← polis.pub

Privacy Policy

Last updated: September 2026

What we collect

We collect the minimum needed to run the service:

• Email address — used for login links and security auditing of account changes
• Handle — your chosen public identity
• Discovery metadata — when you publish or follow, we register metadata (URLs, timestamps, relationships) with the discovery service so other sites can find your content
• Operational logs — when you take actions (publishing, following, commenting), we log the action type, your handle, a one-way hash of your email, your IP address, and timestamp. These logs are used for service health monitoring, abuse detection, and debugging. We do not build user profiles or track browsing behavior

What we host

Your site content — posts, comments, and configuration — is stored on our servers because we host it for you. We don't mine, analyze, or monetize this content. It's your data. We also hold the key that signs it — the next section is about that.

Your signing key

Everything your site publishes — posts, comments, follows — is signed with a private key, so anyone can check that it came from your site and hasn't been changed since. A signature shows that the key was used. It can't show who used it.

We hold the private key that signs your posts, and our software uses it. We generated it when you signed up. It's stored on our servers with your site, and it's in the snapshot we take of our whole data volume before every deploy.

Here is what our software signs with it today:

• what you publish, comment on, and follow, when you do it — including a comment you write while signing up, and comments held until you verify your email
• your site's first registration with the discovery service, the directory other sites use to find yours
• repairs that run in the background with nobody watching: re-registering your site, posts, comments, and tags with the discovery service when its copy has gone missing, and re-sending follow announcements that didn't arrive
• setting up the separate key your direct messages use

Nothing technical limits the key to that list. Whoever holds it can sign anything as you, and the result looks exactly like something you signed yourself. That includes us, anyone who breaks into our servers, and anyone with a copy of one of our snapshots. Nothing we publish records whether a signature came from you or from our software, and we have not built a way to show you.

This isn't special to polis.pub. A signature proves which key signed, never who held it — that is true of every polis site, however it is run. See what a signature does not tell you.

If you'd rather hold your own key

Run your site yourself. Download your export from Settings: it's every file of your site except our logs — posts, comments, messages (still encrypted), settings, and the key. Run it with the open-source polis software on a machine you control, then run polis rotate-key so that what you sign from then on uses a key only you have held.

What that doesn't do, and what it costs:

• We still have your old key. It stays on our servers until your account is deleted, and a snapshot taken before then can still contain it for up to 7 days. Rotating doesn't make it useless: a retired key can still sign things that claim to date from before you rotated.
• Rotate soon. Anyone holding the old key can rotate it too, and whoever does it first wins. The other can't undo it.
• Your address changes. handle.polis.pub stays behind. You'll need your own domain, and people who follow you would need to follow the new address.
• You leave our checks behind. Here, background software checks every site's signatures and files on a schedule and repairs what it can. On your own machine you run checks yourself with polis validate, which covers many of them but not all — it doesn't check whether the files your site serves match the ones it wrote, or whether the pages your published terms of use point to exist.
• You become your own backup. Lose the only copy of your key and nobody can recover it — not us, not anyone.

What we don't collect

No tracking pixels. No analytics scripts. No cookies beyond session authentication. No third-party scripts on your pages. No advertising profiles. No browsing or reading behavior. We log actions you take (publishing, following) for operational purposes only — see "What we collect" above.

How email is used

Your email is used exclusively for magic link authentication. We never display it publicly, never share it with anyone, and never send marketing emails. The only emails you'll receive are login links you request and reaping reminders if your account is unverified.

Published content

Posts, comments, and blessed comments are public by design — that's the point of publishing. Your dashboard, drafts, and private settings are never exposed.

Data storage

Your site content is stored on our servers. Your signing key is generated on our servers and stored with your site data — see Your signing key above. Your email and account metadata are stored in our database.

Data export

Your site is just files. You can download everything from your dashboard Settings at any time. If your account is archived, you can recover your data at /recover.

Data deletion

To delete your account and all associated data, contact us. Unverified accounts are automatically archived after 14 days — see inactive handle reaping for details.

Third parties

We rely on a few infrastructure providers to run the service:

• Resend — transactional email delivery (login links and reaping reminders)
• Fly.io — hosting and data storage (your site content and account data live here)
• Cloudflare — DNS, CDN, and TLS termination (sits in front of all requests)
• Axiom — operational log monitoring

No ad networks, no data brokers, no user analytics services.