Privacy
This is an operating system you can sign into and keep your things in, so it holds the things you put in it. This page lists all of them, says why each one is there, how long it stays, and how to get rid of it.
It describes what the site actually does, checked against the code rather than written from a template.
If you never sign in
Nothing is created and nothing about your visit is stored. No account, no cookie, no analytics, no tracking pixels, no advertising, and no cookie banner, because there is nothing to consent to. A couple of small things are kept by your own browser on your own machine, and Your browser's own storage says which.
Your account
Signing up asks for a name and a passkey. The account holds:
- The name you chose. You pick it yourself and it does not have to be your real one.
- Your passkeys. For each one: a public key, an identifier, whether your device says it is synced or tied to that one device, when it was added and when it was last used. A passkey's private half never leaves your device and this site never sees it.
- That you confirmed you are 13 or over, and when. The answer and the moment, not your age and not your birthday.
- Your sign-in sessions and backup codes, as one-way hashes. The site keeps a fingerprint of each rather than the thing itself, so a copy of the database does not let anyone sign in as you or read your backup codes.
Signing up does not ask for an email address, a phone number, your real name or your date of birth, and the account has nowhere to put them.
The things you keep in it
Each part of the system holds what you put into it, and nothing else.
- Your desk. Which windows are open and where you put them, so the machine looks the same when you come back.
- Which applications you have installed.
- Your files. The name you gave each one, the type your browser said it was, its size, when you added it, and the contents. The name is free text you chose, so it holds whatever you put in it.
- Your note. Whatever you have typed into Notes, and when you last changed it, so that it is there on your other devices too.
Cookies
One, called sid, and only once you sign in. It holds a random
value that identifies your session and nothing else. It cannot be read by
script and it is only sent over a secure connection. It travels with you
if you follow a link into this site, which is what lets a shared link open
on a machine you are already signed in to, and it is withheld when another
site tries to submit a form here.
There are no advertising or analytics cookies, so there is no banner asking you to accept any.
Your browser's own storage
Three small things are kept by your browser, on your machine: your colour theme, your accent colour, and whatever you type into Notes. The two colour settings are never sent anywhere. Notes keeps a copy here so that it works before you sign in and stays instant while you type; once you are signed in that same text is also saved to your account, as listed above. Clearing your site data removes all three from this machine.
If you write to us
Mail sent to the address at the bottom of this page is not forwarded to a personal inbox. It is delivered to this site and stored in the same database as everything else here.
What that keeps is the message as it arrived, up to the first 64 KB of it: the address you sent from, the name your mail program puts on it, the subject, what you wrote, and the technical headers every email carries, which usually include the network address you sent from and which program you used. It is used to answer you and for nothing else.
It is deleted after ninety days, and sooner if you ask.
Who else is involved
- Cloudflare host the site and store its database, so they process everything listed above on our behalf, and they handle the connection when your browser asks for a page.
- Cloudflare Turnstile checks that a new account is being made by a person rather than a script. It loads only when you open the account panel, so if you never sign up it never runs. It is the only third-party code anywhere on this site.
Nothing is sold, shared for advertising, or handed to anyone else.
The database runs in the western United States, which is where Cloudflare placed it when it was created. Transfers out of the UK and the EU are covered by the standard legal arrangements for exactly this, which are part of Cloudflare's terms with us.
Why we are allowed to hold it
- Your account and everything in it: we need it to give you what you signed up for. Without a name, a passkey and a desk there is no account to run.
- A message you send us: our legitimate interest in reading and answering it, which is the reason you sent it. If you would rather we did not hold it, say so and it goes.
- A complaint or a request about your own data: we have to handle it, so holding what is needed to do that is a legal duty.
How long it is kept
- Your account, your desk, your applications, your files and your note: while the account exists. Files also go whenever you delete them, and the note is replaced whenever you change it.
- Sign-in sessions: thirty days, then they expire on their own.
- Backup codes: until you replace them or delete the account. A code that has been used is marked spent and never accepted again.
- The short-lived records used while a passkey is being created or checked: deleted the moment they are used, and in any case within two minutes.
- A message you send us: ninety days.
Nothing is kept indefinitely and there is no analytics store at all. There is one backup, and it is the host's: Cloudflare keep a rolling snapshot of the database covering the last seven days, which cannot be switched off, so something deleted here remains restorable on their side for up to a week. It is used only to recover from a fault.
Deleting everything
Open the account panel, choose Delete my account, and confirm. It happens immediately and it is not a request that somebody reviews. It removes your name, your passkeys, your desk, your installed applications, your sessions, your backup codes, your note, and every file you uploaded, contents and all.
What you can ask for
These apply to everyone who uses this site, wherever you are. There is no separate list for one country.
- See what is held. For an account it is all on your account panel already: your name, your passkeys and when each was last used, how many backup codes remain, your files, and your note. For a message you sent us, ask and we will send you what we have.
- Correct it. Change your name, add or remove a passkey, or replace your backup codes from the same panel. If something we hold is wrong, ask and it will be corrected.
- Delete it. An account, immediately, yourself, as described above. A message you sent us, by asking.
- Pause it. Ask us to stop using something while a question about it is being sorted out, and it will be held and nothing else done with it until that is settled.
- Take it with you. Ask for what you gave us in a form another service can read, and we will send it.
Objecting
You can object to us holding or using anything of yours, at any time, by writing to the address at the bottom of this page. Where we are relying on our own interest to hold it, which for a message you sent us is what we are relying on, objecting means we stop unless there is a compelling reason not to.
Complaining
You can complain to us. If you think we have handled your information wrongly, write to the address at the bottom of this page. We will confirm we have it within thirty days, look into it, keep you posted, and tell you what came of it.
You can also complain to the regulator, instead or as well. You never have to come to us first. In the UK that is the Information Commissioner, at ico.org.uk. If you live elsewhere, your own country's data protection authority, where there is one.
Under 13
This site is not for children under 13 and asks you to confirm that before making an account. If you believe a younger child has made one, the account can be deleted from inside it, and you can also get in touch below.
Getting in touch
Questions about any of this, a request to see, correct or remove something, an objection, or a complaint, all go to privacy@stephenmcode.com. It reaches this site rather than a personal inbox, and the section above says what happens to what you send.
Changes
If this changes, this page changes, and the date below moves. There is no mailing list to tell you, because there is no mailing list.