Privacy

Short version: this site has no analytics, no cookies, no tracking scripts, and no accounts. Nothing you do here is tied to you as a person, because there is nothing here that knows who you are.

The longer version is below, because “we value your privacy” is what every site says and none of them mean. Everything here is a description of something the site actually does, and you can check most of it yourself with your browser’s network tab.

The short version

• No analytics. Cloudflare Web Analytics is switched off. There is no tracking script on any page.
• No cookies. The site sets none. Not one.
• One thing is stored in your browser: a timestamp that keeps the background animation from restarting on every page. It disappears when you close the tab.
• Downloads are counted, but only as “this file, on this day, this many times”. Those counts are public.
• Searching happens on your device. Your search terms never leave it.
• Cloudflare hosts the site and sees ordinary web-server information, the same as with any website.
• The contact page uses a Turnstile check to keep scrapers off an email address. That is the one place a third party is involved.

What is stored in your browser

One value, called pngu:bg-epoch.

The background of every page is a slow animation. Without this, it would jump back to the start each time you opened a new page. So the site writes down a single number (the moment the animation started) and reads it back on the next page so the motion continues where it left off.

It is a timestamp. It is not an identifier, it is not sent anywhere, and it is kept in sessionStorage, which your browser throws away when you close the tab. If you have storage disabled, or you are in private browsing, writing it fails and the animation simply starts fresh. Nothing else changes.

There are no cookies, no localStorage, and no fingerprinting.

Download counts

Every model file on this site is counted when it is downloaded, and the counts are published at stats.pngu.info. You can look at exactly what is recorded, because it is the same page the site owner looks at.

What a download stores is one row of three things:

The file	The day	How many
files/can-suppressor/2x Torx.stl	2026-08-28	4

That is the whole record. There is no row for your download specifically. Your download makes a number go up by one, and that is all that happens.

What is deliberately not stored:

• No IP address
• No browser or device information
• No referrer, meaning where you came from
• No location
• No session, cookie, or visitor ID
• No time more precise than the calendar day, in UTC

This is not a policy choice that could quietly change; it is the shape of the table. There is nowhere to put an IP address even if someone wanted to. That is also why the counts can be public without asking anyone’s permission: a number of downloads per file per day cannot be traced back to a person.

Two honest footnotes. Opening the 3D preview of a model is not counted as a download; only actually taking the file is. And the counts are a floor rather than a total: if you download the same file twice, your browser usually serves the second one from its own cache without ever asking the site, so it cannot be counted. Nobody is being followed around to fix that.

What Cloudflare sees

The site is hosted on Cloudflare, and the files are stored in Cloudflare R2. This is the part that is not really optional: every website you visit is handled by a server, and the server sees the request.

For an ordinary page view or file download, Cloudflare handles the connection and can see the usual things any web host sees: your IP address, the time, which page or file you asked for, and what your browser said it was. It uses this to deliver the site and to block attacks and abuse. This happens at the network level, before anything this site controls.

Two things worth being clear about:

• Cloudflare Web Analytics is turned off for this site. That is the optional product that would build visitor charts, and it is not enabled, so there is no per-visitor reporting to look at.
• Basic request and storage information still exists at the infrastructure level, including for downloads from R2. That data belongs to Cloudflare and is governed by their privacy policy, not by this page. It is not read, exported, or combined with anything else here.

If you would rather a host not see your IP at all, that is what a VPN or Tor is for, and the site works fine through either.

The contact page

The contact details are behind a Cloudflare Turnstile check, the box that confirms you are a person. It is there for a dull reason: an email address published in plain HTML gets scraped and buried in spam within days.

Turnstile is the only third-party thing loaded anywhere on this site, and only on /contact. To do its job it runs a script from challenges.cloudflare.com and looks at browser signals to judge whether you are automated. Cloudflare describes it as privacy-preserving and says it does not use it to track people across sites; it is still Cloudflare’s product, and their privacy policy covers it.

When you pass the check, the site’s server confirms your token with Cloudflare. As part of that confirmation it passes along your IP address, which is an optional signal Turnstile uses to judge whether a token is genuine. Your IP is not stored by this site.

Worth knowing: the contact page has no form. There is no name field, no message box, nothing to submit. Passing the check simply reveals an email address and a Discord handle. You are not sending anything to anyone until you choose to write to one of them yourself, in your own email client.

Search

The search bar is the navigation on this site, and it runs entirely on your device.

When you first search, your browser downloads one file containing an index of every page. From then on, every keystroke is matched against that index locally. What you type is never sent anywhere. There is no search server to send it to, and no log of queries, because none are ever received.

Images, models and downloads

Pages, images, 3D previews and model files are all served from Cloudflare: pages from pngu.info, files from assets.pngu.info. Loading a page or opening a 3D preview fetches from those, which means the normal request information described above applies. Nothing else is contacted.

Fonts are served from this site rather than from Google Fonts, specifically so that reading a page does not tell a third party you did.

Links to other sites

Some pages link out to Printables, Out of Darts, YouTube, and similar. Those links are marked so that the destination is not told which page you came from.

Once you follow one, you are on someone else’s site under their rules, and nothing on this page applies there any more.

What never happens

• No advertising, and no ad networks
• No third-party analytics or tracking pixels
• No accounts, logins, or profiles
• No newsletter, and no email collection
• No data is sold, shared, or traded, because there is none to sell
• No embedded videos or social widgets that would load third-party code