What we don't collect

We do not want to know who you are.

That's not a marketing position, it's laziness plus principle in roughly equal measure. Knowing who you are would mean building something to store it, protect it, and eventually explain when it leaked. No thank you.

Specifically

• There are no accounts, so we hold no names, emails, or passwords.
• There are no advertising trackers, pixels, or third-party analytics.
• There are no cookies set by this website.
• There is no Google Analytics, no Meta pixel, no session recorder, no heatmap.
• Fonts load from your own device. Nothing is fetched from another company.
• We do not sell data, because we do not have any to sell.
• Nothing you do on this site is sent anywhere. Not a click, not a keystroke. There are exactly two exceptions, both of which you have to go and use on purpose, and both have their own section below: DSIM, and talking to Tacky.

Talking to Tacky

The thumbtack in the corner will rant at you about declassified history for as long as you let him, and none of that costs you anything — the ranting is written down in this website and runs on your own device.

If you type something into his box and press send, that sentence leaves your device. It goes to our own server and then to Anthropic, whose model writes his reply. Nothing else goes with it: not your name, not a login, not an identifier, not what else you've been clicking. We don't keep it, and there is nothing on our end that could connect two messages to the same person.

This is the only part of the site that sends us something you wrote. It's a box you have to find, open and type into — nothing on this page is watching you the rest of the time.

There is a counter, and this is the whole of it. Answering costs us money, so the server keeps a running total of how many characters have been typed at Tacky in the last hour, to stop one person running up the bill. That total lives in memory under a scrambled version of your connection, never the connection itself. It isn't written to a disk or a database, it can't be turned back into you, and it vanishes whenever the server restarts. Go over it and Tacky just goes back to his own material — nothing gets blocked and nothing stops working.

DSIM

Everything above was true of this whole website until we built a thing where you can talk to your friends, and you cannot do that without sending something somewhere. DSIM is the only part of this site that transmits anything, and this is exactly what it does.

A name is not an account. No email, no profile, no session. Claiming a screen name makes a pair of keys inside your browser and sends us only the public halves — the private ones never leave your device in a form we can read.

There is a password, and here is precisely what it does. It used to be that your keys lived in one browser and nowhere else, and we called that honest. In practice it meant Safari deleting your name after a week away, or clearing your history taking it, or a new phone simply never having it. So your keys are now also sealed with your password and kept in a third table, where the password is the only thing that opens them.

Your password is never sent to us. It is put through 310,000 rounds of a deliberately slow calculation inside your browser; one half of the result becomes the key that seals your keys, and never leaves. The other half is hashed again and sent as the address the sealed box waits under — so the address is not your name, and holding it gets nobody any closer to opening the box. We store a locked box and a number. We cannot open it, and a copy of that whole table is a pile of locked boxes belonging to nobody in particular.

The part that is not in our favour, said plainly: anybody who guesses your password becomes you. That was not true before, because before there was nothing to guess and also no way back into your own name. There is no reset, because there is no email to send one to. Pick something you would not use anywhere else and write it down somewhere unfashionable.

We store your screen name and that public key. One table, and there is no way to edit a name and no button anywhere that deletes one, which is what makes a name permanently yours. There is no table for buddy lists.

We won't clear a name to hand it to somebody else. Ever, for any reason. It has been done exactly once: Colin lost the key to his own name within a day of building this, found out first-hand that we genuinely cannot recover one, and cleared that single row so he could claim it again. Nobody else's name was touched and nobody else's ever will be. You are reading about it here because a page like this is worthless if it only mentions the tidy parts.

And there is one more table, for messages nobody was there to receive. DSIM used to require both people to be signed on at the same second — miss it and the message was gone, which is not a messenger. So if you write to somebody who isn't signed on, the sealed message waits in a second table until they collect it, or fourteen days, whichever comes first. Then it's deleted.

It waits there sealed. It is encrypted on your device before it is sent, exactly like a live message, and the keys to open it are on your two devices and nowhere else. We cannot read a word of it and neither can anybody who takes the whole table. What's stored alongside it isn't your name or your friend's — it's a number worked out from a secret only the two of you can compute, so a copy of that table doesn't even say who is talking to whom.

One honest exception, because it can't work any other way: somebody adding you has to reach you before you know they exist, so there is no shared secret to hide it behind yet. That one waits under a number worked out from your screen name. Anybody holding the table could therefore tell that a name has somebody waiting to say hello — not who, and not a word of what passes between you afterwards. That's the whole of it.

That also means there is no rename. Not a policy — there is no button, and building one would mean being able to overwrite a name that somebody already holds, which is the one thing this arrangement exists to prevent. If you want a different name you claim a new one and re-add every friend by hand, exactly like the glory days.

Your buddy list is on your device. Nobody, including us, knows who your friends are. Clear your browser and the list is gone, because that was the only copy.

Your messages are end-to-end encrypted. Your browser and your friend's browser work out a shared key from your keys alone — it is never sent anywhere, so it cannot be intercepted or handed over. The relay that carries the conversation receives scrambled text it has no way of reading. We could not show you your own messages if you asked, and that is just as true of the ones waiting in the table above.

What anyone signed on can see. Who else is signed on and what their away message says. That is not a leak, it is what a buddy list is — it worked exactly this way in 2001. If you would not put something on a sign, don't put it in an away message. What nobody can see, including us, is a single word of anybody's conversation.

Nobody can pretend to be you. Everything you publish is signed with your private key and checked by everyone else against the public one. An impostor would have to produce a signature they cannot make — and that holds even against us, because we are not trusted to vouch for anybody either.

Lose your password and your device, lose your name. We genuinely cannot recover it, because the only copy we hold is sealed with something we do not have. There is a long code on the sign-on screen that moves a name to another device without a password, and that is the only other way back.

The two things stored on your device

Your settings. If you tick one of the boxes at the bottom of the page — hold still, bigger words, more contrast — that choice is saved in your own browser so the site remembers it next time. It never leaves your device and we cannot see it. Clear your browser data and it's gone.

Anything you write in the guestbook. That page lets you type something and keeps it — in your browser, on your device, and absolutely nowhere else. It is not sent to us. It is not sent to a database, because there isn't one. No other visitor can see it and neither can we, which is the entire joke of the page and also just true. There's a button on it that deletes the lot, and clearing your browser does the same.

Both of these use the same bit of your browser that any website can use to remember a setting. Neither is a cookie, and nothing about either one travels anywhere.

The boring truth about servers

This is a static website. Our host has to receive a request to send you a page, and their standard logs briefly record things like an IP address, the same way every website on earth works. We don't open those logs, we don't analyse them, and we don't connect them to anything. We'd rather they didn't exist.

If this page ever stops being true

Then we broke our own rule and you should tell us about it, loudly. The whole point of this website is that it doesn't do the thing every other website does.