What we keep, and what we can’t be made to hand over
The short version: as little as we can — and your email, the one thread back to you, is encrypted and yours to erase at any time.
Four things, and no more. An email, so we can send you a sign-in link. A name and an @handle, either of which can be a pseudonym — most of the good ones are. An emblem colour, in place of a photo. And, if you want one, a short bio. That is the whole of your account.
Then there is what you write: your posts and replies, which are public by their nature, and two private lists — the posts you have Noted, and the people you read. None of it is counted in public, anywhere, ever.
No password — we email you a link instead, so there is nothing to steal. No IP addresses in our logs. No advertising, no third-party trackers, no scripts of any kind: the page you are reading loads nothing from anyone but us. No profile photos. Nothing that follows you once you close the tab.
Your email is the only thing here that could tie this account to a real person, so it is treated that way: encrypted where it is stored, used only to send sign-in links, and shown to no one — not other readers, not on your profile.
One unavoidable exception: the service that actually delivers the mail sees the address, because someone has to put it in an envelope. There is no way around that. We keep it to the single provider and nothing more.
You can delete your account whenever you like, from your settings, and you do not have to ask. Two ways: erase your name but leave your words — your email is purged and your posts become “a former reader,” so the conversations you were part of are not left full of holes — or erase everything, the account and every word, the threads beneath included.
Either way, the email goes immediately. This is the whole point of keeping so little: the honest answer to anyone who comes asking is that we did not keep it.
All of this lives on a single small server, and the database is one file the host owns and could delete on principle. No cloud sprawl, no warehouse of behaviour, nothing handed to a broker. A small place, kept deliberately small — because what is never collected cannot leak, and cannot be demanded.