Privacy Policy

In short

Kaomoji Garden works without an account. Browsing and copying kaomoji, symbols and emoji does not ask you for your name, email address or any other personal details. The pages do load a few outside services: Google Analytics, which counts visits, and Google AdSense, which shows ads, both of which use cookies; Cloudflare Web Analytics, which counts page views without cookies; and Google Fonts, which serves the fonts. Each is explained below. The optional Emoji combos features are the only part of the site that keeps anything about you on our own server: copy counts, and signing in with Google to submit, comment or sync favorites.

What your browser keeps

Your favorites, recently used items, language, kaomoji style and emoji skin tone are saved in your browser's local storage. They never leave your device, with two exceptions: the Emoji combo favorites you choose to sync after signing in, and the language, which is also kept in a cookie.

That cookie is named kao_locale. It holds only the code of the last language you used on this site (en, zh, zh-hans, ja or ko), applies only to the Kaomoji Garden pages under /kaomoji, and lasts one year. Your browser sends it to our server with each request for those pages, but the server does not use it, log it or keep it. www.pocketool.app/kaomoji/, the address without a language, is a page where you pick your language yourself; it does not send you anywhere on its own.

Two short-lived entries are kept in session storage, which your browser clears when you close the tab. kg_ec_reported lists the Emoji combos this tab has already counted, so copying one again is not counted twice (see “Emoji combo copy counts”). kg_ec_draft holds the combo you put together on the Kaomoji page until the submit page you open from there reads it, and that page deletes it straight away. It is never added to the page address. Once the submit page has it, it checks the combo against the ones already on the site, as it does for a combo you type, which sends the combo to our server; the combo is published only if you submit it.

Emoji combo copy counts

When you copy an emoji combo, your browser sends that combo’s ID to our server so we can rank combos by how many people copied them. To count each connection once a day, the server computes a one-way code from your IP address (for IPv6, only the first 64 bits, which identify your network), using a random key created for that day. Your IP address itself is not stored. The codes and the day’s key are deleted after two days, and once the key is gone nobody, including us, can work out which address a code came from. Our server records nothing else about the copy; the event Google Analytics receives is described under “Analytics”.

Signing in with Google (optional)

You only need to sign in to submit a combo, comment, or sync your Emoji combo favorites across devices. Sign-in uses Google Identity Services, and Google’s sign-in script is loaded only when you open the sign-in dialog. Once it has loaded, Google may set a cookie named g_state on this site’s domain to remember the state of its sign-in prompt.

We keep only the account identifier Google gives our site for your account, and your nickname. The nickname is assigned at random the first time you sign in (something like user-7f3a), you can change it under “Your account”, and it is shown publicly next to every combo and comment you post. We do not keep your name, email address or profile photo: your email address is only checked at sign-in to see whether you are an administrator, then discarded. A cookie named __Secure-kg_sess keeps you signed in for 30 days; it is required for these features and is not used for anything else. Apart from kao_locale (see “What your browser keeps”), it is the only cookie this site sets itself. The other cookies on this page are set by Google’s scripts.

Public content and moderation

Submitted combos and comments are public and appear as soon as they are sent, without prior review. The one exception is a comment containing a word on the site’s blocked list: it is held back from the thread until an administrator has looked at it. Everything else is moderated afterwards: anyone signed in can report something, and three reports that count hide it automatically until it is looked at. To raise a problem or ask for something to be removed, write to casper.lecturer@gmail.com.

Submitting a combo uses the same kind of daily code as copy counts: to allow at most five submissions per network per day, the server computes a one-way code from your IP address (for IPv6, only the first 64 bits, which identify your network) with that day’s random key. Your IP address itself is not stored, and the codes are deleted after two days. Comments do not do this.

When you submit a combo or post a comment, the page loads Cloudflare Turnstile to check that the request comes from a person rather than a script. For that check Cloudflare receives signals such as your IP address and your browser’s user agent. It is not loaded while you only browse. Cloudflare describes what it collects in its Turnstile Privacy Addendum: https://www.cloudflare.com/turnstile-privacy-policy/

Ads and cookies

This site shows ads through Google AdSense. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or to other websites.

Google’s use of advertising cookies, including the DoubleClick cookie on doubleclick.net, enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the internet. How Google uses information from sites that use its services: https://policies.google.com/technologies/partner-sites

Pages that load AdSense also load Google’s “Privacy & messaging” script, which may set cookies such as FCCDCF and FCNEC to record your privacy choices and the state of its messages. Visitors in the European Economic Area, the UK and Switzerland see Google’s cookie consent dialog there and can consent or manage their options; visitors elsewhere do not see it. Google Analytics is not controlled by that dialog.

You can opt out of personalized advertising in Google’s Ads Settings at https://www.google.com/settings/ads, and opt out of other vendors’ cookies for personalized advertising at https://www.aboutads.info/choices/. Blocking or clearing cookies in your browser works too: copying kaomoji, symbols and emoji does not need any cookie.

Kaomoji Garden is part of Pocketool, and the site-wide privacy policy covers ads and cookies in more detail: https://www.pocketool.app/en/privacy

Analytics

We use Google Analytics 4 on www.pocketool.app to understand overall usage, such as which pages are visited and which items are copied. A page view carries the full address, so what you type into the site search, which appears in the address, is sent too. Each successful copy sends an event with the kind of item (a kaomoji, a symbol, an emoji and so on), its category and a short code that tells us which item it was, never the text you copied. For an Emoji combo, that code is the combo’s public ID, the letters and digits at the end of its page address. Google Analytics sets its own cookies (named _ga, and _ga_ followed by an ID) to tell visits apart. We do not give it your name or email address. Google offers a browser add-on that turns Google Analytics off: https://tools.google.com/dlpage/gaoptout

Other services on every page

This site is hosted on Cloudflare, which automatically adds its Web Analytics script to every page as it delivers it. The script sends Cloudflare the page address and the page you came from (both without anything after ? or #), browser details, and performance figures such as load times and memory use, to count page views and measure page speed. According to Cloudflare it uses no cookies or localStorage and does not track individuals by IP address or user agent: https://www.cloudflare.com/web-analytics/

The fonts (Inter and Noto Sans TC) are served by Google Fonts, so when a page loads your browser downloads them from Google’s servers, and Google receives connection details such as your IP address: https://developers.google.com/fonts/faq/privacy

As the host, Cloudflare also handles connection details such as your IP address to deliver pages and block attacks.

Keeping and deleting your data

A sign-in lasts 30 days, and the codes used for copy counts and the daily submission cap are deleted after two days. A submission that never joins the ranking and that nobody copies or reports stops being public after 180 days; its row is kept, so the same combo cannot simply be posted again. Your account (its identifier and nickname) is kept until you delete it: sign in, open “Your account” and choose “Delete account”. That deletes your sign-ins, your comments, the reports you filed and the favorites synced to your account.

Deleting your account does not delete the combos you submitted. A combo that has joined the ranking stays public, with your nickname and the title and note you wrote removed; one that has not is hidden. A combo joins the ranking once it has been copied on two different days, by anyone, or once the site has given it a theme and English and Chinese titles. So even a combo the site never wrote anything for stays public after you delete your account if it was copied on two different days; it just no longer shows your nickname, title or note.

If an account suspended for breaking the rules is deleted, a one-way hash of its Google account identifier is kept, with no end date set, so the same account cannot sign up again.