Privacy notice
This site asks you for nothing. There is no form, no mailing list and no account: the only thing it sets out to collect about you is visit statistics through Google Analytics, and only if you say yes to them. This notice explains that, and the two other things worth declaring — what the Gallery page loads from Steam, and the access log the web server keeps. It is written under Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679.
What changed on 5 September 2026. Until this version the site collected email addresses, to write to you when the Steam page opened and again at release. The Steam page is open, so the list has no reason to exist: the form and the endpoint behind it are gone, and the addresses collected under the previous notice have been deleted. Nothing was passed to anyone before they were.
And on 6 September 2026. Rereading this notice against the code that it describes turned up three places where it said less than the truth, and one where it promised more. The section on the Gallery now names every field the server receives from Valve, including the account numbers it never passes on; the summary below no longer claims that nothing is loaded from elsewhere, because the Workshop previews are; and the retention of the analytics data is stated as the rule that governs it, because that setting lives in Google's console and not in anything you or we can read here. The promise that was too large — that an item taken down leaves this page within ten minutes — was kept by changing the server, not the sentence: it now refuses to show a list older than six hours.
Who is responsible
Fractaria is published under the name Tears in Rain Studio. That is a trading name, not a separate company: behind it there is one person, and that person is the data controller — Ezio Del Vecchio, a private individual, reachable at info@dware.it. If you write to either name you are writing to the same place. There is no Data Protection Officer: the processing described here is small enough not to require one.
Cookies and analytics
This site uses Google Analytics 4 to count visits and see which pages people read. It runs only if you agree to it.
Nothing happens before you choose. Until you accept, no Google script is loaded, no cookie is written and no request leaves your browser for Google — not a reduced version, none at all. The banner is the whole gate. Declining costs you nothing: the site behaves exactly the same.
If you accept
- What is set: the cookies
_gaand_ga_K7HPN6K4VS, which hold a random identifier. It keeps two page views in the same visit from being counted as two people and, because the cookies last 2 years, it is also what lets Google tell a browser coming back from one arriving for the first time. It is tied to the browser, never to a name. They expire after those two years, or as soon as you decline — declining also deletes them. - What is measured: pages viewed, how long, roughly where in the world you are (country or city, from your IP), the kind of device and browser, how you arrived (search, link, direct), and — from Google's default measurement, which we leave on — how far down a page you scroll and which links you follow off the site. Google Analytics 4 does not store your IP address: it is used to derive the approximate location and then discarded.
- What is not done: no advertising features, no remarketing, no Google Signals, no cross-site tracking, and no user-provided data — there is no address here to send, and no name attached to any of it. What ties one visit to another is the cookie above, and nothing else.
- How long: event data is deleted on the schedule set on the Analytics property itself — Google offers 2 months or 14, and 2 months is the default. That setting lives in Google's console, not in this site's code; write to info@dware.it and we will tell you which of the two is in force.
Legal basis: your consent, Article 6(1)(a) GDPR, and Article 122 of the Italian Privacy Code for the storage itself. Recipient: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, acting as our data processor; data may be transferred to Google LLC in the United States under the EU–US Data Privacy Framework, to which Google is certified. Google's own notice is at policies.google.com/privacy.
Changing your mind
You can switch either way at any time, from the same banner you answered the first time. Withdrawing has to be as easy as giving, and here it is the same two buttons, side by side and the same size. This brings the banner back:
You can also block it from your side, with Google's opt-out add-on or by clearing this site's cookies in your browser.
The community gallery
The Gallery page shows fractals published to the Steam Workshop by people using Fractaria. The list is fetched by this site's own server, so your browser does not talk to Valve to get it. What comes back from Valve is public Workshop data — for each item, its Workshop id, its title, the address of its preview and the SteamID64 of whoever published it. To turn those account numbers into names the server asks Steam once more, and that reply is the whole public profile card — profile address, avatars, country and real name where the person has filled them in — of which the server reads the display name and nothing else.
Four fields per item then go into a file the server writes for itself, so it does not have to ask Steam at every visit, and on to your browser: Workshop id, title, preview address and that name. The account numbers are written nowhere and never reach your browser. The server reuses that file for ten minutes; after that, the next visit that reaches Steam overwrites it with a fresh list. Nothing deletes it — the last list fetched stays on the server's disk until a visit replaces it. The endpoint that answers your browser opens no session, sets no cookie and records nothing about who asked.
If you published from inside Fractaria, the name shown here is your Steam profile name; take the item down on Steam and it leaves this page at the next refresh — at most ten minutes on the server, and up to two minutes more while your browser reuses the copy it already has. If Steam stops answering, the server goes on showing the last list it received for up to six hours, and then shows nothing at all rather than something that may no longer be there. That is the part written under Article 14 — data about people who never came to this site.
The preview images are a different matter: they live on Steam's content network — Valve's own domains and the Akamai network that delivers them — and while that part of the page is showing them your browser requests them directly. Those servers see your IP address, your user-agent and the fact that the request comes from fractaria.app, as they would for any image on any site.
It is the only third-party content on this site besides Analytics, it carries no cookie of ours, and it is not used to measure anything. That is not only a promise: the site sends a Content-Security-Policy that allows scripts only from this site and Google's tag server, and images only from this site and Google's and Valve's networks. Our own server throws away any preview address that is not https on one of the four hosts Steam serves previews from. If the gallery is empty — as it is until the Workshop has something in it — no such request is made at all. Valve's notice is at store.steampowered.com/privacy_agreement.
What else the site does
Everything else is served from fractaria.app itself — the six font files, the stylesheets, the scripts and every image the site draws itself. No font service, no embedded video, no social widgets. Two things do come from elsewhere, and they are the two described above: Google's tag script, which loads from googletagmanager.com and only if you accepted it, and the Workshop previews on the Gallery page, which come from Valve's and Akamai's servers. Your cookie choice is remembered in your browser's local storage — it stays on your device, is never sent anywhere, and disappears when you clear the site's data.
The web server also keeps standard access logs (IP address, time, requested page), as every web server does, for security and diagnostics. Our hosting provider writes them on our behalf and keeps them only as long as its own log rotation does; the legal basis is our legitimate interest in running a site that stays up and is not attacked, Article 6(1)(f) GDPR. They are never used to identify a visitor, and — unlike Analytics — there is no way to decline them: a server that answers a request has to see where the request came from.
Your rights
You can, at any time and free of charge, ask us to:
- Confirm what we hold about you, and give you a copy of it (Art. 15).
- Correct it if it is wrong (Art. 16).
- Delete it (Art. 17).
- Restrict or object to the processing (Art. 18 and 21).
- Receive it in a portable format (Art. 20).
- Withdraw your consent (Art. 7(3)) — for Analytics that is the button above, and it does not affect the lawfulness of anything done before you withdrew it.
Write to info@dware.it and you will get an answer within 30 days. If you are not satisfied, you may lodge a complaint with your national supervisory authority — in Italy, the Garante per la protezione dei dati personali.
Buying the application
Fractaria is sold through Steam. That purchase happens on Valve's platform under Valve's own terms and privacy policy, with Valve as an independent controller of the data involved. We never receive your payment details. Adding Fractaria to your wishlist tells us nothing about you: Steam reports wishlists and sales to us as totals. Following the Steam link from this site is different — if you accepted Analytics, that click is counted as an outbound click, like any other link you follow from here.
Changes to this notice
If this notice changes, the date and version at the top change with it. Changes that affect what we do with data already collected would require asking you again, not quietly editing this page.