Privacy Policy

Last updated: September 2026

Legends of Kurmatu is one person’s world, run by F.C. Marrow at kurmatu.com. This policy covers this website and nothing else.

What I Collect

The search box on the characters page never leaves your browser. It filters a list that is already loaded on the page. Nothing you type into it is sent anywhere, logged, or seen by me.

The rest of this page is the contact form, and then the handful of ordinary technical things any website touches, written out rather than left implied.

When You Use the Contact Form

If you send a message through the contact page, I get the four things you typed: your name, your email address, the subject you picked, and your message. Nothing else is attached to it and nothing is collected in the background while you type.

That is used to read your message and reply to you. It is not sold, not shared, not added to any list, and not used for anything else. There is no list to add it to.

How it reaches me. This site has no server of its own, so the form is delivered by FormSubmit, a third-party service that takes what you typed and forwards it to my inbox as an email. Your message passes through them purely to get to me, under FormSubmit’s privacy policy. Nothing is stored on this website, because this website has nowhere to store it.

If you would rather not involve a third party at all, write straight to hello@kurmatu.com. It is the same inbox and it reaches the same person.

How long I keep it. Messages stay in my inbox as long as they are useful to have, which for a conversation that ended is not long. Ask me to delete yours and it is deleted.

What the Host Records

This site is hosted by Vercel. Like any web host, their servers keep short-lived technical logs when a page is requested, which can include an IP address, the browser and device type, the page asked for, and the time. That is how a server delivers a page and defends itself from abuse.

Those logs belong to the host and are handled under Vercel’s privacy policy. I do not read them, export them, or use them to build any picture of who visits.

No Analytics

Worth stating on its own, because most sites have it and this one does not. There is no analytics on this site at all. No Google Analytics, no Vercel Analytics, no page-view counter, no pixels, no advertising or conversion tags, and no third-party scripts of any kind. Nothing here follows you between sites, because nothing here is watching you on this one.

No Cookies

This site sets no cookies. Not tracking cookies, not advertising cookies, not functional cookies. There is no consent banner because there is nothing to consent to.

Typefaces

The lettering on this site is loaded from Google Fonts. That means your browser makes a request to Google’s servers for the font files, and Google therefore sees your IP address and general browser information as part of that request, the same way it does on a very large number of sites.

Google states that it does not use these requests to build advertising profiles and sets no cookie for them. That is their statement and not mine to guarantee, and it is handled under Google’s privacy policy. I am listing it because it is the one connection this site makes on its own, without you clicking anything, and I would rather name it than let you discover it.

What Your Browser Keeps

Separate from cookies, the site stores two small things inside your own browser. Neither one ever leaves your device, neither is sent to me, and neither contains anything that identifies you.

• That you passed the age check for the current tab, so that answering it does not immediately ask you again while the page reloads. It is deleted the moment the page reads it.
• Which background plate the front page showed you last, so the next visit opens on a different one instead of the same picture every time. It is a number.

The site can also be installed as an app, and if you install it a service worker keeps a copy of the pages in your browser’s cache so it works with no connection. That cache is on your device, is visible only to you, and holds pages from this site and nothing about you.

Clearing your browser’s site data removes all of it. The only consequence is that the front page forgets which picture it showed you.

The Age Check

The gate on the way in asks whether you are eighteen. Your answer is not recorded, not counted, and not remembered beyond the session you are in, which is why it asks again on a later visit. It exists to put the warning in front of you before the world is, not to keep a register of anybody.

Children

This site is for adults and is not directed at children. I do not knowingly collect personal information from anybody, which includes anybody under 13. If you believe a child has somehow sent me something, write to hello@kurmatu.com and it will be deleted.

Where Any of This Is Processed

I operate from Thailand. The three services this site touches, the host, the font provider, and the form deliverer, run servers around the world, including in the United States and the European Union. A request from your browser, and a message you send through the form, may therefore be handled outside your own country, under data-protection rules that may differ from yours.

Security

The site is served over HTTPS, and the form posts over it too. Beyond that, the strongest privacy measure here is structural: this website has no database and no account system, so there is no store of personal information sitting on it to be lost, leaked or handed over. A message you send becomes an email in an inbox, which is as secure as email ever is, and no more.

Your Rights Under Thailand’s PDPA

I operate from Thailand and handle personal data in line with Thailand’s Personal Data Protection Act. Where it applies, you have the right to access the personal data held about you, correct it, have it deleted, restrict or object to its processing, withdraw consent, ask for it to be transferred, and complain to the relevant authority.

In practice there is very little to exercise those rights against, because this site holds nothing. If you have written to me, through the form or straight to the inbox, that message is personal data and those rights apply to it in full. Write to hello@kurmatu.com and say what you want done with it.

If You Are in the UK, the EU, or Anywhere Else

If the UK GDPR, the EU GDPR, or a comparable law where you live gives you the equivalent rights, those will be honoured the same way and by the same route: access, correction, deletion, restriction, objection, portability, and withdrawal of consent. You will not be asked to prove which country you are in first.

If a law where you live gives you a right that is not listed here, ask for it anyway. The answer is far more likely to be yes than no.

Emails You Send Me Directly

The same as the form, and simpler. Write to me and I have your address and whatever you put in the message, because that is what an email is. It is used to reply to you and nothing else, it is never sold or shared, and it is never added to a mailing list, because there is no mailing list. Ask me to delete it and it is deleted.

Who Is Responsible

The person responsible for this site and for anything it touches is F.C. Marrow, operating from Thailand, reachable at hello@kurmatu.com or through the contact page. There is no data-protection officer and no support desk, because there is no company between you and the person who wrote this. Both routes reach me.

Mature Content and Age

This site is for adults, carries an age gate, and contains material described in full under the Terms of Use. Nothing about that changes what this page says: the site still collects nothing from you, whatever age you are.

Leaving This Site

Some of what this site links to is also mine. Focal Comics, fcmarrow.com and MarrowMyth are run by the same person who runs this one.

This policy still stops at the edge of kurmatu.com. Those sites each have their own privacy policy and they say different things, because they do different things. A site with accounts, a store or a membership handles more about you than a site with no form at all, and this one is the quiet end of that range. Read the policy on whichever one you land on.

Anything else linked from here belongs to somebody who is not me, and their practices apply once you arrive.

Changes

If this ever changes, so does this page and the date at the top of it. If the site ever starts collecting something, this page will say so before it does, not afterwards.

Contact

Questions about privacy, or a request to see or delete what I hold, go through the contact page or straight to hello@kurmatu.com. Same inbox either way.