Security & Privacy Policy (SECURITY)

We don’t know who you are… and we don’t want to know. The Hypn0.xyz (HypnoSVG) platform operates in strict compliance with Inter­galactic DOOP Protocols and GDPR directives, adhering to the Zero Personally Identifiable Information (Zero-PII) doctrine. No registration, logins, passwords, emails, SMS, or phone numbers. The database contains zero user or account tables. Synthesized SVG files contain purely mathematical coordinates of vector primitives and inline CSS animations. No source image metadata is embedded (EXIF tags, geolocation, and hardware device profiles are purged during raster­ization).

Prologue: The Anatomy of Privacy in the Age of Mental Resonance

We are the Hypnotoad, the Brain Slugs, and the Receptors of Planetary Mind-Numbing. And we don’t want to know who you are. Don’t even try to persuade us.

The Hypn0 platform is engineered from the ground up on the Zero-PII (Zero Personally Identifiable Information) doctrine. We do not require registration, logins, passwords, email addresses, or phone numbers. In the project database, user and account tables simply do not exist. Generated SVG files contain only mathematical coordinates of geometric primitives and inline CSS keyframes. Zero metadata from source images is retained (EXIF tags, GPS coordinates, device specs, and even source file names are completely stripped during raster­ization).

Section I. No-Consent Mode (Default / No-Tracking)

If you have not clicked the “Submit to Hypnotoad!” button—you are completely invisible in the astral realm. This means:

1. Hypn0 (HypnoSVG) does not deploy any client identifiers. Neither cookies nor browser localStorage records are created.
2. External analytics systems are disabled: tracking beacons and metric counters (Google Tag Manager, analytics scripts, etc.) are blocked at the template level and physically never loaded onto the client device.
3. Server logs—the only baseline telemetry captured by infrast­ructure (IP address, User-Agent, requested URL, and timestamp) — are utilized strictly for DDoS defense and uptime monitoring, retained for a minimal duration with regular rotation faster than memories fade after a hypnosis session.

Section II. Restrictions for Free Humanoids Without a Brain Slug

Humanoids who decline tracking or withhold explicit consent can freely use the local vector generator and browse the gallery. However, they cannot access pseudo-social platform features:

• Publishing original works to the public “Trance Gallery”;
• Voting for artworks (transmitting psychic resonance / likes);
• Submitting complaints or flagging spam and non-transcendent content.

Reason for Restrictions: Anti-Abuse & Bot Defense

To operate the gravit­ational Brain Slug sorting algorithm (curated ranking) and fairly distribute artworks across tiers (“Incubator”, “Approved by Brain Slug”, “Deep Trance Hall of Fame”), the platform requires a unique anonymous client anchor.

Because a humanoid who has not “surrendered to the Hypnotoad” carries no device anchor, the Lord of Mental Intros­pections (the server) cannot recognize duplicate votes. This would lead to instant scripted vote tampering, spam surges, and the destabi­lization of the entire gallery ecosystem.

Section III. Consent Mechanism via “Submit to Hypnotoad!”

1. The browser generates a cryptog­raphic pseudo-random identifier via crypto.randomUUID() (UUID v4).
2. The value is stored in a cookie and/or browser localStorage under the key hypn0_vid.
3. The lifespan is configured for two Earth years, with transmission flags set to safe mode (path=/; SameSite=Lax).
4. The hypn0_vid token is a purely random string and cannot be linked to your real identity, physical vessel, or cerebral Theta/Alpha brainwaves.
5. The identifier is used by the backend exclusively for rate limiting and enforcing the “one vote per artwork per browser” rule.

Section IV. File Processing Security during SVG Generation

• Input Data Sanitization (Source Images): All inbound images pass through the Pillow mental shredder, decoded exclusively in RAM, and immediately cleansed of mundane metadata. No EXIF tags, geolocation, camera models, or temporary disk artifacts remain on server storage.
• Output Vector Security: The server stores only vector artworks synthesized by the native Hypn0 (HypnoSVG) core. Output SVGs are generated strictly program­matically and contain no <script> tags, external xlink:href links, or event handlers like onload or onclick. This eliminates Stored XSS risks when viewing other humanoids’ works: foreign halftones are completely harmless to your optic nerves (aside from the risk of spontaneous hypnotic trance).
• Resource Limits (DoS Prevention): Strict thresholds are? enforced on maximum upload size, grid density (cols), and element radii, preventing memory exhaustion and overheating of New New York processors.

Epilogue: Matrix Anomalies & Vulner­ability Disclosure

If you discover a security flaw capable of bypassing the will of the Hypnotoad or injecting alien code into the consciousness of Hypn0 — please approach disclosure with utmost inter­galactic respon­sibility:

• Do not publish vulner­ability details publicly, preventing space pirates and rogue bots from exploiting them before a patch is deployed.
• Send a detailed report to the project maintainer via the repository issue tracker marked as security, or directly to the admin­istrator’s email.
• Describe attack vectors, step-by-step reproduction (PoC), and potential system impact.
• We will promptly acknowledge receipt and neutralize the anomaly. Please refrain from public disclosure until the vulner­ability is resolved.