Privacy
This is an operating system you can sign into and keep your things in, so it holds the things you put in it. This page lists all of them, says why each one is there, how long it stays, and how to get rid of it.
If you never sign in
Browsing without signing in or starting account recovery creates no account or sign-in cookie. There are no analytics, tracking pixels or advertising. A couple of small things are kept by your own browser on your own machine, and Your browser's own storage says which.
Your account
Signing up asks for a name and a passkey. The account holds:
- The name you chose. You pick it yourself and it does not have to be your real one.
- Your passkeys. For each one: a public key, an identifier, whether your device says it is synced or tied to that one device, when it was added and when it was last used. A passkey's private half never leaves your device and this site never sees it.
- That you confirmed you are 13 or over, and when. The answer and the moment, not your age and not your birthday.
- Your sign-in sessions and backup codes, as one-way hashes. The site stores fingerprints rather than the original values. These cannot be submitted in place of your session or a backup code. Older, shorter backup codes remain valid until you replace them.
- Account recovery progress. The account being recovered, the start and expiry times, the current step, and the public information needed to check a replacement passkey. It also keeps fingerprints of the recovery cookie, tab identifier and completed submission so an interrupted attempt can be checked or retried. No private passkey or entered backup code is kept in these records.
Signing up does not ask for an email address, a phone number, your real name or your date of birth, and the account has nowhere to put them.
The things you keep in it
Each part of the system holds what you put into it, and nothing else.
- Your desk. Which windows are open, where you put them, their size, and whether one is maximised or full screen, so the machine looks the same when you come back.
- Which applications you have installed.
- Your settings. Your appearance, font, spacing, corners, motion, fire, sound and clock choices, and when you last saved them. These are saved to your account so you can use them on another device.
- Your files. The name you gave each one, the type your browser said it was, its size, when you added it, and the contents. The name is free text you chose, so it holds whatever you put in it.
- Unfinished uploads and deletions. An account identifier, file size, storage identifiers, progress and times, so interrupted work can be cleaned up. These records remain until cleanup finishes.
- Your note. The text you save in Notes and a number that identifies its saved version, so one device can recognize changes from another.
Cookies
The sign-in cookie, called sid, holds a random
value that identifies your session and nothing else. It cannot be read by
script and it is only sent over a secure connection. It travels with you
if you follow a link into this site, which is what lets a shared link open
on a machine you are already signed in to, and it is withheld when another
site tries to submit a form here.
Starting account recovery adds __Host-hearth-recovery, a
cookie that only permits recovery actions for five minutes. It does not
open your notes, files or account settings. A separate cookie,
__Host-hearth-session-context, binds a recovered sign-in to
this browser, so a delayed reply cannot restore an older sign-in after an
account change. It lasts up to thirty days and five minutes from starting
recovery, and is renewed on a later sign-in. Neither cookie is readable
by script, and both are sent only over a secure connection.
There are no advertising or analytics cookies, so there is no banner asking you to accept any.
Your browser's own storage
Your browser keeps your settings, Notes drafts and their saved versions, and a marker saying you have already seen the start-up screen this visit. The start-up marker is never sent anywhere. Settings are saved on this device while you are signed out. When your account can save changes, your settings are also saved to that account. Signing out keeps the last appearance here.
Notes keeps local drafts while you write, including unsent changes and copies preserved when you choose between conflicting versions. Signed-in edits are also saved to your account when saving succeeds. Account drafts are kept separately, so signing into another account does not reveal them. Writing from before sign-in is not added to an account automatically. These browser copies can remain after signing out or deleting your account. Clearing this site's data in your browser removes them from this device.
During recovery, this tab keeps its random identifier and any replacement passkey response waiting to be saved. That response contains public registration information, not your private passkey or backup code. This lets a reload continue the same attempt. The copy is cleared when recovery finishes, is cancelled, or the server confirms it has expired. Your browser also clears it when the tab's session is discarded.
If you write to us
Mail sent to the address at the bottom of this page is not forwarded to a personal inbox. It is delivered to this site and stored in the same database as everything else here.
What that keeps is the message as it arrived, up to the first 64 KB of it: the address you sent from, the name your mail program puts on it, the subject, what you wrote, and the technical headers every email carries, which usually include the network address you sent from and which program you used. It is used to answer you and for nothing else.
It is deleted after ninety days, and sooner if you ask.
Who else is involved
- Cloudflare host the site and store its database, so they process everything listed above on our behalf, and they handle the connection when your browser asks for a page.
- Cloudflare Turnstile checks that a new account is being made by a person rather than a script. It loads only when you open the account panel, so if you never sign up it never runs. It is the only third-party code anywhere on this site.
Nothing is sold, shared for advertising, or handed to anyone else.
The database runs in the western United States, which is where Cloudflare placed it when it was created. Transfers out of the UK and the EU are covered by the standard legal arrangements for exactly this, which are part of Cloudflare's terms with us.
Why we are allowed to hold it
- Your account and everything in it: we need it to give you what you signed up for. Without a name, a passkey and a desk there is no account to run.
- A message you send us: our legitimate interest in reading and answering it, which is the reason you sent it. If you would rather we did not hold it, say so and it goes.
- A complaint or a request about your own data: we have to handle it, so holding what is needed to do that is a legal duty.
How long it is kept
- Your account, your desk, your settings, your applications, your files and your note: while the account exists. Files also go whenever you delete them, and the note is replaced whenever you change it.
- Sign-in sessions: thirty days, then they expire on their own.
- Backup codes: until you replace them or delete the account. A code that has been used is marked spent and never accepted again.
- Ordinary passkey creation and sign-in requests: deleted when used. Unused requests stop working after two minutes and are cleared when the next passkey request is created. Deleting your account also removes requests linked to it.
- Recovery progress and completion receipts: stop working after five minutes, including when an attempt is retried or reloaded. Expired records are removed by the next scheduled cleanup or new recovery. The scheduled cleanup runs every five minutes; failures can delay removal. Deleting your account removes these records too. The separate browser binding stored with a sign-in lasts as long as that session.
- A message you send us: ninety days.
- A record that a complaint was made and what came of it: kept after the message itself has gone, because we may be asked to show that it was handled. It holds the dates and what was decided, and nothing that says who made it.
There is no analytics store. Cloudflare keeps a rolling snapshot of the database covering the last seven days, which cannot be switched off, so something deleted here remains restorable on their side for up to a week. It is used only to recover from a fault.
Deleting everything
Open the account panel, choose Delete my account, and confirm. Deletion starts immediately and does not need somebody's approval, with one exception: the account that operates the site cannot be deleted while it is the only one, because the site would be left with nobody able to run it. You are signed out and new uploads stop. It removes your name, your passkeys, your desk, your installed applications, your saved settings, your sessions, your backup codes, your note, and every file you uploaded, contents and all.
What you can ask for
These apply to everyone who uses this site, wherever you are. There is no separate list for one country.
- See what is held. Your account panel shows your name, your passkeys and when each was last used, and how many backup codes remain. Open Files or Notes to see what you keep there. For a message you sent us, ask and we will send you what we have.
- See and change your settings. Open Settings. You can also restore the defaults there. The browser copy remains until you change it or clear this site's data in your browser, including after deleting your account.
- Correct it. Add or remove a passkey, or replace your backup codes from the same panel. If something we hold is wrong, ask and it will be corrected.
- Delete it. Start account deletion yourself, as described above. A message you sent us, by asking.
- Pause it. Ask us to stop using something while a question about it is being sorted out, and it will be held and nothing else done with it until that is settled.
- Take it with you. Ask for what you gave us in a form another service can read, and we will send it.
Objecting
You can object to us holding or using anything of yours, at any time, by writing to the address at the bottom of this page. Where we are relying on our own interest to hold it, which for a message you sent us is what we are relying on, objecting means we stop unless there is a compelling reason not to.
Complaining
You can complain to us. If you think we have handled your information wrongly, write to the address at the bottom of this page. We will confirm we have it within thirty days, look into it, keep you posted, and tell you what came of it.
You can also complain to the regulator, instead or as well. You never have to come to us first. In the UK that is the Information Commissioner, at ico.org.uk. If you live elsewhere, your own country's data protection authority, where there is one.
Under 13
This site is not for children under 13 and asks you to confirm that before making an account. If you believe a younger child has made one, the account can be deleted from inside it, and you can also get in touch below.
Getting in touch
Questions about any of this, a request to see, correct or remove something, an objection, or a complaint, all go to privacy@stephenmcode.com. It reaches this site rather than a personal inbox, and the section above says what happens to what you send.
Changes
If this changes, this page changes, and the date below moves. There is no mailing list to tell you, because there is no mailing list.