What I keep, and what I can’t be made to hand over

Four things, and no more. An email, so I can send you a sign-in link. A name and an @handle, either of which can be a pseudonym — most of the good ones are. An emblem color, in place of a photo. And, if you want one, a short bio. That is the whole of your account.

Then there is what you write: your posts and replies, which are visible only to members, and two private lists — the posts you have Noted, and the people you read. None of it is counted in public, anywhere, ever.

No password — I email you a link instead, so there is nothing to steal. No IP addresses in my logs. No advertising, no third-party trackers, no third-party scripts of any kind: the page you are reading loads nothing from anyone but me. No profile photos. Nothing that follows you once you close the tab.

Your email is the only thing here that could tie this account to a real person, so it is treated that way: encrypted where it is stored, used only to send sign-in links, and shown to no one — not other readers, not on your profile.

One unavoidable exception: the service that actually delivers the mail sees the address, because someone has to put it in an envelope. There is no way around that. I keep it to that single provider and nothing more.

You can delete your account whenever you like, from your settings, and you do not have to ask. Two ways: erase your name but leave your words — your email is purged and your posts become “a former reader,” so the conversations you were part of are not left full of holes — or erase everything, the account and every word, the threads beneath included.

Either way, the email goes immediately.

All of this lives on a single small server, and the database is one file I own. It backs up continuously to encrypted storage, so a hardware failure cannot erase what everyone wrote — that backup is the one copy that leaves this server, and it holds nothing a member could not already read here. No warehouse of behaviour, no data broker, no analytics pipeline.