What this site does, and what it cannot see

What this site collects.

Nothing. There is no account, no session, no profile and no identifier tied to you anywhere in this site.

• No cookies. The site sets none, of any kind, first-party included. There is no consent banner because there is nothing to consent to.
• No analytics. No page-view counter, no tag manager, no pixel, no heat-mapping, no session recorder, no A/B tool, no error-reporting service.
• No third-party origin. No font, script, stylesheet, image, frame or media file is loaded from any other host. Opening this page contacts the server you asked for, and nothing else.
• No forms. There is no contact form, no newsletter, no search box that posts anywhere, and no upload field on this domain.
• No identity requested. The site never asks for a name, an address, an email address, an organisation or a phone number.

The typefaces are served from this origin. Space Grotesk, Inter, JetBrains Mono and Noto Sans Arabic are self-hosted, which is a licence-compatible use and a privacy requirement at once. The font licences →

How to check that on this page.

Do not take the list above on trust. It is written to be falsifiable in about a minute.

• Open your browser's network panel and reload. Every request should be to this origin, and there should be no request after the page finishes rendering.
• Open your cookie and storage inspector. It should be empty for this domain, before and after you navigate the site.
• Read the page source. There is no analytics snippet, no inline beacon and no external src or href to a third-party host.
• Read the response headers. The policy served with this export is default-src 'self', with form-action 'none' and frame-ancestors 'none'.
• Disable JavaScript entirely. Every page still renders and remains usable, because the content is static HTML.

If any of those checks fails, that is a defect and we want to hear about it. Report it →

What a server operator can see.

There is a floor below which no website can claim privacy, and honesty about that floor is the point of this section.

Any web server, including this one, observes the connection itself. It sees an IP address and a request line: the method, the path and the protocol. It also sees the headers your browser sends, typically a user agent and a language preference. Over the clearnet site, that IP address is your network location, or your VPN provider's.

That is inherent to serving a page over HTTP. It is not something this site adds, and no configuration removes it for a clearnet visitor.

Operation is kept minimal by design. The site is a static export, with no application server, no database and no runtime service that could hold anything about you.

The .onion mirror avoids even that.

The whole site is mirrored as a Tor onion service, and that mirror is the private way to read it.

The mirror address is printed in the footer of every page, and it renders with its confirmation marker until the final address is published.

Links to other places.

This site links out to the parent surface, to the documentation site, to source repositories and to the upstream projects it credits.

A link is not a load. Nothing from those hosts reaches your browser until you choose to follow the link, at which point their policies apply and ours stop. No link on this site carries a tracking parameter.

Downloads, and why there are none.

There is no download control anywhere on this domain, on any route. That is a security decision before it is a privacy one. Images are to be distributed over Tor only — a target, planned — and clearnet carries the hashes and fingerprints you check them against. How distribution works →

If any of this changes.

A change to this page is a change to how the site behaves, so it is published here and dated rather than quietly amended.

One question is still open: whether the site publishes a SHA256SUMS file for its own deploys. That would let a reader confirm the page they received is the page that was built.

Terms → · Licences → · About and lineage →