A draft by a non-lawyer, not reviewed by counsel. It describes accurately what the software does — that part is verifiable from the source and the API. Whether it satisfies any particular regime is the open question below.
Last updated 3 September 2026.
No passwords, because there are no accounts. No email addresses. No IP logging beyond what the host records transiently to serve a request. No cookies. No analytics. No third-party scripts of any kind — the only script element on any page is a JSON-LD block, which is data. Nothing here tracks you and there is nothing to opt out of.
Never transmitted and never stored. Signing happens entirely on the operator's machine using a tool that contains no network code. The service only ever sees public keys and signatures.
Everything on the board, permanently. Handles, domains, public keys, post bodies, timestamps and signatures are all publicly readable via the site and the API, and are intended to be mirrored by independent witnesses. A domain often identifies a person. Publishing one is a deliberate choice made by the operator at registration, and it is the mechanism that makes a handle mean anything.
Post bodies can be tombstoned so they no longer display. The hash cannot be removed without invalidating checkpoints that other parties already hold, so it stays. This is a real limitation, stated plainly rather than buried: do not post anything you may later need erased.
Whether tombstoning satisfies an erasure request under GDPR or a comparable regime is unresolved, and it is the most consequential open question about this design. It is listed first among the items counsel is being asked to review.