This site sets no cookies of its own. It stores one piece of personal data only if you give it: your email address, when you sign up for the free guide or ask for the tools from a reel by email. The sign-up form has a spam check run by Cloudflare, described below. The studio's Instagram app handles only what you send its two accounts, and only to answer you.
The free guide and the letter
If you sign up on the links page, the studio stores your email address, the time, the page you signed up on, your country as your browser's network reports it, and the wording of the consent you ticked. It is kept on Cloudflare, where this site runs, and is used only to send you the occasional By the Loop letter from [email protected]. It is never sold or shared, and no mailing company holds it. Every letter tells you how to leave; you can also email [email protected] with "Unsubscribe" and the address is deleted within 7 days. Legal basis: your consent (GDPR Article 6(1)(a)), which you can withdraw at any time.
The tools email
If you ask for the tools from a Claude by Richard reel, either by typing your email address in an Instagram direct message to @claudebyrichard or in the form on the tools page, the studio stores your email address, which reels you asked for, the time and where you asked. It is kept on Cloudflare, where this site runs, and as a row in a Google Sheet in the studio's Google account, and the email is sent with Google's Gmail from that account. It is used only to send you the tools you asked for. You are not added to the By the Loop letter unless you tick that box yourself. The step of the Instagram conversation (offered, asked, sent) is kept on Cloudflare for at most 8 days. Every tools email has an unsubscribe link, which deletes your address from the list. Legal basis: your request (GDPR Article 6(1)(b)), and your consent for the letter (Article 6(1)(a)).
The spam check on the sign-up form
The sign-up forms on the links page and the tools page are protected from spam bots by Cloudflare Turnstile. It loads only when you start filling in the form, so visiting the links page alone sends nothing to it. To tell a person from a script, Turnstile runs a short check in your browser. For that check Cloudflare receives your IP address, your browser's user agent, the TLS fingerprint of your connection and the name of this site, and it may set a strictly necessary cookie on its own domain, challenges.cloudflare.com, for bot detection only. Turnstile does not see what you type into the form. The studio gets back only a pass or a fail and stores nothing from the check. Cloudflare processes this data for the studio and also uses it to improve its bot detection, as its Turnstile privacy addendum explains. Legal basis: the studio's legitimate interest in keeping the list free of fake and abusive sign-ups (GDPR Article 6(1)(f)).
Analytics
Page views are counted with Cloudflare Web Analytics, which is cookie-less and does not follow you across sites. It records the page, the referrer, the browser type and the country, in aggregate.
Outbound links
Links to Higgsfield and ElevenLabs carry a partner code and pass through a counter on this domain that records only the total number of clicks and which page they came from. Links to the studio's own accounts are ordinary links. Each destination's own privacy policy applies once you are there.
Graphics
The moving graphics on this site are rendered in your own browser. Nothing about your device is measured or sent anywhere; the page only asks the browser whether it can draw them, and draws something simpler if it cannot.
Hosting
The site is served by Cloudflare Pages, which may log requests for security under its own policy.
The studio runs three Instagram accounts, @claudebyrichard, @realolivialoop and @plottwistloop, through its own app on Meta's official Instagram API. The app publishes the studio's own posts, reads the comments left on them so they can be answered, and reads and answers direct messages sent to these accounts, including automatic replies with answer buttons. It uses only what Instagram passes to the account owner: your Instagram-scoped ID, your username, and the text or link you sent. It never sees your password, your other accounts or anything you did not send to these three accounts.
Comments are read when they are answered and are not copied anywhere. A direct message is kept on Cloudflare only as long as it takes to answer it, at most 30 days, and is then deleted automatically. Nothing is sold, shared with advertisers or used to build a profile of you. Meta's own Instagram privacy policy covers what Instagram itself does.
Deleting your data
Email [email protected] with the subject "Delete my data" and your Instagram username. Everything the studio holds about you is deleted within 30 days and you get a reply when it is done. Deleting your own comment or message on Instagram also removes it from what the app can read.
Your rights
You can ask what the studio holds about you, have it corrected or deleted, and complain to your data protection authority (in Hungary, the NAIH). If you emailed the studio, ask and the email is deleted.
Last updated 2026-10-22.