Privacy &
How It Works

Last updated: 17 October 2026

The camera

When you press start, your browser asks permission to use your camera. We use that feed only to detect where your hands (or, in the body-tracked games, your whole body pose) are, in real time, so the visual effects can react to them. The processing runs locally using Google's MediaPipe library and your device's graphics hardware. The video stream stays in your browser tab and is discarded as it plays — there is no recording feature, no upload, and no server that ever sees your camera.

The Anatomy Atlas is the one place the camera is off by default. Its 3D skeleton is mouse-driven and uses no camera at all; only when you press Live Motion does it ask for one. That mode tracks your body pose, your face mesh and your hands so it can name your own bones, joints, skull and muscles on screen as you move. All three trackers run on your device through MediaPipe, exactly as above — the video is drawn to a canvas, labelled, and thrown away frame by frame. Nothing is recorded or uploaded, and pressing stop (or leaving the tab) closes the camera immediately.

The microphone

Some toys (for example Hand Beats) ask for microphone access instead of — or as well as — the camera. The audio is analysed live in your browser for loudness and frequency (so a kick drum can be told apart from a cymbal) and the visuals react to that. The sound itself is never stored or uploaded, and it is not played back through your speakers. The analysis result is a handful of numbers that exist for a fraction of a second and are then gone.

What leaves your device

Camera frames, microphone audio and the hand, face and body positions detected from them are never sent anywhere. The code that handles them makes no network requests at all. Only four kinds of data reach a server:

• Vercel Web Analytics, on every page of this site. It records aggregate page views with the page address, the referring site, country, and browser, OS and device type. It sets no cookies and does not follow you to other websites. Every page is counted this way, anonymously. The same script on the main page also records a handful of anonymous usage events: start (you pressed start), ready (the camera came on), camera_error (with the browser's error name, such as NotAllowedError), scene (which scene you opened), and control / toggle (which setting you changed and the option you picked). None of these events carry anything from your camera, microphone or movements.
• Dive Color usage events. On the Dive Color page the same analytics script records two anonymous events: dive_loaded (a video or photo was opened) and dive_exported (a result was saved), each with only the word "video" or "photo". Your file, its name and its pictures never leave your device.
• The visitor counter. The landing page asks our own server (/api/visits) for the all-time visit count. On your first visit from a browser it also asks it to add one. That server function keeps a single number in a hosted key-value database (Upstash Redis) and talks to it server to server, so your browser only ever contacts this domain. The count stores nothing about you.
• Normal web requests. Like any website, our host Vercel receives your IP address, browser type and the time of each request when your browser downloads the pages and files. See Vercel's privacy policy.
• Donations, only if you press "Donate". Our server (/api/tip) asks Razorpay to create a payment page for a fixed amount (rupees if you are in India, going by the country Vercel reports, dollars elsewhere) and sends you to it. Pressing a Donate button first passes through a small /go/ page on this site, which is counted the same way as any other page before it sends you on, whether you are going to Razorpay or to PADI AWARE's own donation page. Nothing about you is sent in that request. Whatever you enter on the payment page is handled by Razorpay, and by PayPal if you pay with it, under their own policies. See Razorpay's privacy policy.

We have no accounts, no advertising and no user profiles.

What is stored on your device

A few small values are saved in your browser's local storage so the site remembers them next time. They never leave your browser:

• hs_visited: a flag so a repeat visit is not counted twice by the visitor counter.
• hs_asl_v1: your Sign School progress (which letters and lessons you have completed).
• hs-jump-hi: your high score in Jump Runner.
• antfarm.atta.v2: your saved Ant Farm colony.
• security-course:captures: which security course challenges you have solved.
• llm-course-tiny-gpt-model-v1: the tiny language model you trained in the LLM course, so you don't have to train it again.

To delete them, clear this site's data in your browser settings.

Third parties

The main app and everything it needs (3D library, hand/body-tracking models, fonts, and the analytics script) is served from our own host, Vercel, on this domain. Like any website, Vercel's servers automatically receive standard request information — your IP address, browser type, and the time of the request — to deliver the page, and Vercel also provides the privacy-friendly Web Analytics described above. See Vercel's privacy policy.

No page on this site loads anything from another company's servers. The drawing and sound libraries (p5.js, Tone.js, ONNX Runtime), the tracking library and models, and the fonts are all copies hosted on this domain, and the site's security policy blocks the browser from fetching scripts, fonts or data from anywhere else. We use no advertising and no analytics other than Vercel's. The one outside company our server talks to is Razorpay, and only when you press the tip button (see above).

Recording your own videos

Ishan's Lab never records video or audio. If you screen-record yourself using it, that recording is created and stored by you, on your device or in whatever tool you chose — we are not involved and never receive it.

Children

Ishan's Lab does not knowingly collect any personal information from anyone, including children.

Your rights

We don't collect or store personal data about you, so there is nothing we hold that could be accessed, corrected or deleted on your behalf. The values in your browser's local storage are yours; clearing this site's data removes them. Camera and microphone access can be revoked at any time from your browser's site settings.

Changes

If we add a feature that changes how data is handled (a built-in recorder, for example, or a new analytics event), this page gets updated before the feature goes live.

Credits

The Anatomy Atlas uses a real anatomical skeleton model from AnatomyTOOL, derived from BodyParts3D © DBCLS and licensed CC BY-SA 2.1 JP. The model file is served from our own host. The Atlas never uses the microphone, and uses the camera only in Live Motion, which you switch on yourself. It is an educational reference, not medical advice.

Credits & licenses

Ishan's Lab is built on open-source software, all served from this domain. The full terms are in LICENSES.md.

• three.js (MIT)
• Google MediaPipe Tasks Vision and its hand, pose and face models (Apache-2.0, license)
• p5.js 1.9.4 (LGPL-2.1, license, source)
• Tone.js 14.8.49 (MIT, license)
• ONNX Runtime Web 1.19.2 (MIT, license) running fast-neural-style models from the ONNX Model Zoo (BSD-3-Clause)
• VT323 and Press Start 2P fonts (SIL Open Font License 1.1, license)

Contact

Ishan's Lab is a hobby project run by Ishan Sharma. Questions? Email bloortechnologies@gmail.com.