Privacy

This describes what the software actually does, in plain terms. It is written alongside the implementation rather than as a legal document, and it has not been reviewed by a lawyer.

What is stored about a member

Your email address, encrypted with AES-256-GCM. The encryption is bound to your specific account record, so a ciphertext cannot be moved from one account to another. Alongside it is a keyed one-way index of the address, which is what makes sign-in and "is this address already registered" work without the address itself being readable.
Your password, never stored. What is kept is a PBKDF2-SHA256 derivation at 100,000 iterations with a random salt. It cannot be reversed into your password.
Your display name, handle, clan, village and description, as you entered them. These are visible to other members.
What you contribute, rate and write. Ratings are not shown as "who rated what" to other members, but they are stored per member.

What is stored when you use the site

Sessions. A random token is set in a cookie; only a hash of it is stored here. A database dump yields nothing you could sign in with. Changing your password invalidates every other session.
Your IP address and browser are not stored. What is stored is a keyed digest of them — enough to notice a session being used from somewhere new, not enough to reconstruct the address or profile your browsing.
An audit entry for privileged actions — a role granted, an item hidden, a setting changed. Append-only: there is no code path that edits or deletes one.

Who can see what

Anyone sees only items a contributor marked public.
Members see the whole community archive.
Moderators additionally see hidden and reported items, and who reported them.
Administrators additionally see the audit log and configuration.

Uploaded files are held in private storage with no public access. Every request for a file is authorised individually — there is no unlisted URL that works forever if it leaks.

Third parties

The archive runs on Cloudflare Workers, so Cloudflare processes requests as the infrastructure provider. Sign-up uses Cloudflare Turnstile to keep automated registrations out.

Linked material loads from the site that holds it. Members can contribute a link — a recording on YouTube, a photograph in another archive — instead of uploading a copy. When a page shows one of those, your browser fetches it from that site directly, and that site can see your IP address and that you asked for the item. There is no way to embed something from elsewhere without this being true.

What the archive does about it: YouTube is embedded through youtube-nocookie.com, the variant that does not set tracking cookies before you press play; linked images are requested with no referrer, so the other site is not told which page you came from; and every linked item says on its face where it comes from, before you open it. Only YouTube is ever embedded in a frame — every other link is a link you choose to follow.

The writing assistant sends article text to an AI service. It only ever runs when you press one of its buttons in the composer, and it never runs on anyone else's writing or on anything already in the archive. Where the text goes depends on what you have chosen in your account settings: either the archive's own assistant, which runs on Cloudflare's AI platform and is sent only the first 300 words of what you are writing, or an AI service you connected with your own API key — Mistral AI, OpenAI, Google, Groq, DeepSeek or OpenRouter. In the second case that company receives the text you are working on and bills you for the call, under their terms rather than ours. Nothing is sent until you ask for a suggestion, and nothing a model suggests is applied to your article unless you apply it yourself.

Your API key, if you add one, is encrypted with AES-256-GCM and bound to your account record in the same way your email address is. It is never displayed back to you, never sent to your browser, and no moderator or administrator can read it. Only the last four characters are kept readable, so you can tell which key is stored. You can delete it at any time from your account page.

Beyond that: there is no analytics, no advertising, no tracking pixel, and nothing is sold or shared with anyone.

Retention, and what you can ask for

Contributions are meant to outlast their contributors — that is what an archive is. So deleting your account does not automatically erase what you gave; the community holds it.

You can ask for your account details, ask for your contributions to be withdrawn or made members-only, or ask what is held about you. Ask an administrator.

Being straight about a limitation: there is not yet an automated export or erasure process, and the audit log is deliberately append-only, so records of privileged actions persist by design. If either matters to you, raise it before you contribute rather than after.

If something is wrong

If you believe material about you should not be here, report it, or contact an administrator directly. Requests about photographs of living people, funerals and genealogies are treated as the most serious kind.