Mud News Package · Updated 24 October 2026
Privacy
Who operates this site
Mud News Package is the publishing site of Manuel A. Dominguez. This notice covers reading, reader discussion, direct book orders and contact with the publisher.
Reading and search
Dictionary searches run in your browser. The site does not send your search text, selected passages or reading position to the publisher. Page visits and buy-button clicks add 1 to daily totals that hold only labels and a count: a broad page group, the source the visit is credited to (for example Instagram, a search engine, an AI assistant or none, taken from the link’s utm_source or the kind of site you came from), a link’s utm_medium class, whether the screen is phone-sized or larger, and for buy clicks the edition or store chosen. So that later clicks in the same visit are credited to that source, your browser keeps the source label in this tab’s session storage, which is cleared when the tab closes. The referring address itself, your IP address, cookies and your reading history are not stored in these totals, and automated browsers are not counted. Known search and AI crawlers are counted by name only. When you press a buy button, the same source label (for example “src_instagram__social”) is added to the Stripe checkout link, so a paid order can be counted under the source that brought the visit; it says nothing about you. These totals feed daily and weekly business reports and order alerts for the publisher’s marketing team, which contain counts and totals only. The site has no advertising pixel or reader account, and no Klaviyo script runs on its pages.
Companion games
Game starts, completions and the ending’s chapter and edition links add to daily aggregate counters by game, source label and medium only. These counters contain no commands, choices, save contents, reading history, device label or reader identifier. Four local yes/no flags prevent repeat counts for the current run; replay resets them. Game progress and those flags stay in this browser until its site data is cleared. Reloading a completed save does not create a new completion. Standalone game packages send no telemetry. Outbound package links carry only the platform source and medium labels. Edition links and Amazon clicks are not purchases; only confirmed direct orders are counted as sales.
Reader discussion
The Commons has no account and asks for no email address. To post, you choose a public display name. Your name, posts, replies, reactions and join month become visible to other visitors, together with simple counts of your posts, the badges you have earned and any favorite book or character you choose to add. Badges are worked out from your approved posts and the reactions other members give them; nothing extra is collected for them. To limit spam, repeated sign-ups and duplicate reports, the site derives a one-way identifier from your IP address, browser information and the day; the identifier changes daily, but each stored identifier remains attached to its post or report until that record is removed. This is moderation data, not an advertising profile. Before a post or reply is published, its text is checked by an AI safety model (Llama Guard 3) on Cloudflare Workers AI; under Cloudflare’s terms, the text is not kept after the check and is not used to train AI models. The site stores only the outcome for a held post (the flagged category, such as hateful content) so that a moderator and you can see why. No decision is final without a person: flagged posts wait for a moderator.
Child-safety holds and reports
Every Commons post is checked automatically before it appears. If a post appears to involve the sexual exploitation of a child, it is not published. It may be held, encrypted, in a separate store that only the site operator can open, together with the time, the display name and member number it was posted under and the IP address it came from. The operator reads it and, where it appears to break US law, reports it to the CyberTipline of the National Center for Missing & Exploited Children (NCMEC) with that information. NCMEC makes reports available to law enforcement. Federal law (18 U.S.C. § 2258A) treats a report as a request to keep the reported material for one year. Held posts that are not reported are deleted seven days after review.
Age question
Before you join, the Commons asks for your birth month and year. People under 13 cannot join; the site then stores nothing about the answer, and your browser keeps a note in its local storage that joining was declined, with no date or other detail, until you clear this site’s data. If you are 13 or older, the site stores only that your age was confirmed and the month of that confirmation. It never stores your birth date.
Your Commons profile and Reset
Your profile lives in your browser only. When you join, the server creates a random secret and your browser keeps it in local storage together with your name and optional favorites. The server stores only a salted hash of the secret, your name, your join month, your favorites, your post counts and the end of a 24-hour slow-posting period for new members. If you clear your browser’s site data or change device, you lose access to the profile, and there is no recovery. “Reset” on your profile page deletes the profile, its badges and its reactions, frees your name, and keeps your posts, shown as from a “former member”. Resetting is your responsibility and cannot be undone. Moderator removal of a name works the same way. To have a post removed, contact the publisher.
Mailing list
The mailing list is optional and needs confirmation. Each sign-up form on this site has a consent box that starts unticked. Only when you tick it and press Join the list does your browser send the address you enter to Klaviyo, the publisher’s email-marketing service; nothing from Klaviyo loads on the page before that. Klaviyo emails you a confirmation link, and the address joins the list only after you confirm. Klaviyo keeps the address, its subscription status, the dates and the form you used, and sends the mailings. Mail is occasional news of the books, no more than once a month. Every email carries an unsubscribe link that works at any time without signing in. You must be 13 or older to join. Addresses that joined through the site’s earlier form before 11 October 2026 are also kept in the site’s own database with their status, the dates and the wording agreed to, and their unsubscribe links keep working.
Music likes
On the Music page you can like a track. Your browser keeps a random liker identifier in local storage; the site stores only a salted hash of it with each like, so one browser counts once per track and pressing again takes the like back. To limit mass liking, each like also stores a one-way identifier derived from your IP address and the day, which changes daily. Only the total for each track is shown to other visitors. Clearing your browser’s site data removes the identifier; likes already given stay counted.
Direct purchases and delivery email
Stripe collects the checkout information needed for your payment and supplies the publisher with order information. The delivery service uses your checkout email address to send your books through Resend. Resend receives that address and the email contents, including the private download link. The publisher’s delivery database stores order and payment references, the edition, amount, currency, dates, email delivery status, download format and time, and hashes of the email address and access key. It does not store your full card number or security code.
Retention
Download access expires after 90 days; that is not a deletion date for purchase records. Order, payment-event and download records currently have no automatic deletion deadline and support past purchases, replacement access and dispute handling. Posts and reports remain until removed by moderation or by a deletion request; Reset removes your profile and name, not your posts. Mailing-list addresses are kept, by Klaviyo and for earlier sign-ups by the site, while subscribed and, after you leave, only to make sure the address is not mailed again; ask the publisher to delete that record entirely. Aggregate counts and moderation decision records also have no automatic deletion deadline. You can request access, correction or deletion by contacting the publisher; records needed to resolve an order or meet an applicable legal obligation may need to be retained. Stripe, Resend, Klaviyo and hosting providers have their own retention practices.
Hosting, browser storage and external services
The site is hosted on Cloudflare. Cloudflare Workers serves the pages, Cloudflare D1 holds the site’s database (orders, Commons posts, earlier mailing-list sign-ups and the daily totals described above) and Cloudflare R2 stores the paid book files. Cloudflare processes request information, which can include IP addresses, browser details and requested URLs, for delivery, security and operation, and may set operational cookies. The site’s pages do not load Klaviyo’s script or set Klaviyo cookies. When you tick a sign-up form’s consent box and press Join the list, your browser sends Klaviyo the address you entered, the page you joined from, your IP address and browser details. If you open a link in a Klaviyo email, Klaviyo records that click under its own policies. The site sets no advertising cookies. Farbound: Ward 7 in the browser (/games/farbound/play) is served from the site itself; its saves, settings and a local playtest log stay in this browser’s storage and are not sent to the publisher. The Games page can show the itch.io widget for the Farbound: Ward 7 playtest, but only after you press “Show the itch.io widget”; until then the page loads nothing from itch.io. Once you press it, the widget is served by itch.io (Itch Corp), which receives your IP address and browser details and runs Google Analytics in it, setting Google Analytics cookies such as _ga, under itch.io’s own privacy and cookie policies. Its browser storage holds your Commons profile secret, name and favorites in local storage, plus a separate preference for each book when you dismiss its mailing-list invitation. The invitation preference stays in this browser until you clear its site data and is not sent to the publisher. For that browser session only, it also holds the source label of your visit; the note that joining was declined is kept in local storage, as described under Age question. Klaviyo, itch.io, Stripe checkout, optional Stripe Link services, Amazon and the publisher’s social accounts (Instagram, Threads, TikTok, Facebook, X and YouTube, linked but not embedded) operate under their own privacy and cookie notices when you visit them. They may process data outside your country.
Bot check (Cloudflare Turnstile)
To keep automated spam out of the Commons and the music likes, the site uses Cloudflare Turnstile. When you join the Commons, start a thread, reply, report a post or like a track, your browser loads a check from challenges.cloudflare.com; it does not load before that. Cloudflare processes technical signals such as your IP address, browser user agent and connection details to tell people from bots; it does not read what you type. Cloudflare processes these signals for the site to protect it, and also as its own controller to improve its bot detection, as set out in its Turnstile Privacy Addendum (https://www.cloudflare.com/turnstile-privacy-policy/). The site receives only a pass or fail result. Once the check has loaded, that page sends only its address of origin (mudnewspackage.com), never the full page address, to other sites you open from it.
Do Not Track and Global Privacy Control
This site does not track you across other websites and does not sell or share personal information for advertising, so it treats every visitor the same whether or not your browser sends a Do Not Track or Global Privacy Control signal. The one third party that can track across sites is the itch.io widget described above, and it loads only after you press its button.
Changes to this notice
When this notice changes, the date at the top of the page changes with it.
Contact and privacy requests
Email links open your mail application. If you contact the publisher, your email address, message and any attachments are handled through email services to answer your request. Write to manueladominguez@mudnewspackage.com for access, correction, deletion or an objection concerning your data. Include enough information to locate the relevant order or post, but never send card numbers, passwords or private download links. Requests may require verification. Rights and any right to complain to a data-protection authority depend on the law that applies to you.