Track
Because our analytics is cookieless and we don’t track visitors across third-party sites for behavioral advertising, there is no cross-site tracking for a Do Not Track signal to disable, and we do not currently respond to DNT signals differently.
11. Other Tracking Technologies
We do not currently use Google Analytics, Meta/Facebook Pixel, advertising trackers, or session-replay tools. If that ever changes, this policy will be updated first, and — for visitors in the UK or EU in particular — those tools won’t load until you’ve given opt-in consent, typically via a cookie/consent banner introduced at that time.
12. Changes to This Policy
We may update this policy from time to time. Changes take effect when posted, and the “last updated” date above will reflect the most recent revision. Material changes will be noted on this page.
13. Contact Us
Questions about this policy or your data can be sent via the contact page.