Effective 2026-08-30. Short version: your timer stays on your device. If you actively mark that your personal weekly window just reset, the site accepts a minimal anonymous observation to calibrate reset detection; it cannot confirm resets during this calibration period.
What stays local. Reset times and notification preferences are saved under the codexreset.v1 localStorage key. Your vigil membership — the cycle you prayed in, your sequence number, and your generated pilgrim name — is saved under codexreset.v1:pray. Those timer and vigil records are not uploaded as records; clearing browser data removes them from that browser, but it does not remove an already accepted prayer from the public cycle records.
Analytics. The site has no sign-up. It loads Cloudflare Web Analytics and Google Analytics 4 to understand aggregate site use. Google Analytics may set first-party analytics cookies and send page, browser, device, and network-derived information to Google; the tag is not used to sign visitors in. You can block or clear analytics cookies through your browser. The credited community video on /tibo is served as a same-origin static file, so playing it does not contact X; only following the original-post credit link leaves this site.
Server processing. The site runs on Cloudflare Workers; Cloudflare processes standard request metadata (IP, user agent) to serve and protect the site. The /api/pray endpoint accepts one prayer per person per reset cycle. To enforce that without keeping addresses, the Worker stores a salted one-way hash of the request IP for up to 45 days; the raw IP is never written into application records, responses, or the public page. The request IP itself is additionally used, transiently, by Cloudflare's rate-limit binding.
Reset calibration. The anonymous observation is sent only when you actively choose “My weekly window reset” and the tracker already has a personal reset time. The browser sends the action time, the remaining milliseconds on that previous personal window, and a random pseudonym that rotates each UTC day; it sends no account identifier or credentials. At the edge, the action time is rounded to a 15-minute bucket, the remaining value is reduced to a coarse range, and a one-way hash of the daily pseudonym is used in a deterministic key so at most one sample is retained for that pseudonym on that UTC day. The stored sample contains only that 15-minute bucket and coarse range and expires after 14 days. The exact action time, raw remaining value, raw pseudonym, and request IP are not written to application storage; Cloudflare's rate limiter uses the IP transiently. These observations are shadow data only and do not confirm or change a reset, forecast, alert, or public counter.
Notifications. In-page notifications are optional, fire only while the page is open, and can be revoked any time in your browser's site settings.
Push notifications. If you explicitly turn on push notifications, your browser creates a push subscription and this site stores the subscription endpoint URL it issues, the time you subscribed, your page language, and whether the active Service Worker can safely render the full alert scope. That endpoint is a per-device identifier; no name, email, account, IP address, or user agent is stored with it. Alert content does not travel through the push service: the push message carries no payload, and your browser fetches the latest selected details from this site when it wakes, so the wake is not a promise that every Event will render separately. Alert v3 owns post-fence regular Reset and strong Watch delivery; historical events at or below the cutover fence do not replay. Compatible subscriptions wake for a regular global Reset, an 83%/93% strong Watch, or a qualifying global banked lifecycle update on its separate banked route. Model-only forecasts and silent context do not notify. Turning notifications off in the control, or revoking the permission in your browser, deletes the stored subscription and compatibility marker; endpoints that the push service reports as expired are deleted automatically.
Email alerts. Email subscriptions are handled by the separate noindex companion at notify.codex-reset.com. It uses Cloudflare Turnstile and double opt-in. An address is HMAC-hashed for private lookup and encrypted with AES-GCM only while the request is pending or active; unsubscribe, hard bounce, complaint, or provider suppression clears the ciphertext immediately. Delivery receipts and provider event IDs exclude the address, and messages use no open or click tracking. The companion publishes its own Privacy and Terms pages.
Public data. The announcement radar republishes short excerpts of public posts for commentary and news reporting. An accepted prayer publishes a generated pseudonym, a sequence number, and a coarse location (country and, when available, city from Cloudflare's edge metadata) on the public vigil wall, alongside aggregate cycle totals. No surface publishes your IP address or any account identity.
Questions or removal requests: open an issue via the contact line in the footer.