Privacy Policy

Thankot.com is published by the Thankot.com Heritage Project, a small editorial project based in Thankot, Chandragiri Municipality, Kathmandu district, Nepal. It is independent: it is not run by the municipality, by the Chandragiri cable car company or by any temple committee.

The person responsible for data on this site can be reached at contact@thankot.com.

There are exactly three ways data reaches us.

1. The contact form. Your name, email address, subject and message. You choose what to put in it. It goes to our inbox and nowhere else.
2. Analytics. Google Analytics 4 records which pages were viewed, roughly where in the world the request came from, the referring site, and the device and browser type. It is aggregate: we can see that 400 people read the cable car page yesterday, not who they were.
3. Server logs. Like any web server, ours records IP addresses, request paths, timestamps and user agents. Those logs drive the rate limiter and the request origin checks that keep the contact form from being used by spam scripts.

We do not ask for a date of birth, a phone number, a postal address or a payment method, because there is nothing on this site to pay for. There are no accounts to create.

This site loads Google Analytics 4 under the measurement ID G-T0G2MVEPYK. The script is loaded from googletagmanager.com only on the live site; it does not run in development. It sends a page view event on the first load and again on every in-site navigation, carrying the page title, the full URL and the path.

Google processes that data as our processor and sets its own cookies to tell one visit from another. Those cookies are listed on the cookie policy page. We use analytics to decide what to write next: if a page gets impressions in search and no clicks, we rewrite it.

We do not run Google Ads, remarketing, audience export, Google Signals or any advertising product, and we do not send Google an email address, a name or a user ID. If you would rather not be counted, block googletagmanager.com in your browser or install Google's opt-out add-on. Nothing on the site stops working when you do.

When you press send, the form posts to our own server. The server checks a security token, checks the request came from this domain, applies a rate limit, checks your CAPTCHA answer, and then hands the message to Mailgun, the transactional email provider that delivers our mail.

Mailgun therefore processes your name, email address, subject and message in transit, and keeps delivery logs under its own retention policy. Two emails are sent: one to our inbox, and one confirmation copy back to you so you have a record of what you wrote.

We keep contact messages in the inbox for as long as the conversation is useful, and clear them out periodically. Ask us and we will delete your thread sooner.

The CAPTCHA on the contact form is written by us and served from this domain. It draws a short code as an SVG image and issues an encrypted token that the server checks against your answer. There is no Google reCAPTCHA, no hCaptcha and no third party watching you solve it.

A separate anti-forgery token, configured under the name csrf_token, is issued when you submit the form. It is AES encrypted, expires 15 minutes after it is issued, and contains an expiry timestamp and nothing else: no identifier, no reference to you.

The site is served over HTTPS with strict transport security, frame denial and a referrer policy set at the edge. No system is perfect, but there is very little here worth stealing, which is itself a security measure.

The Bagh Chal and Langur Burja boards remember where you were. That state is saved by pinia-plugin-persistedstate in a first party cookie named after the game store, restricted to SameSite=Strict so it is never sent to another site.

Because it is a cookie, it travels with your requests to this domain, but we do not read it on the server, do not log it and do not connect it to anything else. Clear your cookies and your saved game goes with it.

There is a chat widget in the corner of the page, supplied by ChatDivo and loaded from chatdivo.com. It is the one piece of third party code on this site that can receive something you typed, so it is worth being plain about.

If you open it and send a message, that message goes to ChatDivo's servers, not only to ours. Anything you put in the box, including a name, an email address or a phone number, leaves this site. ChatDivo also stores its own data in your browser so a conversation survives moving between pages. We do not control that storage and cannot read it.

If you would rather not involve a third party, do not open the widget. The contact form reaches the same inbox and stays between you, us and Mailgun. Please do not send anything sensitive through the chat window. What ChatDivo does with a message once it has it is governed by their terms, not ours.

The widget loads only after the page has finished rendering, so it cannot slow down the article you came to read, and it stores nothing at all unless it loads.

Only the processors named above: Google (analytics), Mailgun (email delivery) and ChatDivo (the chat widget, and only if you open it and type something), plus our hosting provider, which necessarily handles the traffic. We do not sell data, do not run advertising, do not embed advertising trackers in articles, and do not share the contact inbox with anyone outside the editorial desk.

We will hand over information if a Nepali court or a competent authority orders it, and we would tell you unless we were legally barred from doing so.

You can ask us for a copy of anything you have sent us, ask us to correct it, or ask us to delete it. Write to contact@thankot.com or use the contact form. We do not charge for this and we do not require you to prove an identity we never collected: replying from the address that wrote to us is enough.

You can block analytics cookies in your browser, browse in a private window, or use a content blocker. Every page, map and game works with cookies disabled, apart from saved game progress, which has nowhere to live.

This site is written for a general audience and is not directed at children under 13. We do not knowingly collect anything from them.

When what the site does changes, this page changes on the same day, and the date at the top moves with it. We do not send notification emails about policy changes because we have no mailing list to send them to.

Related reading: the cookie policy lists every cookie by name, the terms of use cover reuse of our text and photographs, and the about page explains how the writing itself is checked.