Privacy Policy

The short version

This site has no analytics, no advertising, no tracking pixels, and no third-party scripts of any kind. It sets exactly one cookie, and only once you sign in. If you are only reading, nothing about you is stored.

The rest of this page explains that in detail, and everything in it is checkable against the source code.

If you only read

No account, no cookie, nothing recorded against you.

Each article keeps a count of how many times it has been viewed. That is a single number per article — it is not tied to a person, a session, or an address, and it cannot be used to work out who read what.

Cloudflare, which serves the site, processes request data such as IP addresses in order to deliver pages and to block attacks. That is Cloudflare acting as the host; see their privacy documentation for what they retain.

If you hold an account

Stored, because the site cannot work without it:

• Your email address — to sign you in and to reset your password. It is never shown publicly, never appears on a post, and is never sold or shared for marketing.
• Your username, display name, bio and profile picture — these are public by design; they appear on anything you publish.
• A hash of your password, never the password itself.
• Two-factor details, if you turn it on: a secret shared with your authenticator app, and hashes of your backup codes.
• Sign-in housekeeping — when you last signed in, and a count of recent failed attempts so the account can be locked after too many.
• What you write, including drafts, and any images you upload.

Cookies

One, named dx_auth. It is set when you sign in and holds a signed token identifying your account. It is marked HttpOnly, Secure and SameSite=Lax, so it cannot be read by scripts and is not sent from other sites.

It is strictly necessary — without it there is no way to stay signed in — so no consent banner is shown for it. There are no other cookies.

Two things are kept in your browser's local storage, both only once you have signed in: your editor layout preference, and your display name and picture. The second is there so the account corner of the page can be drawn correctly straight away instead of appearing a moment later on every page you open. Neither is sent anywhere, both are removed when you sign out, and if you are only reading, nothing is stored at all.

Who else sees anything

• Cloudflare — hosting, the database and image storage. Everything on this site lives there.
• Resend — sends sign-in codes and the emails telling you whether your application to write was accepted. They receive your email address and the message.
• A sign-in provider, only if you choose to use one, and only your email address and name.

That is the complete list. Nothing is sold, and nothing is shared for advertising or profiling.

How long things are kept

Account details are kept while the account exists. Sign-in codes expire after ten minutes. Sessions expire after 7 days of inactivity, and completely after 90 days regardless.

Uploaded images that no post or profile refers to are periodically deleted. Published posts stay until their author or an administrator removes them.

Your choices

You can change your display name, username, bio and picture yourself at any time from your account page, and remove a profile picture entirely — the site falls back to a generated letter.

Write to us to ask for a copy of what is held about you, to correct it, or to delete your account. Deleting an account deletes its drafts and its profile. Published posts are handled by agreement, since removing them silently would leave gaps in the site for readers.

Children

This site is not intended for children, and accounts are not knowingly created for anyone under 16. If you believe a child has an account here, tell us and it will be removed.

Changes

If what is collected or shared changes, this page changes with it, and the date at the top will say when.