privacy

What we hold, who else is involved, and what we'd hand over. Last changed 2026-11-04.

what we can't read

Your files and their names, and your mail are encrypted in your browser. We store only the locked versions.
Your keys and recovery phrase never leave your browser unlocked.

what we do hold

Your account: your handle, a hash of your password (not the password), your role, and your settings. No email address is required.
Your password: your browser turns it into a value to sign in with and a separate key, so our server never receives the password itself. With JavaScript off it does pass through our server, and is then forgotten. Unless you turn it off, your password also unlocks your encryption keys on a new device. We serve the code that does all this, so someone running that server could change that code to capture a password and open your files and mail. Your encryption settings let you use a recovery phrase instead.
Upgrades: if we give your account more storage or pages, we keep a record of it, and of a donation's amount and transaction id if we noted them. It's in your data export.
Your second factors, if you add them: passkeys, authenticator secrets (sealed with a server key), and an outside email address if you choose email codes.
Around your encrypted data: sizes and times of files and mail.
Things that aren't encrypted: calendar events, forum posts, project pages, support tickets, and your public pages, which are public on purpose.
Sessions: a cookie that keeps you signed in. No tracking or advertising cookies, and no analytics.

what we log

The sites on this page (sign-in, files, mail, calendar, forum, pages) keep no access logs and don't record your IP address: it's held in memory briefly to limit how fast anyone can try passwords or sign up, then forgotten.

Our chat web app (Element) and git server stopped recording visitors' IP addresses on 2026-11-04. Not yet true everywhere: logs written before that date still hold some until they're cleared, and the proxy in front of our servers notes the IP address of a connection that fails.

who else is involved

Servers.guru (the Netherlands) rents us the server.
Backblaze B2 stores our nightly backups, encrypted before they leave the server with a key that isn't on it.
Cloudflare answers DNS for our domains and, for now, receives incoming mail for n3xu5.art addresses and encrypts it to you before passing it on. It sees mail briefly in plaintext while doing so; moving that onto our own server is planned.
Let's Encrypt issues our HTTPS certificates.
Email sign-in codes, if you use them, are sent through an outside mail service.

if someone asks us for your data

We answer lawful requests only, and only with what we hold: for encrypted things that's locked data we can't open. We'll tell you about a request unless the law forbids it, and we'll publish how many we get. Our canary is a signed statement we renew every month; if it goes stale, assume we've been told to keep quiet.

your choices

See and change your settings at settings.
Leave at any time: deleting your account on your account page removes it and its data at once, and retires your handle. Copies in backups remain until those backups age out. Before you go, the same page gives you everything we hold about you in one archive.
Questions: support.