Privacy
This page describes what the code does, not what we intend. Where it names a deletion, that deletion is a statement in the source.
What we store when you publish
The piece: title, body, the timestamp, and the link upstream if it is a response. That is the whole row. Pieces never carry an IP address or a user agent — the columns do not exist, so there is nothing to delete later.
Alongside it, for 7 days, one more row: the SHA-256 hash of your author link (never the link itself), the piece it belongs to, the backup email address if you gave one, whether the reminder has been sent, whether you turned it off, and the moment the window closes. If you did not give an address, that field is empty.
What we store when you comment
The text, the timestamp, the piece, and the account that wrote it. Comments are public and carry your name — that is what a comment is here. No IP address and no user agent: the columns do not exist.
Rate limiting keeps a short-lived counter — the same salted hash, an action name, an hour or a day, and a number. It references actions, never pieces, and the hourly job deletes every counter older than 24 hours.
What happens on day 7
If a piece has not been claimed when its window closes, the hourly job runs exactly this against it:
DELETE FROM author_tokens WHERE essay_id = :id; UPDATE essays SET author_user_id = NULL WHERE id = :id;
That is the entire deletion model. Afterwards the author link is gone — it existed only as a hash, and the hash is deleted — along with the backup address and the row that named your account while the window was open. No row in the live database connects a person to that piece.
The comments and votes on it stay. They are public, and they belong to the people who wrote and cast them, not to you.
7 days after publishing, we delete the only record connecting you to your piece. Nothing in the live database could identify you after that. The one caveat is backups, below.
The piece is not deleted
Pieces are permanent. Day 7 deletes the link between you and the piece, never the piece. It stays published, at the same URL, readable and linkable forever. The terms explain what that means for requests about a piece after the fact.
Backups
The database is copied nightly and each copy is deleted after about 30 days. That retention belongs to the backup system and is set independently of the 7-day window — the two numbers are not related, and changing one does not change the other. What it means is that for up to roughly a month after any window closes, a deleted row still exists in an off-site backup file. This is the one caveat to everything above, and there is no honest way to remove it while keeping backups at all.
Logs
No request logs are written: the web server has no log directive and the application server's access log goes to /dev/null, so author links never reach a disk that way. The application's own log lines have /a/ paths stripped out before they are written.
Accounts
An account is a username, an email address, and the date it was created — and, while the site is invite-only, which account invited it. That last fact is shown to you, to the account that invited you, and to the operator, and to nobody else; it is not on your public page. An address left on the wait screen is kept until an invite is sent to it, at which point the address is erased and only the dates stay, or until the operator deletes the row. If you link an X account, the handle is stored until you unlink it or a re-check finds the string gone from your bio; checking fetches your public profile page from this server and keeps nothing from it but the handle. There are no passwords: signing in sends a link that works once, within 15 minutes, and is stored only as a hash. Being signed in sets one signed cookie; every visitor's cookie also carries a random session id, described under Analytics below. There are no trackers and no third-party scripts anywhere on the site.
Deleting your account takes the byline off every piece you claimed, and the pieces stay published without a name on them. Your comments stay on the walls they were written on, under this username. Your votes stay. The username is kept forever so nobody can take it and impersonate you; your email address and bio are erased.
Analytics
The site keeps its own analytics, in a separate file, and sends nothing to anyone else. What is recorded: each page view as a route pattern (an author view is recorded as /a/, never the link), the hour, the domain a visitor came from, a random session id, and the account when signed in; how many seconds a page was open, capped at 30 minutes, and how far down a piece was scrolled, by quarter, both posted back to this server by a small script on the page; which header word was clicked, and from which page; and these actions as events: publish, preview, claim, vote, comment, search (with the query), sign in, sign up. What is not: anything about how you write — no keystrokes, no typing rhythm, no paste, no time in the text box. Time on the write page is recorded like time on any page; the text you are producing is not observed. No link to authorship: views of the write, preview, publish and author pages, and the publish and preview events, carry no session id and no account, and timestamps are kept to the hour, so nothing in this file says which account was writing when a piece appeared. The file has no column that could hold an author link or an author's account, and no query joins it to the pieces. The operator sees totals per page and per action, and nothing per person. This file is not backed up, and the operator can delete it whole with one command.
The classifier
When the operator has it switched on, every new piece and comment is sent once, after it is published, to a text classifier run by a third party, which answers with one of five labels — clean, spam, harassment, illegal, other — and a one-line reason. The request carries the text and nothing else: not your account, not your author link or its hash, not your address, not even the piece's own URL. The classifier cannot connect what it reads to anyone. Its verdict and reason are stored beside the piece or comment for the operator, who decides what to do; the only thing the classifier does on its own is take down content it labels illegal, pending that decision. When the switch is off, nothing is sent.
Reports
A report keeps what the reporter typed, the piece it names, the time, and a contact if they chose to leave one. Reports outlast the 7-day window: they are a record about a piece, not about its author, and we keep them for legal reasons.
Three emails exist: the optional backup of your author link, the one reminder before your window closes, and sign-in links. They are handed to a transactional email provider, which sees the address and the contents — including, in the backup email, the author link itself. That is the tradeoff the publish page names when it asks for an address. Every reminder carries a link that turns reminders off.