Privacy

Website pages

The website contains no analytics scripts, tracking pixels, external fonts, or browser local storage. Its pages and account forms work without browser JavaScript. It does not collect fingerprint samples through the browser.

Limited accounts

Accounts store the supplied email address as an unverified identifier, a password hash, creation date, and hashed session identifiers with their expiry and activity dates. The address is not proof of mailbox ownership. Email verification and password recovery are unavailable, and no email is sent.

Account pages use a necessary session cookie marked Secure, HttpOnly and SameSite=Lax. Authenticated sessions expire after eight hours or thirty minutes of inactivity. Anonymous form sessions expire after one hour or thirty minutes of inactivity. IP addresses and hashed email identifiers are held in memory for rate limits using fifteen-minute windows.

You can delete your account using your current password. This removes its active database record and sessions. Private backups can retain earlier records until rotation; the service retains up to fourteen daily snapshots and fourteen pre-upgrade snapshots. Server administrators and the service account can access these private files.

If you lose your password, you cannot recover the account in the current mode. Accounts do not provide fingerprint feeds, accept fingerprint submissions, or grant code or data reuse rights.

Hosting logs

The website is served by nginx on a host managed by the project. For ordinary website pages, access logs record IP addresses, request times, paths and query strings, response status and size, referring pages, and browser user-agent information. Requests to account routes are excluded from access and error URL logging. Ordinary error logs record operational problems. These logs support operation and troubleshooting; they are not fingerprint database submissions.

Logs are accessible to server administrators and the server service account. They rotate daily, with up to fourteen archived log files retained under the host’s rotation policy. The site does not send these logs to an analytics service.

External links

Some pages link to other projects. Following those links opens their websites, which have their own privacy practices.

Future services

Email delivery, verified accounts, fingerprint feeds and sample submissions require separate data handling and operational decisions before they are enabled.