Privacy
Updated 17 October 2026
What this project does
timetravel.fyi is an art project that helps you discover videos hosted on YouTube. There are no visitor accounts, and the application does not save your watch history or use it to personalize recommendations. Selection uses video metadata, including filename matches and view counts.
The application removes an old local watch-history entry, if present, without reading it. Playback and sound preferences are held in memory during your visit. Your browser may cache site files. These statements concern this application; YouTube and Cloudflare process data separately as described below.
YouTube videos and thumbnails
On the video pages, the player loads and attempts to play automatically, initially muted. There is currently no consent screen before YouTube connects. Thumbnails come directly from YouTube’s image service, and the player API loads from YouTube. These connections send technical information such as your IP address, browser information, and request details to Google/YouTube.
The player uses YouTube’s privacy-enhanced domain, youtube-nocookie.com. This does not mean that no data is processed or that consent is unnecessary. YouTube may use browser storage and process playback activity under its own policies. Google explains how privacy-enhanced mode changes personalization in its embedding documentation; see also the Google Privacy Policy.
Thumbnail colors used for the travel animation are sampled in your browser. The project does not upload those color samples or rehost the videos. These legal pages contain no YouTube embeds, external fonts, or analytics scripts.
Hosting and security
Cloudflare delivers the site and runs the contact API. Requests pass through its infrastructure, which processes connection information such as IP addresses, request URLs, browser information, and timestamps to deliver and protect the service. Provider logs and their retention depend on Cloudflare’s services and the operator’s account settings; a fixed retention period has not yet been confirmed. See Cloudflare’s Privacy Policy.
For contact-form abuse prevention, the server derives a keyed hash from your IP address to bind a short-lived form token and apply rate limits. Form tokens expire after ten minutes. The application does not save the raw IP address, this hash, or the token in the stored contact message. This does not remove data processed separately by the hosting provider.
Contact messages
If you use Contact, we ask for your email address, a category, and your message. The current video’s ID may be attached for context. The record also includes a message ID and submission time. We use this information to handle your request, reply, investigate video-removal reports, and prevent abuse. Do not send passwords or unnecessary sensitive information.
Messages are stored in a private Cloudflare R2 bucket accessible through the operator’s authenticated account. There is no public inbox. Submissions are not published or used for marketing, and the website does not automatically send email notifications.
Retention is currently manual: contact records remain until the operator deletes them; no automatic deletion schedule is configured. A specific retention period and review process still need to be set. You can request deletion through Contact, subject to any applicable legal obligation to retain relevant records.
Legal bases and international processing
The purposes of our own processing are operating and securing the site and responding to messages. Where the GDPR applies, the operator must confirm and document the appropriate legal bases, including any reliance on legitimate interests for these purposes, and describe the chosen bases here. Any legal obligation relied on for a particular request must also be identified. No blanket consent is inferred from simply visiting this site.
Cloudflare and Google operate internationally, so data may be processed outside your country, including outside the European Economic Area. The operator still needs to confirm the applicable provider agreements, processing locations, and transfer safeguards. We do not promise EU-only storage.
Your choices and rights
You can close a video page to stop further playback requests and use your browser’s privacy controls to manage third-party storage. To ask about personal data handled by this project, request access, correction, deletion, restriction, portability where applicable, or object to processing, use Contact. If processing relies on consent, you may withdraw it without affecting earlier lawful processing. Rights depend on the applicable law and circumstances.
Where the GDPR applies, you may complain to a supervisory authority, including one in the country where you live or work or where you believe an infringement occurred. The operator’s lead or local authority has not yet been identified. The European Data Protection Board’s authority directory lists EU/EEA authorities.
For data processed by Google under its own policies, use Google’s privacy controls and request channels. Changes to this project’s data practices will be reflected here.