Privacy

What this site knows about you is very little, and this page is all of it. Last updated 2026-10-24. Every change to it is dated in the changelog.

Who we are

stimpunks.world is published by Stimpunks Foundation, a 501(c)(3) nonprofit run by and for neurodivergent and disabled people. Our mailing address is Stimpunks Foundation, Box #620611, Littleton CO 80162, USA. For anything on this page, contact us through stimpunks.org and say it is about privacy on stimpunks.world.

This page covers this site only. Our contact form lives on stimpunks.org, so what happens to a message you send is covered by stimpunks.org’s privacy policy and its cookie policy.

What your browser keeps

These are stored with localStorage in your own browser. All but love-cb are never sent to us or to anybody else, and we cannot read them. love-cb only exists once you have signed on to the CB, and it is sent to us, and only to us, each time the radio checks the channel, when you write on the chalkboard, leave a pebble, drop something in the suggestion box or answer it, water Pando Calrissian’s tree, pin a note to its fence, put a word up on the Fridge of Sighs, take a step on Count Me In’s stair, rescue or adopt an animal, open Profile or Account, read or write in the forums or tasks or look at the World room, and every few seconds while you have chosen to be seen on the Slake. Each one only remembers something you asked this site to remember, which is why there is no consent banner here: there is nothing a banner would be asking about.

Nothing else on this site stores anything: no session storage, no IndexedDB, no service worker. The site’s own security policy lets its pages send data to this site and nowhere else (connect-src ’self’) and never lets them submit a form (form-action ’none’), and the only thing on any page that sends anything at all is the CB, with its chalkboard, its pebble bowls, the suggestion box, Pando Calrissian’s tree, the Fridge of Sighs, Count Me In’s stair, the shelters and Profile, the forums, tasks, and the Slake. Opening Plural Mural asks this site for what is on the board, once, opening Pando Calrissian asks for the tree and its fence, once, opening The Sandbox asks for what is in the suggestion box, once, and opening the street’s front page, the Community Center, the forums or the office’s dashboard asks for the notice, once; none of those requests carries anything of yours.

What our host sees

This site is served by Netlify. Like any web server, it receives what every browser sends with every request — your IP address, your browser’s user-agent string, the address you asked for and the time — and it keeps logs of that under Netlify’s own privacy policy, which also says how long. We need that to run and secure a website, which is the legal basis for it (legitimate interests). We have not switched on Netlify’s analytics, we do not add anything to those logs, and we do not use them to find out who anybody is.

Every typeface, script, stylesheet and image on this site is served from this site, so opening a page makes no request to anybody but Netlify.

Searching the street

The search box on the street and on the Map does its searching in your browser. The first time you type in it, it fetches two files from this site, the list of rooms and the words on every page, and nothing else. What you type is never sent anywhere, to us or to anybody, and it is not kept: not in your browser and not in the address. Following a result is an ordinary link on this site.

When you press play

The jukeboxes, screens and players on the street are press-to-play: until you press one, this site has made no request to that service on your behalf. When you press, your browser loads that service’s player, and from then on the service receives what any website receives from you — your IP address, your browser details, and that you came from stimpunks.world (the site’s address only, not the page) — and may set its own cookies. What it does with that is covered by its own policy, not ours:

The recordings in Hear Queer Here, the Faery Yurt and the Playhouse are served from this site, and none of them loads until you press it either.

The bodymind break

I need a bodymind break, in the dial’s box at the top of a page, on the CB’s radio, and on the CB bar for anybody not signed on, opens a calm screen over the page you are on. It keeps nothing and sends nothing: the first press fetches its own script and stylesheet from this site, and that is all. The forest and the jellies on it are YouTube’s, and like every player on the street, nothing reaches YouTube until you press one; closing the break stops it. If something on the page is playing, the break offers to pause it, and pauses nothing by itself. While it is up, the radio reads nothing aloud. Its links to our Help page and to crisis lines and warmlines are ordinary links to stimpunks.org.

When you follow a link away

A lot of this site is links to other places. When you follow one, the site you arrive at learns that you came from stimpunks.world — the address of the site, never the page you were on — and from then on you are covered by that site’s policy.

People on these pages

Some pages carry photographs of people, recordings of people’s voices, and the names of the people we credit. Every photograph of somebody, and every recording of somebody’s voice, is published with that person’s consent, recorded in our files with a date — the readings in Hear Queer Here included — and it comes down when the person in it says so: one message, no reason needed. A young person who is doing the work and has said yes themselves is published and credited like anybody else; a parent’s yes does not stand in for theirs, and a child too young to give that consent is not published at all. The whole of that is on the Polaroid Wall’s page. The photographs are excluded from this site’s CC BY-SA licence precisely so that taking one down is something we can actually do.

The CB

The CB is a chat channel, patterned after citizens band radio. You join with an invite, on the joining page, which claims a username of your own with a password of your own, and after that you sign on at the Community Center or on the bar in the corner of any page. Until you sign on, the radio is not on any page and nothing is sent. Until 21 October 2026 the CB took a starter password the community shared, and a username was claimed only if you chose to; that password signs nobody on now, and a radio still on with it can only claim the username it is on.

• Before you sign on. A folded bar in the corner of each page, with a teleporter and a way to find out how to get on the CB. It is not the radio: it sends nothing to the channel, knows nothing about who is on it, and shows nothing that is said. Opening the teleporter fetches this site’s list of rooms, from this site, and nothing else is fetched. If you leave its panel open, your browser remembers that under love-cb-guest, and folding it away deletes it. You can sign on from it too, with your username and your password: that sends exactly what the front desk sends, only when you press Sign on, and then the radio takes its place.
• What it sends. While the radio is open on your screen and the tab is in front of you, it asks this site for the latest messages every few seconds, and the first time it does, or the first time you open its teleporter, it also fetches the list of rooms on the street, so that a room named with a # can be shown as a link and the teleporter knows where it can take you; that request carries nothing about you. With a claimed username it also asks us, once, which categories in the forums you can read, because each of them is a room on the CB that the public list does not name; that request carries your pass, the answer names only categories you can read, and nothing records who asked. Teleporting to a room, or to a room’s channel on the chat page, is an ordinary link on this site: it sends nothing to the channel and tells nobody where you went. Typing an @ into it asks us who is online, once, and narrows that list in your browser, so what you type after the @ is not sent. More below. Closed, folded down, or in a tab you are not looking at, it sends nothing. When you transmit, your handle and your words come to us.
• World, or this room. The radio hears one channel at a time. World is the one everybody shares, and listening to it tells us nothing about where you are on the street. This room is the room’s own channel, and to hear it the radio has to tell us which room it is, each time it asks. We do not keep that: nothing records who listened to which room. The radio starts on World, and it remembers which you chose, in your own browser. In the forums, this room is the category you are reading (Ryan’s call, 2026-10-21): a category’s page, a topic in it, or a new topic you start in it, and a category inside another is the room of the one it is in. Each category’s room is a room in every way, with its own channel, Be seen here, call and Follow this room, and only the claimed usernames that can read the category can hear it, be seen in it, call in it or be told about it, so a staff category’s room is its staff’s, as its topics are. The forums’ home, Latest, Mentions and Search are the forums’ own room. Going from one category to another tells us the new one the next time the radio asks, as walking into another room does. On the chat page (since 2026-10-22) the radio is docked into the page, and the channel you pick there is the one it hears, with that room’s Be seen here and call: picking one tells us which, the next time the radio asks, as walking into the room would, and nothing records it. The page keeps your pick only in its own address, after a #, which your browser never sends. Its Back and Forward (since 2026-10-29) are the tab’s own history: beside each step it holds, the page keeps a key and which kind of thing was in the middle (a channel, Events, a conversation, All messages or a search’s results), never who a conversation was with or what you searched for; who it was with is kept only while the page is open. None of it is sent to us. It marks what is new in the other channels from what Unreads already asks, and asks nothing more. If you sort the channels under tags by Recently active or Most active (Ryan’s ask, 2026-10-24), the page asks us once when it opens, when you choose the order and when you press Sort again, never as messages come in: we look at the channels you can hear and answer with two orders, newest message first and most messages in the last two weeks first, never a time or a number, leaving out any room that keeps to itself and any room you cannot go into, and counting none of the street’s bot’s messages. Nothing is kept for it and nothing records who asked. Which order you chose is kept in love-cb, in your own browser. A to Z, where everybody starts, asks nothing. If you choose My own order (Ryan’s call, 2026-10-24, so it follows you from one device to another), the order you arrange the channels into, group by group, is kept on our server under a scrambled form of your claimed username: which channels, in which order, under which group, and nothing about when, not when you arranged them nor how often. Arranging sends your pass and the whole of your order; opening the page with My own order chosen asks for it. A room that keeps to itself is never kept in it. Nobody else is sent it or told you have one, a moderator included. Forget me and deleting your username delete it. Search on the chat page (Ryan’s ask, 2026-10-27, after Discord’s) sends us your pass, the words you typed and the filters you chose, in the body of the request, never in an address, so they are in no log of addresses and not in your browser’s history. We look through the channels you can hear, as they are at that moment, and answer with the messages that match, newest or oldest first, a page at a time, and how many matched in all (Ryan’s call, the same day, as Discord says it): one number for the whole search, never how many on any one channel or from any one person. Nothing is kept for it: not your words, not what matched, and nothing records who searched for what. A room that keeps to itself is never searched, even by somebody who may go into it, and nor is a room you cannot go into, or your direct messages. The days you choose are worked out in your own browser, in your own calendar, and sent as times.
• A place in a film. Somebody can put a place like @34:12 in a message, and on every radio it is a button that moves the film on your page to that place. It never presses play, and nobody else can move your film: only your own press does. Add my spot reads where the film on your page has got to, and the film’s title and the room you are in, and writes them into your message box. The room’s name in a spot links to that room with the spot on the end of the address, after a #, which your browser never sends to any server, ours included; arriving that way gets that film’s play button ready to start at the spot, and nothing plays until you press it. The radio and the film talk to each other inside your browser. That sends nothing, to us or to YouTube, until you transmit it like anything else you type.
• What we keep. The latest hundred messages on each channel, World and every room’s, each with its handle, its words, the handles it @mentions, which message it replies to, if it is a reply, the time it was sent, the time its sender last edited it, if they did, whether it came from the base station or from a claimed username (since 2026-10-21 every username is claimed, so the radio no longer shows that one), the picture sent with it, if there was one, and its description, and the sticker, if it was one: a copy of what one of your pets looks like and is called, or of one of your avatars, its name and what you wrote about it, or of one of your chimeras, which animal gave each part and its name, or which patch, or which patches were on your battle jacket, taken when you sent it. Reactions are kept on the message they were pressed on: which reaction and the handle that pressed it, shown to everybody on that channel by handle and never as a number, and deleted with the message. Once a channel is full, the newest pushes the oldest off, picture and all. Every message is deleted two weeks after it was sent, unless the channel is set otherwise (below). That was Ryan’s call, 2026-10-25, after requests from our community for more to scroll back through, in channels like Pets above all; from 2026-10-18 it was 48 hours, because people on the street live in timezones all over the world and were missing what was said while they slept, and before that everything on every channel was deleted every day at midnight, Colorado time. A message keeps the time it was sent under: one sent on or before 2026-10-25, Colorado time, still goes at its 48 hours. Whoever sent a message can delete it sooner with Take off, picture, reactions and all, and a moderator can delete any message. Taking one off sends your pass, which message and which channel. There is no archive and no backup, and the only copy is one somebody makes into a forum topic.
• A picture. A screenshot or a photo sent on the channel is redrawn in your own browser before it leaves it, which takes off everything a camera or a phone writes into the file, where it was taken first of all; this site refuses a file that still carries any of it. It is kept only with its message and deleted when the message goes, and one that was never sent is deleted within the hour. It has no public address: only a radio signed on to that channel can fetch it, and a picture sent in one of the Town Hall’s private rooms only by the people that room is for. Download saves the copy your radio already holds onto your own device, which is yours; it asks us for nothing more.
• An @mention. Typing an @ into the message box offers the people who have spoken on the channel and the people on Who’s online, and the first one asks us who is online, once. A message keeps the handles it mentions, at most ten, so every radio draws them as names: your radio says who it means, and we keep only the ones the words really name. Who is told about a mention is unchanged, and only a device that asked is.
• A link to another site. An address on another site in a message is a link that opens in a new tab and says which site it goes to, and so is one with words of its own, [words](an address), whose site is written after the words. Following it sends that site nothing from here: no referrer, so it is not told which page of ours you came from, and nothing about the channel. What it does once you are there is up to that site.
• Copy. Copy on a message puts its words on your own clipboard, in your browser. It sends nothing, to us or anybody.
• Sealed at rest, in the staff rooms (since 2026-10-25, Ryan’s call). The channels of every room only some of us may enter (the moderators’, directors’ and board rooms, Executive Session, and every forum category with roles), the words of every call for a moderator left on the desk, and every picture sent on any channel are encrypted where they are kept at Netlify, with the staff key Tasks and the forums use, so somebody who got at the stored files alone could not read them. Every picture, not only the staff rooms’, because a picture is stored under a name that does not say its room. The World channel and the public rooms’ channels are not sealed: everybody signed on reads them. None of this is end-to-end: our server opens them for whoever may read the room. Without that key those channels and the pictures are shut rather than written in the clear, and anything written before that day is sealed within the hour.
• Replies (since 2026-10-21). A reply keeps which message it answers, and nothing else of it: not its words and not who sent it. Every radio draws the line above a reply from what is on the channel at that moment, so when the message answered is edited the line changes, and when it is taken off or its two weeks are up, the line says it answered a message no longer on the channel. Replying sends your pass, your message, which channel, and which message it answers, which must still be on that channel. It tells whoever sent that message only if they switched on When somebody replies to me.
• Edit. Whoever sent a message can change its words with Edit; a moderator can edit only their own, like everybody else. The words it had before are not kept, by us or anywhere: the message is rewritten where it is, says edited and when, keeps its picture, sticker and reactions, and still goes two weeks after it was first sent. Editing sends your pass, which message, which channel and the new words. An edit tells nobody about it unless it @mentions somebody it did not name before, and then it tells only them, if they asked to be told about mentions.
• Take to the forums. With a claimed username, Take to the forums on a message lets you tick messages on the channel and start a forum topic with them. Our server copies them from the channel itself, words, handles, marks and times exactly as they are on the channel, with edited on any their sender has edited, and they then last as long as the topic does. Pictures and stickers stay behind. Whoever sent a copied message can take it out of the topic again, and a moderator can. Ask everybody in the conversation first, as you would before a screenshot.
• How many messages a day. For our directors’ dashboard in the office, every message sent on World or in a room adds one to a count for its day: three numbers a day, for World, for the rooms, and for the rooms only some people can hear: the moderators’ rooms, and since 2026-10-21 the rooms of the forum categories only staff can read. No handle, no room, no words and no time go with it, so it says how busy the channels were and nothing about who was on them or where. Direct messages are not counted. Each day’s three numbers are kept for 400 days.
• What we do not keep. Your IP address is not stored with a message or anywhere else by us, and we do not write handles or messages into any log. We keep no list of who has signed on.
• Where it is kept. Netlify, our host, stores the channel for us and runs the small program that answers the radio, under Netlify’s privacy policy. Netlify’s ordinary logs record that the radio made a request, the same as for any page. Netlify also limits how often one address can try the password; it does that itself, without handing the address to us.
• Who can read it. Anybody signed on, which means everybody who has joined. That makes it a room full of people rather than a private line, so say on it what you would say in a room. A username signs on only with its owner’s password, so a name says whoever holds that password sent it, and nothing more about who they are. A moderator’s is marked BASE: our moderators’ usernames, and which of them hold the board, director or administrator role, are on a list that is not published. A username is put on it only after somebody has joined with it, and one on it that nobody has claimed cannot be claimed with an invite. The list is read each time a pass is checked and never written to by the radio, and the only thing a radio is told about it is its own roles, so that it can keep out of the Town Hall’s rooms it cannot use.
• The radio in a window of its own. Pop out moves the radio into a browser window of its own, which stays open while you go from room to room in the window you came from. It is the same radio with the same pass, and it sends what the radio on that page would have: it reads which page you are on, its address and title and what it says about itself, straight from that window, inside your own browser, to know which room you are in. Your other pages learn that it is out, and ask it to come back, over a channel that stays inside your own browser, and love-cb notes that it is out until the window closes. Nothing more about it is sent to us or kept.
• Links in a message become cards (since 2026-10-24, a request from our community). A bare address in a message on the channel, up to three of them, gets a card under the message. Our server reads each link once, just after the message has gone out, for words: the page’s title, its description and its site’s name, or what the site’s own oEmbed answer says (who made it, the site’s name and, for a post on X, Bluesky or the like, the words of the post), and for a video how long it runs. For a YouTube video it first asks YouTube’s own Data API, sending it only the video’s id, for its title, its channel, how long it runs and whether it may play here. The site sees a request from Netlify, our host, and never from you or from anybody reading the channel. The card is kept with the message and goes when it does. No picture is fetched from anywhere, and nothing a site sends to put on a page is ever put on ours. A YouTube or Vimeo video is a press-to-play player like every other on the street: nothing from YouTube or Vimeo loads until somebody presses it, and then only for whoever pressed. A link written in angle brackets, <https://…>, a link with words of its own, and a link to a room on the street get no card. A card is read again only for a link new in an edit.
• GIFs from Gifbox (since 2026-11-06, Ryan’s ask). GIF beside the message box opens a tray of GIFs from Gifbox, the GIF service run by the people behind Stoat, under its own privacy policy. Nobody’s browser ever talks to Gifbox: the tray asks our server, and our server asks Gifbox with our own key. What Gifbox is sent: the words you search for, only when you press Search or Enter and never letter by letter, which GIF is fetched for a still or picked, and nothing about who you are or where you are; Gifbox sees a request from Netlify, our host. We keep no record of what anybody searched for. The stills in the tray come through our server too, and your browser may keep its own copy of each for a day. A GIF you pick is copied onto the channel, its still and its little video, before you send it, and from then on it is kept exactly as a picture is: only with its message, deleted when the message goes, deleted within the hour if never sent, sealed at rest, and fetched only by radios that can hear that channel. Its description starts as Gifbox’s and is yours to change. Its still has anything written into it taken off, and a video that says where it was filmed is refused. A GIF never moves by itself, at any setting, because a GIF can flash: everybody sees its still until they press it, and pressing again stops it. From Gifbox under it opens its page on gifbox.me, in a new tab, which is the one way your browser reaches Gifbox, and only if you follow it. We never tell Gifbox what was shared. Gifbox offers no content filter, so a GIF on the CB is under the house norms like any other picture. GIFs go on the channel; not yet in a conversation under Messages.
• Our own emoji (since 2026-11-06, Ryan’s ask). Add Emoji in the picker under the message box makes a picture into an emoji anybody on the CB can use by its name between colons. Adding one sends your pass, its name and the picture, already made small in your own browser (at most 128 pixels across), and our server takes off anything still written into it. We keep its name, its picture, and a scrambled mark of the username that added it, which is never shown to anybody, ourselves included, and is how only you, or a moderator, can take it down; nothing about when, and no username, so it says only that it is from Stimpunks. Its picture is public: a picture in a message cannot carry a pass, so anybody can fetch it from its address, which asks search engines not to keep it, and a browser may keep its own copy for an hour. You say it is yours to share and that anybody recognisable in it has said yes before it goes. Taken down, its name and picture are deleted, and a message that used it shows its name in words. Nothing is counted: no most used, no popular, and no record of which emoji you use. One of our own can be a reaction too, kept on its message by name like any reaction. Our own emoji are drawn in the forums, Tasks and the office as well, which ask for the list once, with your pass, when they open. The emoji picker itself sends nothing: Unicode’s emoji are drawn by your device, their list comes from this site when you first open the tab or type : and two letters in the message box, and a search in it stays on your device.
• What is new to you, with a claimed username. The radio marks a channel or a conversation where something has been said since you last read it, and lists them under Unreads: a dot, never a number. So that reading on one device clears the dot on the others, we keep, for your claimed username, when you last read each channel and each conversation, and nothing else: not what you read, not how often, and nothing about anybody else’s reading. Each time is dropped once it is two weeks old, because nothing that old is left on the channel. A room that keeps to itself is never recorded. Nobody but you is ever sent it, a moderator included. Forget me and deleting your username delete it. To tell you what is new, the radio is sent the time of each channel’s newest message, as the World room shows anybody signed on, and never their words; which rooms you follow for it, or that you follow every room, is kept in your own browser.
• The Inbox, with a claimed username (since 2026-10-29, a request from our community after Discord’s, and Ryan’s calls). The tray on the radio’s bar opens four tabs. Unreads is the list above, and asks nothing more. Mentions sends us your pass when you open it, and we look through the channels you can hear and the forums for where somebody else has @mentioned you, or a role you hold, as they are at that moment, as Search would: nothing is kept for it, so when a message goes, it is gone from your Mentions too, and a room that keeps to itself is never looked in. Bookmarks and Reminders are the two things the Inbox keeps, on our server, under a scrambled form of your claimed username, as what you have read is: a bookmark is which channel and which message, and nothing else, not even when you made it, and a reminder is which channel, which message, the time you chose and whether you have been told. Neither keeps the message’s words: they are read off the channel each time you open the tab, so a message taken off the air or past its time is gone from your bookmarks and reminders too, and they say so. A message in a room that keeps to itself can be neither. So that a reminder can come due, one small list holds the next time each person’s reminders are due, by that same scrambled name, with no handle and no message; every five minutes it is read, each reminder that has come is marked told, once, and your own devices are told, if you have notifications on and have not switched reminders off. The radio is told whether one of yours has come due, yes or no, with what Unreads already asks. Nobody else is sent any of it, a moderator included. Forget me and deleting your username delete it all.
• What it does not do. No chimes, no badges, no number of anything; what is new is marked, above. If the radio is closed, nothing reaches you from it and nothing is saved up for later. A device you switch on for notifications is told about what you chose for it, and nothing else, and since 2026-10-25 what your devices are told is kept for you for 30 days.
• Speaking aloud. If you switch on Speak new messages aloud, the radio reads each new message out, handle first, using a voice built into your own device. It only uses voices your device says are on the device itself, so the words are not sent to a speech service anywhere else; some browsers also offer voices that are, and the radio will not use those. If your device has no voice of its own, nothing is spoken. Each message comes with a burst of radio static before it and the tail of static after, made in the page and not fetched from anywhere; at the Gentle setting the words come without it, and there is no static without a message being spoken. It is off until you switch it on, it only reads what arrives while the radio is open, and folding the radio away stops it mid-word. Read aloud, under a message’s three dots, reads that one message the same way when you press it, with the same voices only, and sends nothing anywhere either.

We keep a message because you sent it for other people on the channel to read, and keeping it for two weeks is what that takes. Transmitting is your consent to it, and you can take that back by asking us to delete what you said.

How long each channel keeps

Since 2026-10-25, Ryan’s call, our administrators can set how many messages a channel keeps and for how long, at the desk in the Moderators’ room: World, any room’s channel, every channel not set otherwise (the Slake’s places too), and direct messages, each on its own. A channel can keep 50, 100, 200, 500 or 1,000 messages, each for a day, two days, a week, two weeks, 30 days, 90 days, a year or for good. Unless it is set otherwise, a channel keeps its latest 100, each for two weeks. The radio says what the channel you are on keeps, as the first line under In this channel, so you know before you say anything.

• A longer time never reaches what was already said. Every message is marked, when it is sent, with how long its channel kept messages then, and it is never kept longer than that, whatever the channel is set to later. One exception was made, for the Pets channel on 2026-10-25: its two writers, Ryan and Norah, both said yes to what they had already said there being kept as long as the channel now keeps it. Nothing else has had that, and nothing will without everybody who wrote in a channel saying yes.
• A shorter time, or fewer messages, reaches everything at once: what no longer fits is deleted when the change is made.
• What the desk keeps about it: for each channel set, how many and how long, and which administrator set it last and when. Nothing about who read what.
• For good means as long as the channel keeps it: the newest still pushes the oldest off once the channel is full, Take off still takes a message off, and Forget me and deleting your username still delete what they always did.

Hosting a film

Anybody signed on to the CB can host the film they are watching, with Host this film on the radio, so that everybody else on the channel can see where it has got to and catch up. It is off until you press it, it is never remembered, and a new page starts with nobody hosting.

• What it sends, and when. Your pass, your handle, the room you are in, the film’s title, its YouTube id and how long it runs, the place in it and whether it is playing, and, when the film is one song or video in an album or a playlist, that list’s YouTube id. For a live video it sends that it is live, in place of a length and a place. The id is what lets everybody else’s radio find that film’s own play button on the page, when several films have nearly the same name, and the list’s id is what lets it find that album’s and go on through it with you, and how long it runs is what a play button says when a radio has to put one up (below). It goes when you start hosting, when the film plays, pauses, jumps or changes, and every half minute besides, and only while the radio is open and the tab is in front of you. Put the tab behind another and it stops sending until you come back; fold the radio away or leave the page and you stop hosting.
• What we keep. One record for each room somebody is hosting, holding exactly that and the time it was last heard. Every update replaces it rather than adding to it, so there is no history of what you watched or where you were in it. It is deleted the moment you stop hosting. If you go quiet instead, by folding the radio or leaving, it is shown to nobody seventy-five seconds after it was last heard, and it is gone for good at the next update from any host or at the hourly sweep, whichever comes first. There is no archive, no backup and no copy.
• Who can see it. Anybody signed on, on every page: their radio shows who is hosting which film in which room, and where it has got to. Everybody’s radio is sent every host on the street with the channel, so nobody’s radio has to tell us which room they are in to find the host for theirs. A room that keeps to itself is the exception: its host is sent only to radios tuned to that room’s own channel, and to nobody else.
• What it does not do. It moves nobody’s film. Catch up is a button on each person’s own radio, and only their press moves their film, the same as a place in a message. Follow, beside it, keeps your film in step with the host’s, playing, pausing and moving with it, on to the next song of an album with it, but only once you have pressed it yourself; it sends nothing, it is never remembered, and your own pause ends it. One person hosts a room at a time, and only the base station can take a room over.
• A moderator’s own video. A moderator can paste the address of one YouTube video into Screen a video on the radio, and it goes up on the first screen of the page they are on. It plays on their page and nowhere else, and nothing is sent to us until they host it. If they do, pressing Catch up or Follow beside them puts that video’s play button on the first screen of your page, in place of what it had, saying how long it runs and who put it there. Nothing reaches YouTube until you press it, and the screen’s own controls put back what was there. On a set you tune, like the Solarpunk Hermitage’s television, Looming Rocks’ stage or the Rebellion Rave Room’s big screen, it is tuned on the set, which stays off until you press play. Only a moderator’s hosting can do this, and our server, not their radio, says whose hosting is a moderator’s.
• In a popped-out call. Show the film, on the bar of a call’s own window, shows the film somebody is hosting in the call’s room, above the call, as its play button. While it is shown and the window is in front of you, the window asks us for that room’s host every six seconds, with your pass and the room’s name, which joining the call has already told us; Hide the film stops it, and nothing is kept. It puts up a film only when the room’s own page has a play button for it, or when a moderator is hosting it, the same rule as above, and otherwise says in words what is being hosted. Nothing reaches YouTube until you press play, and Catch up there moves only your own film.
• What we do not keep. The same as the radio: no IP address, nothing in any log, and no list of who watched.

We keep that you are hosting because you pressed Host this film so that other people could see where you are, and keeping it while you are hosting is what that takes. Pressing it again takes that back.

Being seen in a room

Signed on to the CB, the radio has a switch, Be seen here, in every room on the street. It is off until you press it, and once pressed your browser remembers it, so you are seen in each room you open with the radio until you switch it off. Since 2026-10-07, being seen puts you on the radio’s Who’s online list, for anybody signed on to the CB, with the room you are in. Before that it showed you only to people seen in the same room. If you switched it on before then, it now does more than it did when you pressed it, and switching it off takes you off the list at once.

• What it sends, and when. Only while you are seen, the radio is open, and the tab is in front of you: every few seconds, your pass, which room this page is, and a random number the page makes up for this visit, which nobody else is shown. Switch it off, fold the radio away, put the tab behind another or leave the page, and it tells us you have gone and sends nothing more.
• Who can see you. Anybody signed on to the CB, seen or not, on Who’s online: your username, whether it is the base station, and the room you are in. Anybody else seen in the same room sees you there too, and only they are shown who is in that room’s call. Names come in alphabetical order and nobody is shown a number. A room the base keeps, and the room of a forum category only staff can read, is named only to the people it is for, and somebody seen only there is on nobody else’s list. A room that keeps to itself is named to nobody: being seen there shows you only to people seen there. Moderators see the same, by the same rules, on their list of every username, with how many are seen now.
• What we keep. While you are seen, one record: your handle, whether you are the base station, whether your handle is a claimed username, which room, the time of your last check and the visit’s number. Opening another room replaces it rather than adding to it, so which rooms you have been in is not kept. It is shown to nobody thirty seconds after your last check, and deleted when you stop being seen, or within two minutes by anybody else’s check, or by the hourly sweep at the latest.

We keep that you are in a room because you chose to be seen there, and keeping it for as long as you are is what that takes. Pressing Be seen here is your consent to it, and pressing it again takes that back.

Showing your avatar in 3D rooms

On Cel Street, the street drawn in 3D, walking into a room makes the radio that room’s, so you chat on its channel with whoever is in it, on its own page or on Cel Street. With a claimed username, the radio there has a second switch, Show my avatar in 3D rooms, under Be seen here. It is off until you press it. It is new on 7 November 2026, Helen Edgar’s ask, and it is the first time the street has kept where in a room somebody is, so it is written down here first.

• What it shows. The avatar you wear on the CB, drawn as a 3D figure, standing at the place in the room you are standing at, such as the tea table, and moving when you move to another place. Never your exact spot, only which of the room’s places.
• Who can see it. Only people seen in the same room as you, while you are seen there too: the same people Be seen here already shows you to. It is never on Who’s online.
• What it sends, and when. Your pass, which room and which of its places, when you switch it on and each time you move to another place. Out on the street, it sends that you are in no room.
• What we keep. Which room and which place, under a scrambled form of your username, and nothing about when: no history of where you have been, because each move replaces the last. Leaving the room, switching it off, Forget me and deleting your username delete it, and with no avatar worn nothing is shown. Nobody is told who looked.

Who’s online

Who’s online, beside World and This room on the radio, lists everybody seen in a room and which room, with a link to go there, and, beside a claimed username, the avatar its owner wears on the CB, if they wear one (below), the chat status they chose, if they chose one (below), and their availability, if they set one (below), except a room that keeps to itself, which is never on it. While its panel is open, the radio is open and the tab is in front of you, it asks us every few seconds, sending your pass and nothing else. Typing an @ in the teleporter asks the same once and narrows the list in your browser, so the letters you type are not sent. Nothing records who looked, or when.

Your chat status

Signed on to the CB, Your chat status, under Your status & availability on the radio, says whether you would like to be talked to, with one of the interaction badges: come say hi, people i know or not right now. It is not Be seen here: being seen says you are in a room, and a chat status says whether you want to be talked to, wherever you are.

• It starts as none. Nothing is shown beside your name until you choose a badge, and it stays until you change it. Nothing changes it for you: it never goes to idle or away when you stop typing, and it never runs out.
• Who can see it. Anybody signed on to the CB: beside your name on Who’s online and to people seen in the same room as you, on your profile, and at the top of a conversation with you under Messages, so it can be checked before anybody writes. It is a sign and not a lock: it stops nobody writing to you.
• What it sends, and when. Your pass and the badge, when you choose one. The radio’s own ask of what is new to you, while it is open, brings your badge back, so one chosen on another device reaches this one.
• What we keep. Which badge you chose, under a scrambled form of your username, and nothing else: not when you chose it, not how often you change it, and nothing about who looked. Choosing none takes it away at once, and so do Forget me and deleting your username.

We keep your chat status because you chose it so that people could see it, and keeping it is what that takes. Choosing none takes that back.

Your availability

Signed on to the CB with a claimed username, Your availability, under your chat status on the radio, says whether you are around for working together: Available, Busy, Away, Do not disturb or Out of office, with a line of your own words if you like (one line, at most 100 characters), or Not shown.

• It starts as Not shown, and only you change it. Nothing is shown beside your name until you choose, and it stays as you left it. Nothing sets it for you unless you switch on Away by itself (below): it never turns to Not shown after a while unseen, and it never runs out. Not shown looks exactly like never having chosen.
• Away by itself starts off, and only you switch it on. Under your availability you can choose to be shown as Away when the CB has not heard from your radio for 5, 10, 15, 30 or 60 minutes. It only ever stands in for Available or Busy, and without your line; Away, Do not disturb and Out of office stay as you chose them, and what you chose is never changed, so the next time any radio of yours is open it shows as before. The CB hears from your radio only while it is open and its page is in front, so a folded radio, a page behind another, or a closed laptop all count as away. While it is on, we keep the minute your radio last asked what is new to you, beside the minutes you chose, under the same scrambled form of your username. Nobody is sent that minute or your choice of minutes, but anybody watching your name can tell, to within those minutes, when you stepped away. Switching it off takes both away at once, and so do Forget me and deleting your username.
• Who can see it. Anybody signed on to the CB: beside your name on Who’s online and to people seen in the same room as you, on your profile, and at the top of a conversation with you under Messages. People who use Tasks and the office see it beside your name there too, when they assign a task or mention you. It is a sign and not a lock: Do not disturb and Out of office stop nobody writing to you, and nothing is ever sent on your behalf, so there is no automatic reply.
• It does not silence anything. Do not disturb asks people to hold what can wait. Your notifications are your own switches, device by device, and it changes none of them.
• What it sends, and when. Your pass, the state and your line, when you choose them, and the minutes for Away by itself when you choose those. The radio’s own ask of what is new to you, while it is open, brings them back, so a choice made on another device reaches this one; with Away by itself on, that same ask is the CB hearing from you.
• What we keep. Which state you chose and your line, under a scrambled form of your username, and nothing else: not when you chose it, not how often you change it, not when you were last seen unless you switch on Away by itself, and nothing about who looked. Choosing Not shown takes both away at once, and so do Forget me and deleting your username.
• What stays in your browser. So that a state left on yesterday does not go on saying something untrue, the radio asks once, on another day, whether it is still true, with Keep it, Not shown and Change it. The day you last chose or kept it is kept in love-cb in this browser, and the radio never sends it; until you press something, nothing anybody else sees changes.

A room’s call

People signed on to the CB can join a voice and video call for the room they are in, with Join this room’s call on the radio, and in the rooms behind Cavendish Coworking’s doors from the room itself. Three of those calls are open to anybody; see below. The rooms off the Town Hall for our directors, our board and our moderators are the other way round: anybody can walk in, and their channel, their call and any film hosted in them are handed to the base and to nobody else, so nobody else’s radio hears anything about them. The call is run by 8x8’s Jitsi as a Service, not by us, and it opens in a window of its own at the foot of the page.

• What we send, and to whom. Pressing the button asks this site for a pass into that room’s call, which carries your handle and whether you moderate that call: the base station moderates every call, and nobody else does since guests went (2026-11-01). We sign it and send it back; your browser hands it to 8x8 when the call opens. 8x8 sees your handle, as your name in the call, an id we make from your handle so that 8x8 counts one person once, and which room it is.
• What 8x8 gets. Whatever any video call gets: your IP address and browser details, and, once you join and switch them on, your camera, your microphone, and any screen you share. Jitsi’s own chat is switched off in every call, so nothing you type goes to 8x8. What 8x8 does with that is covered by 8x8’s privacy notice, not by this page.
• A call’s chat is the room’s channel. Since 2026-11-01 (Ryan’s call), Jitsi’s own chat is switched off in every call, so the room’s channel on the CB is where the people in a call type to each other, and a conversation’s call has the conversation. That means what is typed during a call is kept the way the channel keeps it, for two weeks unless our administrators set that channel otherwise, and not only while the call lasts, as Jitsi’s chat was.
• Camera and microphone. Both start off. Opening the window may make your browser ask about them, so the call’s first screen can show you a preview; nothing goes to the call until you join on that screen. The call is the only thing on this site allowed to ask for a camera, a microphone or a shared screen, and our pages never ask for any of the three themselves.
• Sharing a YouTube video in a call. Anybody in a call can share a YouTube video for everybody in it to watch together, from the call’s own menu. That is Jitsi’s feature, and when somebody uses it, Jitsi loads the video from YouTube itself (youtube.com, not the no-cookie address our own players use) in the call window of everybody in the call, so YouTube gets what it gets from any of its players, and may set its cookies, under Google’s privacy policy. Jitsi’s analytics, its avatar lookups and its animated-picture search stay switched off.
• No guests. Until 2026-11-01 the calls behind Cavendish Coworking’s Events, Operations and Editorial doors let in somebody not signed on, under a name they typed, to knock and wait in a lobby. Nobody had needed it, so Ryan took it out: every call is for people signed on to the CB, nobody types a name for a call, and 8x8 no longer asks us whether a meeting has a lobby.
• Recording and transcripts. The base station can record a call or turn on live transcription, and nobody else can. Jitsi shows everybody in the call when either is on. A recording or transcript is kept by 8x8, under its notice.
• Sharing a file. Anybody in a call can share a file there, a screenshot or a photo, from the call’s own Share file. The file goes to 8x8 and to the people in the call, never to us, and we keep nothing about it. 8x8 does not publish how long it keeps a file shared in a call, so share nothing there you would not want kept, and nothing with somebody else in it who has not said yes. For anything to be kept, or kept to the people it is for, the forums are the place. The CB’s own channel forgets everything after two weeks.
• Who is in a call is shown before anybody joins. 8x8 tells us when somebody joins or leaves a room’s call, and when the call opens and closes, and the radio of anybody signed on who has chosen to be seen in that room shows the names of everybody in its call: their handles, in alphabetical order, with no number. A room the base keeps, and a staff category’s room in the forums, shows its call only to the people it is for. Since 2026-11-06 the same names are shown to anybody who may go into the room. What 8x8 sends is checked against a secret we share with 8x8, and what does not match is not believed.
• An event on now in a call names who is in that call. Since 2026-10-29 (Ryan’s call, from a proposal to join an event’s call straight from the chat page and see who is there first): while an event scheduled in a room’s call, or on the World call, is going on, its card under Events shows the names of everybody in that call, the same names as above, alphabetical and with no number, to everybody who can see the event, whether or not they are seen in the room. That is wider than the rule above, on purpose: the call is an announced gathering while the event is on. Before the event starts and after it ends, its card says nothing about who is in the call, and an event in a room rather than its call never names who is in the call. Nothing more is kept for it, and nothing records who looked.
• Who is in a call is shown to anybody who may go into the room. Since 2026-11-06 (Ryan’s calls, by popular request, after Discord, which lists the people in a channel’s call under the channel): on the chat page, every channel whose call has somebody in it shows the names of everybody in that call under it, and the same evening the radio’s Who’s online and its Happening now began showing them too. They are the same names as above, alphabetical and with no number, each with the avatar that person wears on the CB, and each opens that person’s profile when pressed, and they are shown to anybody signed on who may go into that room, whether or not they are seen there. That is wider than the rule above, on purpose: it is how people find a call to join. A room the base keeps, and a staff category’s room in the forums, names its call only to the people it is for; a room that keeps to itself is never named; and a call with somebody you are messaging is never shown, because nothing is kept about it. It is read from the records below each time the radio listens or Who’s online is open, and the avatars from the one copy of who wears which that Who’s online already reads; nothing more is kept for it, and nothing records who looked.
• A call with somebody you are messaging. Since 2026-10-29, Join call on a conversation in the list on the chat page opens a call for the two of you, once the conversation is accepted and while neither of you has blocked the other. It is run by 8x8 like a room’s call, and 8x8 gets the same: your handle, the id we make from it, and a name for the call that we make from the two of you and that says nothing about either. Only the two of you can get a pass into it. Unlike a room’s call, we keep nothing about it: when 8x8 tells us somebody joined or left it we ignore what it says, so who is in it is never shown anywhere and it is never on Who’s online. Opening it rings the other person (since 2026-10-29, Ryan’s ask), but only on devices they switched on for When somebody I’m messaging opens a call with me, which is off until they switch it on: it says who opened the call and nothing else, and pressing it opens your conversation, where Join call is. It rings each time either of you opens the call, the second person included, because we keep nothing that would say whether anybody is in it. Nothing else tells anybody, and nothing is kept about the ring but what any notification keeps in your past notifications, without words. Nobody moderates it, and nobody, the base station included, can record it or turn on transcription.
• The World call. Since 2026-10-13 there is one call that is no room’s: Join World call on the radio opens it from any room, for anybody signed on to the CB. It is a room’s call in every other way, run by 8x8, with the same pass, the same record while you are in it and the same deletion when you leave. Since 2026-10-18 it is the call of the World room too, so, as in every room, somebody seen in the World room is shown who is in it, and since 2026-11-06 so is anybody signed on, as with every call. Like every call it hangs up when you leave the page, a move to another room included, unless it is popped out.
• A call in a window of its own. Pop out on a call moves it into a browser window of its own, which stays open while you go from room to room. That window asks for a new pass into the call with your CB pass, exactly as joining does, and keeps nothing; which call to open is in the part of its address after the #, which your browser never sends to us. The radio on your other pages learns which call the window holds, and asks it to hang up when you press Leave, over a channel that stays inside your own browser. Nothing about it is sent to us or kept.
• Which calls are going is shown to anybody signed on. Since 2026-10-13 the radio’s Who’s online names the World call and every room whose call has somebody in it, for anybody signed on to the CB, seen or not, and since 2026-10-27 the radio hears the same list each time it listens, so its Happening now can say a call is going in the room you are in: the room, and since 2026-11-06 who is in the call, but never how many. A room the base keeps is named only to the people it is for, and a room that keeps to itself is never named. It is read from the records below, nothing more is kept for it, and nothing records who looked.
• What we keep. While you are in a call, one record: your name in the call, whether you are a moderator, the time you joined, and 8x8’s id for you, scrambled so it cannot be looked up. No email, and nothing else 8x8 sends. It is deleted when you leave, when the call closes, or by the hourly sweep once it is older than a pass into a call can be. Somebody’s leaving is remembered, without their name, for an hour, so that a late message from 8x8 cannot put them back. We do not keep who was in a call once they have left, when they joined before, or for how long. The pass is signed and handed back, and not stored.
• Leaving. Leave the call, or leaving the page, hangs up.

The World room

The World room, past the Garden, is every room on the street on one web, and anybody can read the list. Signed on to the CB, you also see which rooms are active now. The World room’s own channel is the CB’s World channel, and its own call is the World call.

• What it shows, for every room you may go into: who has chosen Be seen here in it, as Who’s online already shows; whether its call has somebody in it, as Who’s online already says, and never who; and the time of the latest message on its channel, which keeps two weeks, and which until now only somebody tuned to that room could see. Never the words. Nothing at all is shown about a room that keeps to itself, and the Town Hall’s private rooms only to the people they are for.
• Most active, Ryan’s call. Sorting by most active puts first the rooms with the most people seen in them and in their calls. To work that out, our server counts them each time somebody asks, and sends the order and never the numbers; but the order itself says which rooms have more people in them than others. It is the one place on the street that counts people. Nothing is kept for it.
• What it sends. While the World room is open and in front of you, signed on, it asks us every half minute and when you come back to it. Each request carries your pass and nothing about where you are, and nothing records who asked.
• Its call is the World call. As in every room, if you choose to be seen in the World room you are shown who is in its call, which is the World call, and so is everybody else seen there; since 2026-11-06 anybody signed on is, seen or not.

The Feed’s and The Source’s channels

Since 2026-10-23 (Ryan’s ask, after Discord’s feed bots), the CB channels of The Feed and The Source hear each new arrival as it comes in: every quarter of an hour our server reads the feeds on The Feed’s boards and the commit feeds on The Source’s terraces, and says anything new on that room’s channel, under the room’s own name and marked BOT.

• What it reads. Our own sites’ public feeds, and GitHub’s public feed of commits for each of our repositories, from our server. Nothing about you goes with those requests, and nobody’s visit to the street causes one.
• What it says. A new item’s site, its name and where it goes, and for a commit its short id, its day and the names it gives for who made it, never an email address. Never the words of the thing itself. It is a message like any other: on its channel for two weeks, with reactions and replies, and our moderators can take one off. Nobody can edit it, and its name, The Feed or The Source, cannot be anybody’s username.
• What we keep for it. For each feed, the ids of the items it last carried and the version our server last read, so nothing is said twice. Nothing about anybody.
• It never pushes a person’s message off a channel. When a channel is full, the bot’s oldest go first, and it keeps at most thirty of its own on one.
• Who is told. A device that follows that room by name under notifications is told about each new arrival there, with its site and name unless the words are switched off. Follow every room does not take them in: that switch is for people’s talk, and a phone that pressed it did not ask to be told about every commit to the street.

The chalkboard

Plural Mural has a chalkboard leaning against the foot of its wall, for leaving a note to whoever comes by next. It was Helen Edgar’s idea. It is part of the CB and runs on the same rules, with two differences, both written above the box you write in: anybody can read it, and a note stays up for seven days, where a message on the channel stays two weeks.

• Who can write on it. Only people signed on to the CB. Writing sends your handle, your note and your pass to us, the same as transmitting on the radio.
• Who can read it. Anybody who opens Plural Mural, signed on or not. That makes it a board in the street rather than a room, so write on it what you would write on a board in the street. A username says whoever holds its password wrote it, and nothing more about who they are. The board’s answers ask search engines not to index or archive it; that is a request they honour rather than a lock.
• What we keep. The latest thirty notes, each with its handle, its words and the time it went up. A thirty-first rubs out the oldest. Every note is deleted seven days after it was written, and the base station can rub one out sooner. There is no archive, no backup and no copy.
• What we do not keep. The same as the radio: no IP address, nothing in any log, and no list of who wrote or who read.
• Where it is kept. Beside the channel, at Netlify, under Netlify’s privacy policy.

We keep a note because you chalked it up for passers-by to read, and keeping it for the week is what that takes. Writing it is your consent to that, and you can take it back by asking us to rub it out.

The pebble bowls

The Solarpunk Hermitage and the Faery Yurt each have a bowl by the door for leaving a pebble: a line of your own, and a link if the thing is somewhere else. It was Helen Edgar’s idea. Each bowl is part of the CB and runs on the chalkboard’s rules: anybody can see what is in it, and a pebble stays for seven days. The basket beside it, of things the host has put out to take, is part of the page and sends nothing: taking one is following a link, and nothing records that you did.

• Who can leave a pebble. Only people signed on to the CB. Leaving one sends your handle, your words, the link if you gave one, which room it is for, and your pass to us, the same as transmitting on the radio.
• Who can see it. Anybody who opens that room, signed on or not, so leave in it what you would leave by a door somebody else walks through. A username says whoever holds its password left it, and nothing more. The bowls’ answers ask search engines not to index or archive them.
• What we keep. For each room, the latest thirty pebbles, each with its handle, its words, its link and the time it was left. Every pebble is deleted seven days after it was left, a thirty-first lets the oldest go, and the base station can lift one out sooner. There is no archive, no backup and no copy.
• What we do not keep. The same as the radio: no IP address, nothing in any log, no list of who left or who looked, and nothing about what anybody took from a basket.
• Where it is kept. Beside the channel and the chalkboard, at Netlify, under Netlify’s privacy policy.

We keep a pebble because you left it for whoever comes to that door, and keeping it for the week is what that takes. Leaving it is your consent to that, and you can take it back by asking us to lift it out.

Pando Calrissian’s tree

Pando Calrissian has one tree on a hillside, which anybody signed on to the CB can water, and a fence beside it for notes. Both are part of the CB. The tree is kept for good, and what it keeps is a number.

• Who can water it. Only people signed on to the CB. Watering sends your pass to us, so the tree knows somebody signed on is holding the can. The pass is checked and not kept, and nothing about who watered is written down: not your handle, not when you watered, not how often.
• What the tree keeps. How many times it has been watered, and the time of the last watering, so it can tell everybody when the ground will take more. Nothing else. That number never expires and is never reset. It is not personal information about anybody, because it cannot be traced to anybody.
• The fence. The chalkboard’s rules exactly. Only people signed on can pin a note, which sends your handle, your words and your pass to us; anybody who opens the room can read it; the latest thirty are kept, each with its handle, its words and the time; every note is deleted seven days after it went up, and the base station can take one down sooner. A username says whoever holds its password wrote it, and nothing more. Its answers ask search engines not to index or archive it.
• What we do not keep. The same as the radio: no IP address, nothing in any log, no list of who watered, who pinned a note or who looked, and no copy or backup of the tree or the fence.
• Where it is kept. Beside the channel and the chalkboard, at Netlify, under Netlify’s privacy policy.

We keep a note because you pinned it up for whoever comes up the hill, and keeping it for the week is what that takes; pinning it is your consent to that, and you can take it back by asking us to take it down. The tree’s number is kept because it is the tree, and it holds nothing of yours.

The Fridge of Sighs

The Fridge of Sighs is a fridge door covered in word magnets, where a sentence is built one word at a time by whoever comes in. It is part of the CB. Finished sentences are kept for good, and that is only simple because none of them holds anything about who wrote it.

• Who can put up a word. Only people signed on to the CB. Putting one up sends the word and your pass to us. The pass is checked and not kept.
• The one thing kept about anybody. To stop anybody putting up two words in a row, the fridge keeps a mark saying the last word was yours: your handle, scrambled with a secret kept in the site’s settings on Netlify, so it cannot be looked up from a handle without that secret. It is replaced by the very next word, from anybody, and it is never shown to anybody, sent to any page, or stored with a sentence. Nothing records who put up any other word.
• What the fridge keeps. The words on the line so far, the finished sentences, and the time each one was finished. The newest forty stay on the door, and older ones are filed by month into the drawer. They are kept for good, with no names in them, and the base station can take a word or a sentence down.
• Who can read it. Anybody who opens the room, signed on or not. Its answers ask search engines not to index or archive it.
• What we do not keep. The same as the radio: no IP address, nothing in any log, no list of who put up words or who looked.
• Where it is kept. Beside the channel and the chalkboard, at Netlify, under Netlify’s privacy policy.

A word you put up is part of a sentence that belongs to everybody who added to it, which is why it is kept with no name on it. If something on the door should not be there, ask and we will take it down.

Count Me In’s stair

Count Me In is a stairwell everybody climbs together, a number to a step, with a chairlift beside the stair. It is part of the CB, and what it keeps for good is two numbers.

• Who can take a step. Only people signed on to the CB. Taking a step sends your pass to us, and the number you typed; riding the lift sends your pass and no number. The pass is checked and not kept.
• The one thing kept about anybody. To stop anybody taking two steps in a row, the stair keeps a mark saying the last step was yours, the same kind of mark as the Fridge of Sighs: your handle scrambled with that secret. The very next step replaces it, and it is never shown to anybody or sent to any page. Nothing records who took any other step, or whether anybody came up by the stairs or the lift.
• What the stair keeps. The step it is on, the highest step it has reached, and where it had got to the last time it went back to one, with the time. The highest step is kept for good. None of it is personal information about anybody.
• Who can read it. Anybody who opens the room, signed on or not. Its answers ask search engines not to index or archive it.
• What we do not keep. The same as the radio: no IP address, nothing in any log, no list of who climbed or who looked, and nothing about who put the number that sent the stair back to one.
• Where it is kept. Beside the channel and the chalkboard, at Netlify, under Netlify’s privacy policy.

The Brass Tacks Board

The Brass Tacks Board is for posts meant to last: news, notices, events and celebrations. Anybody can read it, and it has a feed of its own, so its posts reach feed readers and search engines may find them.

• Who can post. Only our moderators, signed on to the CB as moderators. Posting sends their pass, the title, the words and the picture, if there is one; the pass is checked and not kept.
• What we keep. Each post’s title, its words, the moderator’s username, when it went up and when it was last edited, and its picture and description. The username is public on the post, on purpose, so anybody can see who put it up. Posts are kept until a moderator takes them down; there is no other copy and no archive, and nothing about who reads the board is kept or counted.
• Pictures. A picture is redrawn in the moderator’s browser before it is sent, which takes off everything a camera writes into a file, where it was taken first, and the board refuses one that still carries any of it. It must have a description, and the moderator says that everybody recognisable in it has said yes to it being on the board. It is served to anybody from this site, and deleted when its post is taken down or its picture changed; one that never made it onto a post is deleted after a day. If you are in a picture on the board and want it down, ask any moderator, and they will take it down.
• Where it is kept. Beside the CB, at Netlify, under Netlify’s privacy policy.

The notice

Our moderators can put up one line along the top of the street’s front page, the Community Center, Home, the forums and the office’s dashboard, for news everybody should see.

• What opening those pages sends. Each asks this site for the notice, once, with nothing of yours in the request: no pass, nothing you typed, nothing from your browser’s storage. Nothing is kept about who asked, and nothing is counted.
• Putting it away. The notice has a Put it away button. Pressing it keeps a short code worked out from the notice’s words in your own browser, under love-notice, so it stays away on every page it is on until a new notice goes up, and changing even a letter of the words counts as a new one. That is never sent to us, and nothing tells us who put a notice away.
• Who can put one up. Only our moderators, from the desk in their room, signed on to the CB as moderators. Doing it sends their pass and the words; the pass is checked and not kept.
• What we keep. The notice up now, or that there is none, and which moderator put it up or took it down last, and when. The pages show only the words; the moderator’s username and the time are shown to the other moderators at the desk. There is one notice at a time, and a new one replaces the old: there is no archive.
• Where it is kept. Beside the CB, at Netlify, under Netlify’s privacy policy.

The suggestion box

The suggestion box in The Sandbox is where anybody signed on to the CB can drop in a suggestion, a feature request or a bug report, and where our moderators answer them. Anybody can read what is in it, signed on or not, the way anybody can read the Brass Tacks Board; its answers ask search engines not to keep them, and it has no feed.

• Who can drop something in. Anybody signed on to the CB. Dropping one in sends your pass, what kind it is, its title and its words; the pass is checked and not kept.
• What we keep. Each one’s kind, title and words, your handle, public on it, on purpose, when you dropped it in, and the mark your pass gave it: BASE for a moderator, which nobody can set themselves. (A box from before 2026-10-21 may also say a suggestion came from a claimed username; every username is claimed now.) Under it, every reply from you or a moderator (since 2026-10-25 a suggestion has a thread of them, where it had one answer): its words, the username on it, public, when it was sent and last edited, and whether a moderator’s reply marked it done, not doing or open again. Where a suggestion stands is worked out from those replies and kept nowhere else. A suggestion and a reply can each carry pictures, below. Me too: the handle of everybody signed on who pressed it, to say a suggestion affects them too, public on the suggestion, alphabetically, and never shown as a number. It is not a vote, and nothing in the box is sorted by it. A device can be told when there is something new in the box for it, only if it switched that on: see notifications. Nothing about who reads the box is kept or counted, and nothing in it is counted, ranked or voted on.
• How long. Until it is taken down: by you, from the box, or by any moderator, with every reply and Me too on it. A reply stays until whoever wrote it or a moderator takes it down, and a Me too until whoever pressed it presses it again; editing a reply keeps nothing of what it said before. A suggestion from a claimed username comes down only for that username’s own password, the same as a message on the channel. There is no other copy and no archive. The box holds a few hundred at most; a full box refuses the next one and says so, rather than quietly pushing the oldest out.
• Pictures. This reverses what this page said when the box opened, that it takes words only, because a screenshot of a bug is a picture of somebody’s screen: Ryan’s call, 2026-10-25, so a bug report can show what went wrong. A suggestion can carry up to four pictures, and so can every reply under it. Each is redrawn in your own browser before it is sent, by the same code the CB uses, which takes off everything a camera or a phone wrote into it, where it was taken first of all; our server refuses one that still carries any of that. Each needs a sentence saying what it shows, which is what a screen reader says in its place. A picture in the box is as public as its words: anybody can see it, signed on or not, at an address of its own that asks search engines not to keep it. A screenshot shows whatever was on your screen, so the box asks you to say you have looked at all of it: no messages but your own, no faces from a call, nothing from your other tabs, emails or notifications, and that anybody recognisable in it has said yes. We keep each picture, its description, when it was added, and a scrambled mark of the username that added it, which is never shown to anybody and is how only you can put your picture in the box. A picture goes the moment its suggestion is taken down, or the reply it is on is edited without it or taken down. One you added and never dropped in is never shown to anybody, and is deleted after a day. A browser that has shown somebody a picture may keep its own copy of it for ten minutes.
• Not for a security problem, which everybody could read there: report it privately, as below.
• Where it is kept. Beside the CB, at Netlify, under Netlify’s privacy policy.

Notifications

Notifications, under Your radio on the CB, can switch a device on to be told about the CB, even with stimpunks.world closed. It reverses what this page used to say, that there were no notifications at all. That was Ryan’s call, 2026-10-18, after several requests from our community, and especially from our staff, as more of our chat and work moves onto the street.

• Sealed at rest (since 2026-10-25, Ryan’s call): every device’s record, its delivery address and keys included, is encrypted where it is kept at Netlify, with the staff key Tasks and the forums use, because a delivery address works like a password for sending that device a notification. Without that key no device can be switched on or off, and nothing is written in the clear.
• What can notify you. These, each off until you switch it on: somebody @mentioning your handle on a channel you can hear, or in a post in the forums that your claimed username can read; somebody replying to one of your messages on a channel you can hear (since 2026-10-21); somebody giving you props, which wait in Profile for you to confirm or reject; somebody sending you a direct message; somebody you are messaging opening a call with you (since 2026-10-29); any message on a room you follow, and on The Feed’s and The Source’s channels each new arrival, but only if you follow that room by name; a call starting in a room you follow, or the World call; every message on World; and, for our directors, board members and administrators, something new in your Notifications in Tasks (since 2026-10-21); and events, one you said you are interested in starting, and a new one on World or in a room you follow (since 2026-10-23); and the suggestion box (since 2026-10-25, Ryan’s ask and Norah’s): a moderator replying to a suggestion you dropped in, and, offered only to our moderators, something new in the box, a suggestion dropped in or a reply from whoever dropped it in, so whichever of them switch it on know without watching the box. One starts on: When a reminder I set comes due (since 2026-10-29, Ryan’s call), because you asked for that one yourself when you set the reminder; switch it off and your reminders are only marked in the Inbox. It tells only your own devices, says whose message and where, and its first words if the device wants words and the message is still on the channel. One more switch, Everything, and anything added later, switches on every one of them at once and any kind of notification we add after you press it, so a new kind reaches you without asking you first: that was asked for by somebody in our community, and is Ryan’s call, 2026-10-19. It leaves the words and the rooms you follow as you set them. Follow every room (Norah’s ask, 2026-10-21) follows every room your pass can go into at once, rooms that open later included, instead of one at a time; it is not a kind of notification, so Everything leaves it as you set it too. You are never told about your own messages. An edited message tells only somebody it @mentions that it did not name before, and nobody who follows the room again. A room that keeps to itself tells only the devices that follow it there, by name and never by Follow every room, so a mention or a reply there tells nobody else. A reply to a message sent under a claimed username tells only the devices switched on as that username.
• Calling a role. Since 2026-10-23 (Ryan’s ask), @moderator, @director, @board and @administrator call everybody who holds that role, the way an @ before somebody’s handle calls them: on a channel, in a post in the forums, and in a task or a comment in Tasks or the office. Anybody signed on can call @moderator, which is how to ask our moderators for help; the other three can be called by our moderators, directors, board members and administrators. On a channel or in the forums, a call tells the devices of the people holding that role that switched on When somebody @mentions me, and says which role, only where their pass can go now, and never in a room that keeps to itself; in Tasks and the office it goes into the Notifications in Tasks of everybody there who holds it, as an @ before their handle would. Nobody is ever told who holds a role, or how many people a call reached: not whoever called it, and not the radio’s @ list, which offers the role’s word and says only what it calls. Nothing new is kept: a message or a post keeps which roles it called, as it keeps which handles it mentions, and goes when it goes. Those four words cannot be anybody’s username.
• A call for a moderator leaves a note on the moderators’ desk. Since 2026-10-23 (Ryan’s call), when somebody who is not a moderator calls @moderator on a channel or in a forum post, a note goes on the desk in the Moderators’ room as well, so a call made while no moderator was listening is still waiting for one. It holds who called, when, where (the room’s channel, or the topic and post), and the words they called with, as they were then; an edit leaves one only if it newly calls. Nothing is left from a room that keeps to itself, or from one only some people may enter. Only moderators signed on as the base can read the notes. A moderator closes one once the call is answered, which deletes it, and nothing records who closed it; one nobody closes is deleted after thirty days. A note stays if you take the message off the channel, edit it, or delete your username, as a report does, because it was said to the moderators. The desk keeps two hundred at most, and past that the oldest goes. A moderator calling the others leaves no note.
• What a notification says. Who sent the message and where, and its first 180 characters, unless you switch Show the words of a message, a post, props or a task off for that device. For a mention in the forums, who wrote the post and its category, and, unless the words are off, the topic’s title and the post’s first 180 characters. For props, who wrote them and, unless the words are off, their first 180 characters, and never how many are waiting; pressing it opens the street with Profile open at Your props. For a direct message, who sent it, whether it is asking to start a conversation, and, unless the words are off, its first 180 characters; pressing it opens the street with Messages open. For a task, who did it and why it is yours (assigned to you, put on it, taken off it, mentioned in it or in a comment on it, or one you are on, made or commented on), and, unless the words are off, the task’s name and the words of a box ticked; for a comment in the office, who wrote it and whether it is on a contact, a grant request, a case, a mailing, a template or an email, and never which one by name, whatever the words switch says; never what a description or a comment says, and never how many are unread; pressing it opens the task in Tasks, or the comment. It is sent only once the change is in your Notifications in Tasks, and only while your pass can read Tasks. For an event, where and when, the event’s title unless the words are off, and for a new one who scheduled it; never who else is interested, and never how many; pressing it opens the chat page at Events, on that event. For the suggestion box, who did it and whether they dropped a suggestion in, replied, or marked yours done, not doing or open again, and, unless the words are off, the suggestion’s title and the first 180 characters of what they wrote; never how many are waiting, and never anything to whoever wrote it; pressing it opens the box on that suggestion. Anybody who can see your screen can read a notification, so switch the words off where that matters. A call’s notification says only that a call has started in a room, never who is in it, because that is shown only in the room itself (see calls).
• Private rooms. A device is told about a room only if the pass it was switched on with could hear that room now. Before anything is sent, our server checks that pass by the same rules as the radio, so a changed password, a claimed or deleted username, or a moderator taken off the list stops that device’s notifications at once.
• What we keep. For each device you switch on: the push address and the two keys your browser made for it; the handle it was switched on as, which kind of pass that was and a scrambled form of the pass, not the pass itself; and what you chose. Nothing about what was sent to the device itself, and nothing in any log; what your devices are told is kept for you, apart from them, in your past notifications. It is kept beside the channel, at Netlify.
• Your browser’s push service. A notification travels through the push service your browser comes with: Google’s for Chrome, Edge on Android and most Android browsers, Mozilla’s for Firefox, Apple’s for Safari, and Microsoft’s for some Edge on Windows. It is encrypted to your device’s own keys, so the push service cannot read who sent it or what it says, but it sees that a notification went to your device, when, and how large it was. Our server sends to those services and nowhere else.
• What we cannot take back. Once a notification has reached your device it is your device’s, and it stays in your notifications until you clear it. A message taken off the channel, or gone at its two weeks, is not taken off a device it has already reached.
• Your past notifications (since 2026-10-25, Ryan’s ask: notifications come and go, and Tasks already kept its own for 30 days). It reverses what this page used to say, that nothing about what was sent to a device is kept. Each time one of your devices is told something, our server also keeps it for you, once however many of your devices were told: what kind of notification it was and why, who it was from, where, which message, post, task, suggestion or event it was about, and when, and never its words. Only a notification a device was actually sent is kept, so what you switch on decides what is in it. Your page shows them, newest first, for 30 days and 500 at most, and marks the ones you have not seen there yet, never how many. The words on Your page are read again each time you open it, whether or not your devices showed them, from wherever they still are and only if your username can still read them there: a message while it is still on its channel, a post while it is still in the forums, a task’s name while you can read Tasks, a suggestion’s or an event’s title while it is there. A message gone at its two weeks, or taken off, is gone from Your page too, and only that there was one is left. Direct messages and props are never shown there in words; they are where they always were, under Messages and in Profile. It is kept under a scrambled form of your username, and nobody else is shown it, a moderator included. Opening Your page marks everything in it seen, which only your own list knows. Clear my past notifications on Your page deletes the whole of it at once, and Forget me and deleting your username delete it too.
• Switching it off. Switch off on this device in the tray, or signing off the CB on that device, deletes that device’s record and takes the subscription off it. Forget me and Delete my account under Account delete every device switched on as your handle. A device your browser’s push service says has gone is deleted the next time anything is sent to it.
• Who can switch it on. Anybody signed on to the CB, as their own username, and nobody else can be told about yours: every username is claimed, and a device is told only while the pass it was switched on with still works.
• On an iPhone or iPad, a website can only send notifications once it has been added to the Home Screen and opened from there, and stimpunks.world only from iOS or iPadOS 26, which opens every site added to the Home Screen as a web app.

We keep a device’s record because you switched notifications on there and asked to be told, and keeping it is what that takes. Switching it on is your consent to it, and switching it off takes it back.

The forums

The forums are the CB’s place for conversations that need to last longer than two weeks: topics in categories, each kept for a week, three months, six months or for good after its last post. Only a claimed username can read them, so they are not public: they have no feed, and every answer from them asks search engines not to keep it.

Since 2026-10-25 every topic, every category’s list of topics, and every picture and file posted or waiting to be posted is sealed at rest, Ryan’s call: encrypted where it is kept at Netlify, with the same key of their own as Tasks, which neither the office nor direct messages use, so somebody who got at the stored files alone could not read them. Every category is sealed, not only the staff ones, because a topic moved out of a staff category must never be left in the clear. They are not end-to-end encrypted: our server opens them for whoever may read the category. Without that key the forums are shut rather than written in the clear, and anything written before that day is sealed within the hour.

• Who can read and write. Anybody signed on to the CB with a claimed username, moderators included once they have claimed theirs. A few categories are for our moderators, directors or board, by the same roles as the Town Hall’s rooms. A category you cannot read is never sent to your browser, and nothing tells you it is there. Reading sends your pass and which category, topic or search you asked for; the pass is checked and not kept, and nothing records who read what.
• Each category is a room on the CB. Ryan’s call, 2026-10-21: reading a category, or a topic in it, tunes the radio’s This room to that category’s own room, with its own channel, Be seen here, call and Follow this room, and a category inside another is the room of the one it is in, so all of Team Docs is one room. Its room is for exactly the people who can read the category: a claimed username, with the category’s roles, checked by our server for everything the radio does there, and by nothing kept in your browser. Somebody seen in a staff category’s room, or in its call, is shown only to the people that category is for, and a notification about its room goes only to a device whose claimed username can read it. A category’s room is not on the street’s public list of rooms, and the World room shows its people, its call and its latest message on the forums’ own line, to the people who can read it. It cannot be your favourite room on your profile card, which everybody signed on can see.
• What we keep. Each topic’s title, its category, its tags, when it was started and last posted to, and whether a moderator has pinned or closed it. Each post’s words, your username, shown to everybody who can read that category, the mark your pass gave it (BASE for a moderator), when you posted it and last edited it, which post it answered, its reactions (who pressed which, by username, and never how many), the previews of the links in it, its pictures and files, below, and the usernames it @mentions, so they can be shown as names. With every post we also keep a scrambled mark of the claimed username that wrote it, which is never shown to anybody, ourselves included: it is how only you can edit or take down what you wrote, and not somebody who claims the same name after you have deleted yours.
• The Wiki. Ryan’s call, 2026-10-19: a category of how-to pages, kept for good. The post that opens each topic there is a wiki page, which our moderators can edit whoever started it, and the page shows the username of whoever started it and of whoever edited it last, which we keep with it. Nothing else about earlier versions is kept: an edit replaces the words. Team Docs works the same way (Ryan’s call, 2026-10-20, for the team’s documents moving out of Google Docs): it and everything in it, its Field Guide, Notes, Meeting Minutes and Templates, can be read only by our moderators, directors, board and administrators, is kept for good, and the post that opens each topic there is a page any of them can edit. Everywhere else in the forums, and on every reply in the Wiki and Team Docs, only whoever wrote a post can edit it. A wiki page goes only with its whole topic.
• Templates. A topic in Team Docs’ Templates is offered to anybody who can read it when they start a new topic, and choosing one copies its title and words into the new post in their own browser. Nothing records who used which template, and its pictures stay with it.
• Grantmaking and tags. Ryan’s call, 2026-10-22, moving the Grants table out of Notion: a topic can carry up to five tags, words you choose, which anybody who can read it sees and which a category’s page can show it by. Every grant round is a topic in Grantmaking tagged grant-round, kept for good, and the post that opens one is a page any of our directors and board can edit, so each can add their name to its approvals; it shows who edited it last. A grant round names the people being considered for a grant, links their entries on stimpunks.org, and can hold what our team noted about each of them, their circumstances included, as the Grants table did. Grantmaking is read only by our directors, board and administrators, but it is kept the way the rest of the forums are, not sealed the way the office is. The rounds made in Notion were brought in once, each under the username of whoever made it there and at the time they made it, with the id of its Notion page kept so it could be brought again without a second copy, and each says it was brought from Notion. Nobody was told when they arrived.
• What we do not keep. Anything about who reads: no views, no read receipts, no list of who has seen what, and nothing counted but a poll’s votes, below. There are no badges and no unread count. What is new to you is marked by your own browser, below, and never by us.
• Polls. Norah’s ask, Ryan’s calls, 2026-10-22: whoever starts a topic can open it with a poll, or add one to it later, as can the editors of a wiki like Grantmaking and our moderators, and a poll is the one place in the forums that counts: how many picked each choice, in the poll’s own order. A poll keeps the username of whoever added it, shown on it. It is one of two kinds, chosen when the poll is made and never changed. A show of hands keeps, for each vote, your username, which choices you picked and a mark from your pass, and shows your username under your choices to everybody who can read the topic, as the votes come in; you can change your vote or take it back while the poll is open. A sealed ballot keeps how many picked each choice and, apart from that, that you have voted, as a code made from the topic and your pass that differs in every poll, so you cannot vote twice. Nothing we keep says what you picked, so nobody can see it, our moderators and Ryan included, and a sealed vote cannot be changed or taken back, because we could not find it. Nobody is shown any of a sealed ballot’s numbers until it closes, on its date or when whoever added it, the topic’s starter or a moderator closes it, and then everybody who can read the topic sees them, and it cannot be opened again. With only a few votes, the numbers can still say who picked what, which the poll says before you vote. A vote tells nobody, and a poll goes with its topic.
• Pictures and files. This reverses what this page said when the forums opened, that they take words only: Ryan’s call, 2026-10-18. A post can carry pictures and files. A picture is redrawn in your own browser before it is sent, by the same code the CB uses, which takes off everything a camera or a phone wrote into it, where it was taken first of all; our server refuses one that still carries any of that, and refuses a picture sent as a file. A description is offered and never required. A file goes exactly as it is, so anything written inside it goes too, such as the author’s name a word processor puts in a document: check it before you post it. The forums take only PDFs, plain text, Markdown, CSV, RTF, and Word, Excel, PowerPoint and OpenDocument documents and EPUB books, each checked against what its first bytes say it is, never a web page, a script, an SVG or a document with macros in it, up to 20 MB each (from 5 MB, 2026-10-27); one over 4 MB is sent, kept and fetched in parts of 4 MB, each sealed, and checked whole once every part has arrived. Since the same day a file’s name, which is kept beside it, is sealed with it, where it had been in the clear beside each sealed file. Neither has a public address: each is fetched with your pass, only by somebody who can read the topic it is in, so a topic moved to a staff category takes its pictures and files with it, and a file is only ever saved to your device, never opened in the forums. Ask anybody recognisable in a picture before you post it. A picture or file goes the moment its post, its topic or your edit lets go of it; one you added and never posted is deleted after a day.
• @mentions. This reverses what this page said when the forums opened, that they send no notifications: Ryan’s call, 2026-10-18. Typing @ offers the people in the topic, anybody with a claimed username on Who’s online, and anybody who started or last posted in a topic you can read (and, if you can open Tasks, everybody Tasks can assign), which your browser asks for once, the first time you type an @. They are names you can already see; there is no list of every username. A post keeps the usernames it mentions, to show them as names. Mentions lists the topics where somebody has mentioned you: our server works it out from the posts each time you look, and nothing records who was mentioned where. A mention tells you on a device only if you switched on When somebody @mentions me there (see notifications), and only if your claimed username can read the category it is in.
• How long. Every category says how long its topics stay after their last post, and every topic says the date it goes. Since 2026-10-28 our administrators can set how long each category keeps a topic, at the desk in the Moderators’ room, as they can for the CB’s channels. Every post is marked with how long its category kept topics when it was posted, and a topic is never kept longer than the shortest of those, so a longer setting never keeps anybody’s words longer than they were said under; a shorter one reaches every topic at once. Each category set keeps who changed it last and when, and nothing more. The same day, with the say-so of everybody who had posted in them, Announcements, Events, Show your work, Props & Gratitude and every Interests category began keeping their topics for good, and so did Work opportunities and Discourse, which were empty; the watering hole began keeping a topic three months, for topics started after that. When it goes, everything in it goes with it: every post, reaction, vote, preview and copied message. A topic a moderator has pinned stays while it is pinned. Whoever wrote a post can take it down sooner, a topic’s starter can take the whole topic down while nobody else has posted in it, and a moderator can take down any post or topic. There is no archive and no backup.
• Previews of links. A link on a line of its own in a post becomes a preview. For a page on another site, our server reads that page once, when the post is made or edited, for its title, its description and the site’s name, or for what the site’s own oEmbed answer says about it (who made it and, for a post on X, Bluesky or the like, the words of the post), and keeps those with the post. For a YouTube video it asks YouTube’s own Data API, sending it only the video’s id, or reads the video’s own page, for its title, its channel and how long it runs, and the preview is a press-to-play player like every other on the street: nothing from YouTube loads until somebody presses it. Either way the site sees a request from Netlify, our host, and never from you or from anybody reading the post, and nothing is fetched again when somebody reads it. No picture is fetched from anywhere. A link to a room on the street shows that room’s own name and description, from this site.
• Copying from the CB. Anybody with a claimed username who can hear a channel can tick messages on it and start a topic with them. Our server copies them from the channel itself, so the words, the handles, the marks and the times are exactly as they are on the channel, with edited on any their sender has edited, and nobody can put words in somebody else’s mouth; pictures and stickers are not copied. Once copied, they last as long as the topic. The house norm is to ask everybody in the conversation first, as for a screenshot. Whoever sent a copied message can take it out of the topic at any time, and so can a moderator. Nothing can be copied from a room that keeps to itself, and from one of the Town Hall’s private rooms, or a staff category’s room, only into a category no wider than that room.
• In your browser. love-forum, in the table above: which topics you have opened and when, the colours you chose for the forums, and a post you have started and not sent. It is never sent to us. The tab’s own history keeps, beside each address it already holds, how far down that view you were and the address of the view before it, so going back one step puts you where you were (going back, since 2026-10-21); it goes with the tab’s history, and nothing of it is sent to us. What the link back says and which link you followed are kept only while the page is open.
• Deleting your username. Your posts stay up with your username on them, and from then on only a moderator can take them down. If you want them gone, take them down yourself first, or ask a moderator. A vote in a show of hands stays too, with your username under it, until the topic goes, so take it back first if you want it gone; a sealed ballot never had your name on it.
• Where it is kept. Beside the CB, at Netlify, under Netlify’s privacy policy.

We keep a post because you wrote it for the people in the forums to read, for as long as its category says. Posting is your consent to that, and taking a post down takes it back.

The Wiki’s bot

Since 2026-10-26 Claude, the AI that does most of the building here (how this site is made), can keep the pages in the forums’ Wiki and Team Docs up to date, Ryan’s call. It does that through a key of its own, kept in Netlify and in our password manager, and never through anybody’s username or password.

• What the key can do. In the Wiki and in Team Docs and every category under Team Docs, and nowhere else: list the pages, read a page, start a page and edit a page, whoever wrote it, the way a moderator can, and change a page’s tags (since 2026-10-28). It cannot reply, take anything down, add a picture, a file or a poll, or move or pin a topic, and it cannot read or write Grantmaking or the directors’ and board’s categories.
• Since 2026-11-07 it can also start topics in Reading, watching, listening, playing, Ryan’s call, so each book on the Solarpunk Hermitage’s shelf has a topic to talk about it in. There it lists, reads, edits and tags only the topics it started, never anybody else’s, and it cannot reply. That category is open to everybody on the CB, so the key reads nothing there a member could not.
• Team Docs is staff-only, so the key can read staff documents as well as write them. Whoever holds the key can read every page in Team Docs, Meeting Minutes included.
• It writes under its own name, Claude, marked BOT, so you can always tell its pages and edits from a person’s. Nobody can have Claude as a username. A page it edits says it was edited by Claude.
• It tells nobody. Its pages send no notifications, and an @mention or a role in its words rings no device.
• A person reads it first. Ryan asks for a change in a conversation with Claude, and Claude writes it; nothing posts on a timer or by itself.

Tasks

Tasks are the team’s to-do list, moved here from EspoCRM (Ryan’s call, 2026-10-20). They are the CB’s too, and they are not public: only our directors, board members and administrators can read or change them, and only once they have claimed their username. Nobody else is sent a task, or told that there are any.

Since 2026-10-25 they are sealed at rest, Ryan’s call: every task, its comments, its activity, everybody’s Tasks notifications and saved filters, the recurring tasks, the templates and the snippets are encrypted where they are kept at Netlify, with a key of their own that neither the office nor direct messages use, so somebody who got at the stored files alone could not read them. They are not end-to-end encrypted: our server opens them for whoever may read Tasks. Without that key Tasks are shut rather than written in the clear, and anything written before that day is sealed the next time it is written, or within the hour.

• What we keep, for each task. Its name; its status and priority; the day it starts and the day it is due; when it was finished, if it was; its description, written in Markdown; the username of whoever it is assigned to, and of anybody else working on it; its tags; the username of whoever made it, and when; and the username of whoever changed it last, and when. A task brought over from EspoCRM also keeps EspoCRM’s id for it, so bringing tasks over again updates them rather than making them twice; and when one of those is deleted here, its EspoCRM id is kept on its own, so bringing tasks over again leaves it deleted. A task brought over from our Tasks in Notion (since 2026-10-21) keeps the id of its page there in the same way, and when it was made there; Notion does not say who made it or when it was finished, so neither is kept. Nothing else about the Notion page comes over, and nothing is sent to Notion.
• Activity and notifications (since 2026-10-21, after EspoCRM’s stream and notifications). Every change somebody makes to a task is kept as part of its Activity, on its page: who made the change and when, and for each thing it changed (its name, status, priority, days, who it is assigned to, who else is on it, its tags) what it was before and after. A change to a description is kept as only that it changed, never its words; a tick keeps the words of the box ticked. A task a recurring task makes is kept under nobody’s name. A task’s activity keeps its newest 200 changes and goes when the task is deleted. Each change is also put in the Notifications of everybody it concerns, except whoever made it: whoever the task is assigned to and whoever else is on it, before and after the change, whoever made the task, and anybody the change newly @mentions in its description. A comment is kept in the activity and the notifications as only that somebody commented, and which comment, never its words. A comment in the office is put in these notifications too, naming only what kind of record it is on and its id. Your notifications are kept under a scrambled form of your username, each with whether you have read it, for 30 days and 200 at most, and nobody else is shown them. Nothing is sent anywhere for them: they are there when you open Tasks.
• Comments (since 2026-10-21, after EspoCRM’s stream posts and Notion’s comments). A comment on a task keeps its words, written in Markdown; the username of whoever wrote it; when it was written, and when it was last edited; and a scrambled form of the writer’s username and when they claimed it, which is never sent to anybody, so that only they can edit it, and somebody who claims the same name after it was deleted cannot. They, or an administrator, can delete it. A task also keeps when it was last commented on, so the Feed can put it first. A comment goes in the Notifications of whoever the task is assigned to, anybody else on it, whoever made it, anybody who commented on it before, and anybody it @mentions, except whoever wrote it, as only that there is one and on which task; an edit tells only anybody it newly @mentions. A task holds 500 comments at most, and after that a new one is refused rather than an old one dropped; they go when the task is deleted. A comment brought over from a task’s page in our Notion (since 2026-10-21) also keeps Notion’s id for it, so bringing comments over again changes it rather than adding it twice, and when one is deleted here that id is kept on its own so it stays deleted; it keeps who wrote it, as their username, and when, and tells nobody. Nothing is sent to Notion.
• Pictures and files (since 2026-10-27, after EspoCRM’s attachments). Anybody who can read Tasks can attach pictures and files to a task and take any of them off, and attach them to a comment of their own (since the same day; only the comment’s writer changes what it holds), under the forums’ rules: a picture is redrawn in your browser before it is sent, which takes off what a camera wrote into it, where it was taken included, and is refused if any of that is still in it; a file goes exactly as it is, with anything written inside it, such as an author’s name, and only as a PDF, plain text, Markdown, CSV, RTF or a Word, Excel, PowerPoint, OpenDocument or EPUB file, checked by its first bytes, never a document with macros in it. A file is 20 MB at most; one over 4 MB is sent, kept and fetched in parts of 4 MB, each sealed, and checked whole once every part has arrived. A task keeps, for each, its kind, its size, a file’s name or a picture’s description if somebody wrote one, and the username of whoever attached it, and when. They are sealed at rest with the rest of Tasks, have no public address, and are sent only to somebody who can read Tasks, while the task holds them. One put up and never attached goes within a day; one taken off, or left out of a comment when it is edited, is deleted then; a comment’s go when it is deleted, and they all go when the task is deleted. A task’s activity says how many pictures and files were attached or taken off, never their names.
• What we do not keep. Anything about who reads: nothing records who looked at a task, or when, and marking a notification read is known only to your own list. A description’s or a comment’s earlier words are not kept anywhere. The Feed (since 2026-10-21) is worked out from the tasks and their activity each time it is opened, and keeps nothing of its own.
• How long. A task stays until a director or an administrator deletes it. Finished tasks stay too, as a record of the work.
• Recurring tasks. Each is kept like a task: its name, which can carry the week, the year or the month; its description; whoever its tasks go to and anybody else on them; their priority and tags; how often it comes round; the next day it makes a task, and how many days after that day each task starts and is due; whether it is switched on; who made it and when, and who changed it last and when; and, for one brought from EspoCRM, EspoCRM’s id for it. On its day the site makes the task by itself, under nobody’s name, and the task keeps which recurring task made it and for which day, so it is never made twice. A recurring task stays until a director or an administrator deletes it; deleting it makes no more tasks and leaves the ones it made.
• Templates (since 2026-10-22). A template is a task to start from, kept like a recurring task: its name and description, which can hold fill-ins such as {name} for somebody’s name and links to their records in the office; whoever its tasks go to and anybody else on them; their priority and tags; how many days after a task is made it starts and is due; and who made it and changed it, and when. A director making a task from one replaces the fill-ins themself. When somebody fills in stimpunks.org’s Join form, the office makes their onboarding task from a template by itself, under nobody’s name, with their name in its name and links to their join request and their contact, which are in the office, sealed; nothing else of what they wrote is put in the task. A task made from a template keeps which one. A template stays until a director or an administrator deletes it; deleting it leaves the tasks made from it.
• Snippets (since 2026-10-27). A snippet is words the team writes once and puts into a box by typing ! and part of its name, such as a checklist with a line for every director. Each is kept like a template, sealed with the rest of Tasks: its name and its words, and who made it and changed it, and when. Only somebody who can read Tasks is sent them, in Tasks, in the office and in the forums, and only they can make, change or delete one. Putting one into a box keeps nothing and tells nobody: the words are then the description’s or the comment’s, as if they had been typed. A snippet can hold {directors}, {board} or {administrators} (since the same day), which our server fills, when it sends the snippet to be put in, with a line for each username holding that role then; so somebody who can read Tasks is sent who holds those roles, in Tasks and the office only. The forums are never sent such a snippet, because a post can be read by anybody in its category. {me} is filled with your username, and {today} by your browser with your own day. A snippet stays until somebody deletes it; changing or deleting one changes nothing it was already put into.
• Your saved filters. When you save a list or a board as a saved filter, we keep, under a scrambled form of your username, its name and the address that holds its filters, order and columns, and nothing about when. Nobody else is sent them or told you have any, an administrator included. You delete one with Delete beside it; Forget me and deleting your username delete them all.
• Deleting your username. Your saved filters and your notifications go, and so they do with Forget me. The tasks, their comments and their activity stay, because they are the organisation’s work, with your username on them as words.
• In your browser. Nothing of the tasks. The tab’s own history keeps, beside each address it already holds, how far down that view you were and the address of the view before it, so going back one step puts you where you were (going back, since 2026-10-21); it goes with the tab’s history, and nothing of it is sent to us. What the link back says, which can be a task’s name, is kept only while the page is open. How you filter and sort the list or the board lives in the page’s address, which you can bookmark or share with another director, and nothing is stored there; a saved filter is kept with us, above, so it is on any device you sign on with.
• Where it is kept. Beside the CB, at Netlify, under Netlify’s privacy policy. Every answer asks search engines not to keep it.

The office

The office holds the people and organisations Stimpunks is in touch with, our grant requests, and the connection requests and volunteer applications that come in, which EspoCRM called cases, moved here from EspoCRM, where they were kept until now (Ryan’s call, 2026-10-20), and the email between them and our team mailbox. Most of the people in it never signed on to this street: they wrote to us, asked us for something, or were introduced to us. So it is held more tightly than anything else here. Only our directors, board members and administrators can open it, and only once they have claimed their username; nobody else is sent anything from it, or told whether anybody is in it.

• What we keep, for each contact. Their first and last name; an email address and a phone number, if we have them; whether they have asked not to be emailed or not to be called; notes, in Markdown; the username of whoever added them, and when; and the username of whoever changed them last, and when. A contact brought over from EspoCRM also keeps EspoCRM’s id for it, so bringing contacts over again updates them rather than adding them twice; and when one of those is deleted here, its EspoCRM id is kept on its own, so bringing contacts over again leaves it deleted. EspoCRM’s address and payment fields were empty on every contact, so they are not kept.
• What we keep, for each grant request. Its name; which of our grants it is for (Mutual Aid or Creator Grants) and the stage it is at, which says whether it is open, granted or denied; the amount, in dollars; the day it was submitted and the day it was decided, which is set when it is granted or denied; the contact it is from; the number of the stimpunks.org form entry it came in as; a description, in Markdown; the username of whoever added it, and when; and the username of whoever changed it last, and when. One brought over from EspoCRM also keeps EspoCRM’s id for it, kept on its own if it is deleted here, as a contact’s is. The history of its stages that EspoCRM kept was not brought over.
• What we keep, for each case (a connection request or a volunteer application). Its number; its name; which of the two it is; its status, which says whether it is still open, and its priority; the day it was submitted and the day it was closed; the contact it is from; the number of the stimpunks.org form entry it came in as; a description, in Markdown; the username of whoever added it, and when; and the username of whoever changed it last, and when. One brought over from EspoCRM keeps EspoCRM’s number and id, as a contact or a grant request does; the HubSpot ids EspoCRM still held from before it, and its history of status changes, were not brought over. The highest number given is kept too, so a number is never given twice.
• Pictures and files (since 2026-10-27, as in Tasks). Anybody who can open the office can attach pictures and files to a contact, a grant request or a case and take any of them off, and attach them to a comment of their own on anything in the office (only the comment’s writer changes what it holds). A picture is redrawn in your browser before it is sent, which takes off what a camera wrote into it, where it was taken included, and is refused if any of that is still in it; a file goes exactly as it is, with anything written inside it, and only as a PDF, plain text, Markdown, CSV, RTF or a Word, Excel, PowerPoint, OpenDocument or EPUB file, checked by its first bytes, never a document with macros in it, up to 20 MB, in parts of 4 MB. For each we keep its kind, its size, a file’s name or a picture’s description if somebody wrote one, and the username of whoever attached it, and when. They are sealed with the office’s own key, names and all, have no public address, and are sent only to somebody who can open the office, while a record or a comment holds them. One put up and never attached goes within a day; one taken off, or left out of a comment when it is edited, is deleted then; and they all go when what holds them is deleted. A mailing, a template and an email take them on their comments only, because a file on a template would read as one the mailing sends, and it is not.
• How an entry from stimpunks.org arrives. When somebody fills in one of stimpunks.org’s forms to ask for a grant, to connect, to volunteer or to join our community, stimpunks.org’s server sends their entry here, signed with a key the two servers share, so nobody else can send one. The office finds them as a contact by their email or adds them, with their name and phone number, and makes the grant request or case, with every other answer they gave, their address among them, in its description. A Join entry makes a join request, which is a case, and since 2026-10-22 also a task in Tasks to welcome them, which carries their name and links to their join request and contact, and none of their answers. This replaced EspoCRM on 2026-10-20, and nothing goes to EspoCRM any more. The entry also stays on stimpunks.org, under its own privacy policy.
• Email with the team mailbox. A script inside our team’s Gmail sends the office every email between the team mailbox and somebody who is a contact, as it arrives or is sent, signed with a key the two share. It is filed on that contact’s page whole: who it is from and to, its Cc, and its Bcc on what the team sent; when it was sent; its subject and its plain text; and Gmail’s ids for it and its thread, so the office can link to it there. Attachments stay in Gmail: the office keeps only their names and sizes. To know who is a contact without being sent anybody’s address, the script is given a keyed hash of each contact’s email address and compares the addresses on each email with those, so email with anybody who is not a contact never leaves Gmail, and the office keeps nothing of an email that reaches it with no contact on it. Somebody becomes a contact this way only when one of the team chooses, by putting a label on one of their emails in Gmail: the script then sends the name and address that email gives them (its sender, or whoever we sent it to), the office adds them as a contact, added by the team mailbox, with nothing else about them, and the whole thread is filed on them. The script remembers, in its own settings in the team’s Google account, which labelled threads it has handled. Writing and replying are done in Gmail; the office only opens it. A director or an administrator can delete an email from the office, which leaves it in Gmail; its Gmail id is kept on its own so it is never filed again. The email also stays in Gmail, under Google’s privacy policy. EspoCRM’s own copies of our email were not brought over.
• Mailings. A director or an administrator can send an email from a template to everybody at one stage of a grant pipeline. The office keeps each template (its name, subject and words, and who wrote or changed it, and when), and for each mailing the template’s words, the pipeline and stage, the day it was narrowed to requests submitted since if it was, who sent it and when, and for each email the grant request and contact it is for and whether and when it went. Until an email goes, it also keeps that person’s address and the email filled in, because the team mailbox’s script fetches them to send it: the one time the office hands that script anybody’s address, and only for a mailing a director has seen in full and confirmed. Anybody who asked not to be emailed, or has no address, is left out. The script sends each from the team mailbox’s own Gmail, one email to each person and never as a group, and tells the office it went; the mailing then drops that address and those words, and the email comes back to the office as one of the team mailbox’s, filed on its contact. Stopping a mailing takes back whatever has not gone, deleting a contact takes back theirs, and a mailing with nothing waiting can be deleted.
• Writing to one person with a template (since 2026-10-22). On a contact’s page, Write to them in Gmail can take one of these templates, filled in for them, and opens Gmail’s compose window with their address, the subject and the words ready, for the director to read and send from Gmail themself. The office keeps nothing for it and sends nothing: the filled email travels in the link to Gmail, so it is in that director’s own browser history, as the address alone always was, and reaches Google only as an email being written in our Gmail does.
• QuickBooks. A director or an administrator can connect the office to our QuickBooks company, through Intuit’s own sign-in. The office then reads our books once a day, late in the evening, and when a director presses Read the books now, and never writes to them. It keeps, sealed like every record: the permission Intuit gives it, two tokens that never leave our server and are never logged, with our company’s id at Intuit and who connected it and when; and what it last read, which replaces the time before: the money that came in over the last 30 days, each deposit, payment and sales receipt with its day, its amount, its kind, the account it went into and who it was from as our books name them, and no memo, address or email; and this year’s income, expenses and net by month, and income by account. Disconnect tells Intuit the office may no longer read our books, and deletes both. Our books themselves are at Intuit, under Intuit’s privacy statement.
• Givebutter. The office reads our Givebutter account, where people give to Stimpunks and where our mailing lists are kept, once a day, late in the evening, and when a director presses Read Givebutter now, with a key of ours. It writes to it in one way only, below. What it keeps, sealed like every record, replaces what it read the time before: for each gift in the last twelve months, its day, its amount, what reached us after Givebutter’s fees, its campaign, whether it was recurring and whether it went through; for each recurring plan, whether it is giving, how often and how much; and for each campaign, its name, its goal, what it has raised and how many people have given. It keeps nobody’s name, email, phone or address, and no message left with a gift, because somebody can give anonymously and the office needs nobody’s name to count. Everything about who gave stays at Givebutter, under Givebutter’s privacy policy.
• Joining our mailing lists (since 2026-10-23). When somebody asks on stimpunks.org’s Join form to be added to our Members Only mailing list or our Monthly Newsletter, a director can press Add them to Givebutter’s lists on their join request in the office. That press sends Givebutter their email address, their first and last name when their contact has both, and the lists they said yes to, as Givebutter’s tags for those lists, and marks them as wanting our emails. Givebutter takes a first and a last name together or no name at all, so somebody whose contact has one name goes to Givebutter by their email address alone (since 2026-10-25). Nothing else of their join request goes: not what they told us about themselves, not their city, not their profile or website, and nothing about who pressed. It happens only on that press, never when a form arrives, and never for a list they said no to. Givebutter matches somebody already there by their email address and adds the lists without taking any away, and the office tells the director who pressed whether they were there already, from when Givebutter says it made their contact, keeping nothing of its answer. The join request keeps which lists were sent and when, sealed like every record. Once there, they are on Givebutter’s lists under Givebutter’s privacy policy: every email it sends can be unsubscribed from, and taking somebody off a list, or out of Givebutter, is done in Givebutter, because deleting their join request or their contact in the office does not reach it.
• Our Members page (since 2026-10-23). When somebody fills in the Members page part of stimpunks.org’s Join form (a few words about themselves, a website, or both), a director can add them to our Members page, stimpunks.org’s Individuals page, from their join request in the office. The office shows the line as it will appear there: the name they asked to be shown by, or else the name or pseudonym they gave on the form, linked to their website if they gave one, and their words. The director can tidy the name, the link and the words first, and then presses Add them to the Members page. That press puts that one line at the end of the page’s list, and nothing else of their join request goes: not their email address, not their city, not what they told us about why they are joining, and nothing about who pressed. It happens only on that press, never when a form arrives, and only for somebody who filled in that part of the form. The office writes to stimpunks.org as one WordPress user, with an application password kept in Netlify’s settings and never in our code, and uses it for that one page and nothing else. Before it writes, it reads the page, and it refuses if the page has changed since a director looked, or if somebody by that name is on it already. WordPress keeps the page as it was before as a revision, under that user. The join request keeps when they were added, sealed like every record. Once there, the line is public on stimpunks.org, under stimpunks.org’s privacy policy. Changing the line, or taking somebody off the page, is done on stimpunks.org, because deleting their join request or their contact in the office does not reach it.
• Our Organizations page (since 2026-10-23). When somebody fills in the Organizations page part of stimpunks.org’s Join form (a few words about their organization, its website, its logo, or any of these), a director can add their organization to our Organizations page from their join request in the office, as the Members page is added to. The director types the organization’s name where the form did not ask it, and can tidy it, the link and the words; the office shows how it will look first. To show the director their logo, the office fetches it from where the Join form keeps it on stimpunks.org, takes off anything a camera or a phone wrote into it (where it was taken, the device, the time), and shows it in their browser; nothing of it is kept. The director says in words what the logo shows, for anybody who cannot see it. Then Add it to the Organizations page copies that logo, with its camera data taken off, into stimpunks.org’s media library, and puts one entry at the end of the page: the name, linked to the website, the words, the logo and its words. Nothing else of their join request goes: not their name or email address, not their city, not what they told us about why they are joining, and nothing about who pressed. It happens only on that press, never when a form arrives, and only for somebody who filled in that part of the form. The office writes as the same WordPress user, with the same application password, and uses it for that one page and the logo and nothing else; it refuses if the page has changed since a director looked, or if an organization by that name is on it already. WordPress keeps the page as it was before as a revision, and the logo stays in the media library, public, until somebody deletes it there. The join request keeps when they were added, sealed like every record. Changing the entry, or taking it or the logo off, is done on stimpunks.org, because deleting their join request or their contact in the office does not reach it.
• Posts to our networks (since 2026-11-02). A director, a board member or an administrator can write a post in the office and send it to Stimpunks Social (our own, here on the street, since 2026-11-02) and to our Bluesky and Mastodon accounts, which the office posts to itself, and keep it there for Threads, our Facebook Page and our LinkedIn Page, which are posted by hand for now. Only the words of the post go, posted as Stimpunks and in public, on that person’s second press and never otherwise: nothing about who pressed, and nothing about anybody else. To make Bluesky’s card for the first link in a post, our server reads that page once, on the press, as the forums read a link, and sends Bluesky its title and description; nobody else’s browser fetches anything. For each post the office keeps its words, the card it sent, the username of whoever pressed and when, and what happened on each network (the address of the post there, or what the network said went wrong, or who posted it by hand and when), sealed like every record, the newest 500. The office signs in to Bluesky with an app password and to Mastodon with an access token, kept in Netlify’s settings and never in our code or the page. Threads and our Facebook Page (since 2026-11-02) are posted to by the office once a director connects each through our own Meta app, signing in at Threads or Facebook; the office then keeps our Threads account’s token and our Page’s token, sealed, and nothing about the person who connected but their username and when. Until a network is connected, or if its connection lapses, it is posted by hand. Once posted, a post is on that network under its own privacy policy (Bluesky’s, mastodon.online’s, Threads’, Meta’s), and deleting it is done there. A post to Stimpunks Social is kept in public on our server, its words, when and an id and nothing about who pressed, so /social shows it at once; each morning it is copied into this site’s own code and the page is built from it, and from then on it is part of the site’s history in git. Reading /social keeps nothing about you: it asks our server for the newest posts and sends nothing.
• Comments (since 2026-10-21). A contact, a grant request, a case, a mailing, a mailing’s template or an email filed from the team mailbox can have comments under it, kept as a task’s comments are, and sealed like every record in the office: each comment’s words, written in Markdown, the username of whoever wrote it, when it was written and when it was last edited, and a scrambled form of the writer’s username and when they claimed it, which is never sent to anybody, so only they can edit it. They, or an administrator, can delete it. A contact, a grant request or a case also keeps when it was last commented on, so the feed can put it first. A comment is told in Tasks’ Notifications, to whoever added the record, anybody who commented on it before and anybody it @mentions, except whoever wrote it; those notifications are not sealed, so they never carry the record’s name or the comment’s words, only who commented, when, whether it is on a contact, a grant request, a case, a mailing, a template or an email, and the ids of the record and the comment. A record holds 500 comments at most, and they go when the record is deleted; an email’s go when it is deleted from the office, or with its only contact. A comment’s earlier words are not kept.
• The dashboard, the reports and the feed are worked out from these records each time they are opened, and the feed keeps nothing of its own. Some things are kept for the dashboard alone. One is a line each night, late in the evening, of how many grant requests were open in each pipeline and how many of those were submitted that year, and how many cases and tasks were open and how many tasks overdue, because a record does not keep the history of its stages: numbers only, sealed like every record, for 400 nights. Two more are what the office last read from QuickBooks and from Givebutter. Since 2026-10-22 there are two from the team mailbox. One is a list of the newest emails filed in the office, the twenty sent last, each with its Gmail id, when it was sent, its subject, whether the team sent it and which contacts it is filed on, and never an address or its words; an email deleted from the office, or let go with its contact, leaves it. The other is the mailbox’s counts, which the team mailbox’s script sends once an hour: how many unread conversations are in the inbox, how many emails came in and went out in the seven days before it counted and the seven before that, and how many of those were with a contact. Numbers only, so nothing about anybody leaves Gmail for them, and each count replaces the last. Both are sealed like every record. The dashboard also shows how many messages went out on the CB each day, and the forum topics posted to last, of the ones whoever is reading may read, from the forums themselves; it keeps nothing of them. How you arrange the dashboard (since 2026-10-27, after requests to move and hide its parts) is kept on our server under a scrambled form of your claimed username, sealed like every record: the order of its sections and of the boxes in Newest, and which of them you hid, and nothing about when. It follows you from one device to another, and nobody else is sent it or told you have one. Put it back as it was deletes it, and so do Forget me and deleting your username.
• Encrypted where it is kept. Every record is sealed with AES-256-GCM under a key only our server’s functions hold, in Netlify’s settings and never in our code, so the store on its own shows nothing that can be read, and a record changed without the key is refused. Without the key the office is shut: nothing in it can be read, and nothing is ever written to it unsealed.
• What we do not keep. Anything about who reads: nothing records who opened the office, which contact they looked at, or what they searched for. Nothing about a contact is ever written to a log. A change replaces what was there before; no earlier version is kept.
• How long. A contact, a grant request, a case or an email stays until a director or an administrator deletes it, and a record’s comments go with it; deleting a contact leaves their grant requests and cases, which then say their contact has been deleted, and deletes the emails filed only on them. Deleting is for good: there is no archive and no backup of it on this street.
• In your browser. Nothing of anybody’s. The order of a list, and which pipeline, stage, type and status it shows, live in the page’s address; a search does not, because what is searched for is somebody’s name, email or number, and the address goes into the browser’s history. It lasts only while the page is open. The tab’s own history keeps, beside each address it already holds, how far down that view you were and the address of the view before it, so going back one step puts you where you were (going back, since 2026-10-21); it goes with the tab’s history, and nothing of it is sent to us. Never a name: what the link back says, which can be somebody’s name, is kept only while the page is open, like a search.
• Where it is kept. Beside the CB, at Netlify, under Netlify’s privacy policy. Every answer asks search engines not to keep it, and to be cached nowhere.

Threads and Facebook: what our Meta app keeps, and deleting it

Stimpunks Foundation has one Meta app, called Stimpunks.World. It is used only by the office, to post our own posts to our own Threads account (stimpunks) and our own Facebook Page (Stimpunks), when a director, a board member or an administrator presses Post (posts to our networks). Nobody else signs in to it, and it reads nothing about anybody.

• What it keeps. For Threads: our account’s id and username, an access token, and when the token runs out. For Facebook: our Page’s id and name, and the Page’s access token. For each, the username of whoever connected it and when. All of it is sealed (encrypted) where it is kept, is never written to a log, and is never shown on any page.
• What it does not keep, or ask for. Anything about any other Facebook or Threads user: no profiles, friends, followers, likes, comments, messages or reactions. It does not read the Page’s posts or anybody else’s.
• What it sends. The words of a post, and for Facebook the first link in them, at the moment somebody presses Post, and nothing else.
• Deleting it. A director pressing Disconnect on the office’s Posts page deletes that network’s token at once. Removing the app from Facebook (Settings & privacy → Settings → Business integrations) or from Threads (Settings → Account → Website permissions) stops its token working, and nothing else is kept to delete. To ask us to delete anything the app keeps, contact us through stimpunks.org and say it is about our Meta app; we delete it within 30 days and tell you when it is done.

The member map

Since 2026-10-22 our member map, of where our community lives, hangs on the Community Center’s wall, and stimpunks.org’s Individuals page shows the same map as a picture of it, served from here. It used to be a Google My Maps map. It shows places and how many of us are in each, and never anybody’s name.

• What anybody can see. Every place on the map, where it is, how many of us are there, each country and how many, and how many in all. Anybody can see it, signed on or not, because a map of where a community is is meant to be seen. A place is only the place somebody gave when they asked to be on the map, on stimpunks.org’s Join form: a city, a region or a country.
• What is kept. One entry for each of us on the map: the place’s name, its country, and a latitude and longitude, and nothing about who. The entries brought over from our Google map on 2026-10-22 also keep which entry each was there. Which join request an entry came from is kept on the join request, sealed in the office, which only our directors, board members and administrators can open, so that taking somebody off the map takes their entry.
• Looking a place up. To put somebody on the map, a director looks up the place they gave. The words of the place, and nothing else, go from our server to OpenStreetMap’s Nominatim, under the OpenStreetMap Foundation’s privacy policy, which answers with places to choose from. Nothing goes to OpenStreetMap from anybody’s browser. A place near one already on the map joins it, so a city is one place with how many are there.
• Looking at the map asks nobody else for anything. We draw the world ourselves, from Natural Earth’s outlines, which are public domain; there are no map tiles, and no map service is asked anything when the map is shown, here or on stimpunks.org.
• Coming off it. Ask us, through the Stimpunks contact page or in our community, and a director takes you off. Deleting your join request takes your entry off too. A place stays on the map while anybody else is there.
• Where it is kept. Beside the CB, at Netlify, under Netlify’s privacy policy. The map’s answers ask search engines not to keep them.

Moderators’ roles

Who is a moderator, and which moderators also hold the board, director or administrator role, decides who can open the Town Hall’s private rooms, the staff forum categories, Tasks and the office. Since 2026-10-21 our administrators keep that list at the desk in the Moderators’ room (Ryan’s call), where until then it was only in the site’s settings.

• Sealed at rest (since 2026-10-25, Ryan’s call): the list our administrators keep is encrypted where it is kept at Netlify, with the staff key Tasks and the forums use. Without that key the desk’s roles are shut, and only the break-glass list in the site’s settings counts until it is back.
• What we keep, for each moderator. Their username; which of board, director and administrator they hold; and the username of whoever changed that last, and when. Nothing else, and no history: a change replaces what was there.
• The break-glass list. A few names are kept in the site’s settings at Netlify instead, so that nobody can lock everybody out of the desk. The desk shows them, and cannot change or remove them.
• Who sees it. Only our administrators, at the desk. It is never published, never sent to anybody else, and never written to a log. A radio is told only its own roles.
• The rules it keeps. Only an administrator changes it; the board role is given or taken only by somebody on the board or on the break-glass list, because Executive Session is the board without staff; and nobody can be left without an administrator. A change reaches every page within half a minute, and the radio of the person it changed is handed their new pass by itself, which is the pass signing on again with their own password would give them.
• Where it is kept. Beside the CB, at Netlify, under Netlify’s privacy policy.

Links, and Linked from

Since 2026-10-21, after Notion’s links and backlinks (Ryan’s ask and calls): typing [[ in a message on the CB, a forum post, a task, a comment, or a record in the office finds a forum topic, or for our directors, board members and administrators a task, a grant request, a case or a contact, and puts a link to it in the words. A task, a topic and an office record each say, under Linked from, what links to them.

• A link is never a name. What goes into the words is what kind of thing it is and its id, nothing else, so a copy of the words, a search, a notification or a page somebody saved carries no name. The name is filled in each time the words are read, for whoever is reading: a task or a grant request linked from a topic everybody reads shows its name only to the people who could open it, and everybody else sees that it is one they can’t open, never whether it exists. A notification says only what kind of thing a link is.
• What the [[ menu sends. The letters you typed after [[, to our server, in the body of the request and never in an address, so they are in no browser history or log; it answers with what you could open whose names hold them. Nothing about what was searched for is kept.
• What Linked from keeps. For each task, task comment, forum post, contact’s notes, grant request, case and office comment that holds a link, which things it links to and when that last changed. The office’s are sealed, like every record there. It changes as the words change and goes when they go: an edit that takes a link out takes it out of Linked from, and deleting a task, a topic, a record or a comment takes it away. Linked from shows a reader only the places they could open themselves.
• A chat leaves no trace. A message on the channel or between two people can hold a link, and it shows in it as anywhere else, but it is never in anything’s Linked from, and nothing about it is kept, because the CB keeps its messages for two weeks. A single message is not something to link to, for the same reason; taking a chat to the forums is the way to keep it.
• In your browser. Nothing kept. The radio remembers the names it has been told only while the page is open.

Your username

Everybody on the CB has a username of their own, claimed with a password of their own. You claim yours when you join with an invite, on the joining page, and from then on the username signs on with its own password and nothing else, so nobody else can sign on as you. That is Ryan’s call of 21 October 2026, which retired the starter password the community shared: until then claiming was optional. Since 28 October a radio still on with that password, or with the moderators’ shared one, opens nothing: a pass from either was signed with the shared password, so anybody who knew it could have made one. It says where to go instead: an invite, or for a moderator the joining page.

• Invites. A moderator makes an invite at the desk in the Moderators’ room and passes on its link, which has the code after a #, so your browser never sends it to any server as an address. An invite is its code, a note saying what it is for, which moderator made it and when, when it runs out, how many times it may be used and how many times it has been. Nothing records who joined with which invite: joining takes one use off it, and that is all it knows. Only moderators see the invites, and a moderator can delete one, which stops it at once; an invite that has run out is deleted a month later. Since 2026-10-23 a director can also make one from the office, when they write to somebody in Gmail with a template that has an invite in it, from that person’s contact or join request: one press makes an invite that works once and runs out after thirty days, and puts its link in the email for the director to read and send from Gmail. Its note says only that it was made in the office for one person, and it is not written down anywhere whom it was for, on the invite, the contact or the join request, so the office does not become a record of who came in through which invite either.
• Joining. The joining page sends the invite, the username you would like, the password you chose twice over, and an email address if you gave one, only when you press Join; before that it asks us whether the invite works and whether the username is free, which sends those two and nothing else. Since 28 October 2026 moderators join with an invite too, and an administrator gives them their roles afterwards.
• What we keep. The username as you claimed it; your password and a recovery code, each only as a salted scrypt hash, from which neither can be read back; when you claimed it; a version number that moves whenever the password changes, so every other device is signed off; and a count of wrong passwords with the time the username is locked until after five of them. If a moderator gives you a reset code, its hash, for a day; if you ask for one by email, its hash, for an hour. Your email address, only if you give one, below. And only while a moderator has timed your username out or banned it, until when. No other name, and nothing about what you do. It is filed under a scrambled form of the username, so the store’s own list of what it holds does not show usernames; moderators can see a list of them.
• An email address for recovery, if you give one. It is optional, offered when you join and under Account on the radio, where you can add it, change it or take it off with your password. It is used for one thing: sending you a reset code when you ask for one at the front desk in the Community Center, with your username and that address. It is kept sealed, encrypted with a key kept in the site’s settings on Netlify, and shown to nobody but you, moderators included. Asking for a code tells nobody anything: the desk gives the same answer whether or not the address is the one on the username. The email is sent from our team’s mailbox at Google, by a small script in it that collects it from us within ten minutes, so Google handles the address and the code to send it, under Google’s privacy policy, and the email stays in that mailbox’s sent mail, where the people who look after the mailbox could see it; that is why the code works for an hour and not a day. We forget the email as soon as the script says it went, it is never filed with our contacts in the office, and at most one goes for a username in a quarter of an hour. The address goes when your username does.
• Your pass. Signing on hands your browser a pass, which says your username, the version number above and when it runs out, signed with a key kept in the site’s settings on Netlify that nobody types or needs to know. We keep no copy of it and no list of passes. Since 28 October 2026 (Ryan’s call) a pass runs out thirty days after it was made; while your radio is open and listening, it is handed the same pass made fresh once a day, which it keeps in place of the old one, so a pass runs out only after thirty days with no radio listening, and you sign on again. Until that day a pass never ran out, and it was signed with the passwords our community and our moderators shared, so anybody who knew one could have made a pass for somebody else; changing the key signed everybody off once. Sign off everywhere else, under Account, asks for your password and moves the version number, so every pass made before stops at once, on every device, and their notifications with them; the device you pressed it on is handed a new pass. A new password does the same.
• Your password. We never see it again once you have typed it, cannot tell you what it is, and it is never logged. The ways back in are the recovery code you are shown, once, when you join; a reset code by email, if you gave an address; and a reset code from a moderator, who will want to be sure it is you first. Any of them is used at the Community Center, and gives you a new recovery code.
• On the channel. Until 21 October 2026 a message from a claimed username was marked CLAIMED. Every username is claimed now, so nothing marks it; BASE is still a moderator’s, put there from the pass, and nobody can set it on a message themselves.
• Your pets, your avatars, your chimeras, your jobs, your patches, your crystals, your herbs and your profile card. The pets you adopt, the avatars and chimeras you keep, the jobs you keep from the Guild, the patches on your battle jacket, the crystals in your pouch, the herbs in your basket and your profile card and profile sets are kept under your username, and only your password reaches them.
• Deleting it. Delete my account under Account deletes the username, its password, its email address, your pets, your avatars, your chimeras, your jobs, your patches, your crystal pouch, your herb basket, your profile card and its sets, your props, your chat status, your saved filters for tasks, your own order for the chat page’s channels and every direct message and conversation you are in at once, and anybody with an invite can claim the name afterwards. A moderator can do the same, if you ask them to or if the covenant needs it. Your adopted animals stay on the list of everybody adopted, where nothing connected them to you. Your forum posts stay up, with your username on them.
• Moderators. A moderator joins the same way, with an invite, and an administrator puts their username on the moderators’ list afterwards; until 28 October 2026 a moderator’s username was claimed with the moderators’ shared password instead, which every moderator knew. Only their own password signs on as them. We keep exactly the same record for them as for anybody: which roles they hold is not in it, and is kept on the moderators’ list. The desk will not reset, delete, kick, time out or ban a moderator’s username, or clear its card.
• What moderators can do. Make and delete invites; see the list of every username; look up one username, give it a reset code, delete it, clear its profile card without deleting it, or kick, time out or ban it. That is all: they cannot read your password or your email address.
• The moderators’ list of every username. Since 22 October 2026, Ryan’s call after moderators asked for it for safeguarding, the desk in the Moderators’ room lists every username on the CB, says how many there are and how many are seen in a room now, and shows who is seen and where, by exactly Be seen here’s rules: only if you pressed it, never in a room that keeps to itself, and a room only to a moderator it is for. Each name opens its profile, which anybody signed on can already open from the channel. It shows nothing else: not when you joined, not your email address, not anybody’s roles beyond moderator. It is fetched when a moderator presses for it, nothing is kept for it, and nothing records who looked. Until that day there was no list of everybody, for moderators or anybody, and it is still shown to nobody else: the street’s rule against counting people is about what everybody sees, and this list is for the people who look after our community.
• Kick, time out and ban. A moderator can sign your username off every device at once (kick), which you can sign straight back on from with your own password; keep it off the CB for ten minutes, an hour, a day or a week (time out); or keep it off until a moderator lifts it (ban). Each signs every device off, so your notifications stay off until you switch them on again. While a time out or a ban holds, nothing that needs signing on works for your username, reading included, and signing on tells you a moderator timed you out and for how much longer, or banned you, and where to reach us; it says so only after the right password, so nobody else who tries your username learns anything. We keep until when it holds, and nothing else: not which moderator did it, not why. A time out that has ended is taken off the next time you sign on. Your username, and everything kept under it, stays yours throughout, and a ban keeps anybody else from claiming the name. If you think one was a mistake, reach us privately.
• Where it is kept. Beside the channel, at Netlify, under Netlify’s privacy policy.

We keep your account because you asked us to, so that your username is yours; joining is your consent, giving an address is your consent to that too, and deleting your username takes both back.

Two-step sign-in

Since 2026-10-26, Ryan’s call, anybody with a username can turn on two-step sign-in under Account: after your password, signing on asks for a six-digit code from an authenticator app on your phone, or a passkey (your fingerprint, your face or the screen lock on your device). From 2 November 2026 it is required for our moderators and staff; a staff username without it is on the CB as an ordinary member, with nothing else shut, until it is set up. Somebody who learns your password still cannot sign on as you.

• What we keep, on your username’s record and nowhere else. For an authenticator app, its secret, sealed at rest with the staff key, and the last half-minute a code was used in, so each code works once. For each passkey, its credential’s id, its public key, which kind it is, its signature counter and the name you gave it; never your fingerprint or your face, which never leave your device, and nothing that could sign on as you. Your backup codes, each kept only as a scrambled form of it, each good once. Nothing about when any of it was added.
• The QR code is drawn in your browser, from the key, so the key never goes to anybody else to be turned into a picture. The key is shown to you once, to put into your app, and not again.
• Signing on. Your password earns a ticket good for five minutes, and the second step is checked against it; nothing is stored for it. A wrong code counts as a wrong password, and five lock the username for fifteen minutes.
• Adding or taking off a step signs every other device off. Taking one off, and new backup codes, ask for your password.
• If you lose your steps. A backup code signs you on once. Your recovery code, or a reset code we email you, changes your password and still asks for the second step. A reset code from a moderator takes the second step off, because the moderator has made sure who they are talking to.

The shelters, and your pets

Rescue A Cat, Rescue A Dog and Rescue Small Animals are shelters where animals turn up at random, and the first person signed on to the CB to press brings one in and can name them. Anybody signed on can adopt one, who then lives in the Profile on their radio. Both are part of the CB.

• Who can rescue or adopt. Only people signed on to the CB. Rescuing sends your pass, which animal, and the name you typed, if you typed one; adopting sends your pass and which animal. The pass is checked and not kept, and nothing records who rescued any animal.
• What each shelter keeps. The animals waiting for a home: each one’s looks, where they were found, their name and when they came in; and when the next animal is due, which is random and never sent to any page. An animal stays until somebody adopts them. The base station can take a name off an animal, wherever the animal is.
• The list of everybody adopted, kept for good. Each adopted animal’s looks, name, and when they came in and were adopted, and, once their person has renamed them, the name they came in under. It never says who adopted or renamed anybody, and anybody who opens the rooms can read it.
• Showing your pets, if you choose to. With a claimed username, Show my pets on the CB in Profile lets anybody signed on to the CB press your handle on the channel and see your pets: what they look like and what they are called, not when they came in or were adopted. It is off until you switch it on. We keep only that it is on, and when you switched it on; switching it off, Forget me and deleting your username delete that. Showing them lets people find them on the list of everybody adopted, which still says nothing itself. Pressing somebody’s handle sends your pass and their handle, and we keep neither.
• Stickers. Sticker on the radio sends a drawing of one of your own pets, with its name, to the channel you are tuned to. It is a message like any other, kept and deleted with the channel’s messages, and it says nothing more than the drawing and the name.
• Renaming. Once adopted, a pet can be renamed from Profile, as often as you like. That sends your pass, which pet and the new name; the name changes in your pets and on the list of everybody adopted, and the base station can take a name off there as it can in the shelter.
• Your pets, which with your avatars, your chimeras, the jobs you keep from the Guild, your battle jacket’s patches, your crystal pouch, your herb basket, your profile card and your username, if you claim it, is all the street keeps under a person. When you adopt, the animal is filed under your handle so that your Profile shows them on any device you sign on with. The record is filed under a scrambled form of your handle, not the handle itself, so the store does not list handles; it holds your pets’ looks, names and dates, and nothing else about you, and beside it, only if you switch it on, that your pets are shown, and, only while you have let one out, a copy of that pet in the room. Only your password reaches them: nobody else can sign on as your username. Opening Your pets in Profile sends your pass to us, once, to fetch them.
• Forget me. The button under Account, on your radio. It deletes your record there and then, your avatars, your chimeras, the jobs you keep from the Guild, your battle jacket, your profile card and its sets, your props, your chat status, your saved filters for tasks, your own order for the chat page’s channels, your messages and when you last read each channel and conversation with it, and takes home any pet you have let out. Your animals stay on the list of everybody adopted, where nothing ever connected them to you. It cannot be undone.
• What your browser keeps. The animals you rescued, under love-rescues, as listed above. That is on your device and never sent to us. It is also why the Guild’s Rescue Ranger badge is shown only on the board and in your own Profile: nothing here knows who rescued, so nobody else can be shown it.
• The cat café and the dog park. Pekoe and Purrs and the Run read their shelter’s list when they open, the same way anybody opening the shelter does, with no pass, and that list now carries the pets people have let out there. Otherwise they keep nothing: the animal on your lap or beside your chair, and what is on your table, live in the page and are gone when you leave it. A film on either telly loads from YouTube only when you press it, like every film on the street.
• Letting your own pet out, if you choose to. Signed on to the CB, you can let a cat you adopted out in the café, or a dog you adopted off the lead on the Run, a few of yours at a time. The part in the room that does it sends your pass once when the room opens, to see which of your pets are out, and then only when you press: your pass, which pet, and out or home. While a pet is out we keep a copy of them in that room’s list: what they look like, where they were found, their mood and their name, filed beside the scrambled form of your handle and nothing about when. Anybody who opens the room can meet them, with no pass, and the room says they have a home and never whose; their name is the one already on the list of everybody adopted. Renaming them changes the copy, and the base station can take a name off it. Taking them home deletes the copy, and so do Forget me and deleting your username. The animals waiting for homes come first: when the room is full, yours stay home, and if the shelter fills up while yours is out, the last pet let out waits outside until there is a place.
• What we do not keep. The same as the radio: no IP address, nothing in any log, and no list of who rescued, who adopted or who looked.
• Where it is kept. Beside the channel and the chalkboard, at Netlify, under Netlify’s privacy policy. The shelters’ and the pets’ answers ask search engines not to index or archive them.

We keep your pets because you adopted them and asked the street to remember, and keeping them is what that takes. Adopting is your consent to it, and Forget me takes it back.

Your avatars

An avatar is a bodymind you drew at the Bodymind Booth, dressed or not at the Dopamine Dress-Up Den, or an outfit on the Den’s valet stand with no body in it. Drawing one, changing it and walking it next door happen in your browser and send nothing: next door, it travels in the address, after the #, which never reaches any server. Avatars are the second thing the street keeps under a person, after pets, and only when you press a button that says it keeps. That was Ryan’s call, 2026-10-14, made knowing it.

• An avatar is a list of choices, never a picture. What is kept is the choices you made, every one a word out of the booth’s and the Den’s own lists, which our server checks against those lists and refuses anything else; its name, if you give it one; and what you wrote about it, if you write anything. There is no camera in the booth, nothing to upload, and nothing an image could be. The drawing is made fresh from the choices wherever it is shown.
• Keeping one. Signed on to the CB, Keep it in the booth or the Den sends your pass, the choices, the name and what you wrote. Changing or deleting one from Profile, or keeping the changes, sends your pass, which avatar and what changed. We keep up to 24 at once.
• Opening your strip. Signed on to the CB, Open my strip in the booth, the Dress-Up Den or Fantasy Fancy Dress sends your pass and brings back the avatars you kept, so you can change one there. It sends nothing else and keeps nothing, and nothing in Fantasy Fancy Dress is kept: what you change there is kept back in the Dress-Up Den, when you press Keep.
• Walking as your avatar. Signed on to the CB, Bring my avatar on Paper Street or Cel Street sends your pass, once, and brings back your avatars, so the one you wear on the CB can walk down the street with you. It sends nothing else, and nothing on either street is kept: not where you walked, not which doors you passed, not where you teleported to. Your familiar walks there too, read from your own browser where it already is.
• Where they are kept. Under a scrambled form of your handle, the same as your pets, so the store does not list handles, at Netlify, beside the channel. Only your password reaches them: nobody else can sign on as your username.
• Wearing one on the CB, if your username is claimed. Profile lets you wear one avatar at a time, and change which whenever you like. The one you wear is shown beside your name on Who’s online to anybody signed on to the CB, while you are seen in a room, and large in your profile, which anybody signed on to the CB opens by pressing your handle on the channel or your name on Who’s online, with what you wrote about it. To do that, a copy of its choices and what you wrote is kept where Who’s online can read it, under the same scrambled form of your handle, and it is shown only beside a claimed username, a mark we take from your pass. Taking it off, deleting it, Forget me and deleting your username take that copy away first.
• Showing the rest, if you choose to. With a claimed username, Show my avatars on the CB in Profile shows all your avatars in your profile, the one you wear first, with their names and what you wrote. It is off until you switch it on. We keep only that it is on, and when you switched it on; switching it off, Forget me and deleting your username delete that. Opening somebody’s profile sends your pass and their handle, and we keep neither; the answer never says whether somebody has avatars they have not shown.
• What a screen reader hears. Only what you wrote about it. The drawing is silent if you wrote nothing, and nothing on the street ever describes your body for you.
• As your familiar. Take it with you in the room, or Take it with me on a chimera in Profile, makes it your familiar, which follows you from room to room and sits wherever there are no words. That is kept in your own browser, under love-familiar above, and never sent to us: we do not know who has a familiar or which one, and nobody else sees it, unless you bring it out.
• Its sayings. A chimera can have up to five sayings, a line each, which you write beside its name on the bench or in Profile. They are kept with the chimera when you keep it, shown under it in your profile if you show your chimeras, and said by it as your familiar: when you press it, and now and then in a speech bubble while it may move by itself.
• Bringing your familiar out, if you choose to. With a claimed username, Bring my familiar under Be seen here on the radio sends us a copy of your familiar: which animal gave each part, its name and its sayings. The people seen in the same room as you see it there, walking about the room, while you are seen there, and you see theirs; nobody else does, it is never on Who’s online, and we keep nothing about when or where. It is off until you switch it on. Switching it off, sending your familiar home, Forget me and deleting your username delete the copy; taking a different chimera with you changes it. Nobody is told who looked.
• Chimera Cozies. Some rooms have a cozy, a spot drawn for a familiar to sit in, and your familiar sits in a free one. Nothing about that is sent or kept.
• Sending it home. Send it home, on the familiar, forgets it in your browser, and takes the copy in if you brought it out.
• As a sticker. Sticker on the radio can send one of your avatars to the channel you are tuned to, with its name and what you wrote. It is a message like any other, kept and deleted with the channel’s messages.
• Deleting them. Delete any one from Profile, which asks once more; Forget me under Account deletes them all with your pets, and whether they are shown; and Delete my account deletes them with your username.
• What we do not keep. The same as the radio: no IP address, nothing in any log, and no list of who has an avatar or who looked at one. Every answer about your avatars asks search engines not to index or archive it.

We keep your avatars because you pressed Keep and asked the street to remember them, and keeping them is what that takes. Pressing Keep is your consent to it, and deleting them takes it back.

Your jobs at the Guild, and their badges

The Adventurer’s Guild stamps the jobs you hand in, in your own browser, under love-quests, and works out your badges from them there; a badge is a set of things done that go together, mostly jobs, and it is kept nowhere. The jobs you hand in are the third thing the street can keep under a person, after pets and avatars, and only once you switch on Keep my jobs in my Profile on the Guild’s board, which starts off. That was Ryan’s call, 2026-10-14.

• What the board sends. Signed on to the CB, opening the Guild’s board sends your pass to us once, to ask whether your Profile keeps your jobs, and, as yes or no, whether it has a pet, for the Pet Parent badge; signed off, it sends nothing. Switching keeping on sends your pass and the jobs this browser has stamped. After that, handing a job in sends your pass and which job. The pass is checked and not kept.
• What we keep. Which jobs you have handed in, as a sorted list, and nothing about when or in what order: a list of times would be a record of how you spend your days. Only a job that is on the board can be in it. Your badges are not kept: the board and the radio work them out from the jobs, from whether your Profile has a pet, and from the animals your own browser rescued.
• Which badges other people see. In your profile, only what your jobs and your pets already show: the badges your jobs make if you show your jobs, and Pet Parent if you show your pets. Rescue Ranger is never shown to anybody but you, because nothing on the street knows who rescued which animal.
• Where they are kept. Under a scrambled form of your handle, the same as your pets and your avatars, at Netlify, beside the channel. Only your password reaches them: nobody else can sign on as your username.
• Showing them, if you choose to. With a claimed username, Show my jobs on the CB in Profile lets anybody signed on to the CB who opens your profile see your jobs and the badges they make. It is off until you switch it on. We keep only that it is on, and when you switched it on. Opening somebody’s profile sends your pass and their handle, and we keep neither; the answer never says whether somebody keeps jobs they have not shown.
• Deleting them. Switching Keep my jobs in my Profile off, which asks once more, deletes them and whether they are shown. So do Forget me and Delete my account under Account. The stamps in your browser are yours to forget with the board’s own button.
• What we do not keep. The same as the radio: no IP address, nothing in any log, and no list of who keeps jobs, who has which badge or who looked. Every answer about your jobs asks search engines not to index or archive it.

We keep your jobs because you switched on keeping them and asked the street to remember, and keeping them is what that takes. Switching it on is your consent to it, and switching it off takes it back.

Your battle jacket and its patches

Patches lie about the street, and some are on a counter in a shop, free to take. Each one is drawn in its own room and goes on your battle jacket, in Profile on the radio. The patches are the fourth thing the street keeps under a person, after pets, avatars and jobs, and only when you press a patch’s own button. That was Ryan’s call, 2026-10-14.

• Picking one up. Only signed on to the CB: a patch’s Pick it up or Take one sends your pass and which patch, and nothing else. Signed off, the button is not there and nothing is sent. The page itself sends nothing until you press.
• What we keep. Which patches are on your jacket, as a sorted list, and nothing about when you picked any of them up or in what order; the jacket sews them on in the order the street lists them. Only a patch that is on the street can be in it. Nothing counts who else has a patch: there is no list of a patch’s takers, only each person’s own jacket.
• Where it is kept. Under a scrambled form of your handle, the same as your pets, at Netlify, beside the channel. Only your password reaches it: nobody else can sign on as your username.
• Showing it, if you choose to. With a claimed username, Show my battle jacket on the CB in Profile lets anybody signed on to the CB who opens your profile see your jacket and what is sewn on it. It is off until you switch it on. We keep only that it is on, and when you switched it on. Opening somebody’s profile sends your pass and their handle, and we keep neither.
• As a sticker. Sticker on the radio can send one of your patches, or your whole battle jacket, to the channel you are tuned to. It is a message like any other, kept and deleted with the channel’s messages, and it carries which patch, or which patches were on your jacket when you sent it, and nothing else. A jacket sent as a sticker does not change when you pick up another patch.
• Downloading a picture. Download in Profile saves a picture of one of your avatars, chimeras, pets, badges or patches, or of your battle jacket, onto your own device. It is made in your browser from the drawing already on your screen, with the typefaces its words are set in fetched from this site; nothing is sent to us or anybody, and nothing is kept.
• Deleting it. Forget me under Account takes every patch off, with your pets, your avatars, your chimeras and your jobs; Delete my account does the same with your username.
• What we do not keep. The same as the radio: no IP address, nothing in any log, and no list of who has which patch or who looked. Every answer about your jacket asks search engines not to index or archive it.

We keep your patches because you picked them up and asked the street to remember, and keeping them is what that takes. Pressing a patch’s button is your consent to it, and Forget me takes it back.

Your crystal pouch

On every card of the Crystal Wheel in Myths & Legends, behind Helen Edgar’s Faery Yurt, you can take that crystal with you, and it goes into your crystal pouch, in Profile on the radio. The pouch is the eighth thing the street keeps under a person, after pets, avatars, jobs, patches, profile cards, chimeras and props, and only when you press a crystal’s own button. That was Helen’s ask, 2026-10-26.

• Taking one. Only signed on to the CB: Take it with you sends your pass and which crystal, and nothing else. Signed off, the button is not there and nothing is sent. The page itself sends nothing until you press.
• What we keep. Which crystals are in your pouch, as a sorted list, and nothing about when you took any of them or in what order. Only a crystal on the wheel can be in it. Nothing counts who else has a crystal: there is no list of a crystal’s takers, only each person’s own pouch. The pouch shows small drawings of the stones, never anybody’s photograph, and each one links back to its card.
• Putting one back. Put it back in Profile takes a crystal out of your pouch, and nothing remembers it was there.
• Showing it. Off until you switch it on, and only for a claimed username: Show my crystal pouch on the CB puts a Crystals tab in your profile for anybody signed on. While it is off, your profile says only that you have not made it public, the same whether your pouch is empty or full.
• Deleting it. Forget me under Account empties it, with everything else; Delete my account does the same with your username.
• What we do not keep. The same as the radio: no IP address, nothing in any log, and no list of who has which crystal or who looked. Every answer about your pouch asks search engines not to index or archive it.

We keep your crystals because you took them and asked the street to remember, and keeping them is what that takes. Pressing a crystal’s button is your consent to it, and Forget me takes it back.

Your herb basket

In the Herbery in Myths & Legends, behind Helen Edgar’s Faery Yurt, you can gather a herb, and it goes into your herb basket, in Profile on the radio. The basket is the ninth thing the street keeps under a person, after pets, avatars, jobs, patches, profile cards, chimeras, props and the crystal pouch, and only when you press a herb’s own button. That was Helen’s ask, 2026-10-26.

• Gathering one. Only signed on to the CB: Gather it sends your pass and which herb, and nothing else. Signed off, the button is not there and nothing is sent.
• The cauldron sends nothing. Tipping herbs into the cauldron and stirring happens in your browser, and nothing about it is sent or kept, signed on or not.
• What we keep. Which herbs are in your basket, as a sorted list, and nothing about when you gathered any of them. Only a herb in the Herbery can be in it. Nothing counts who else has a herb, and the brews and stews your basket could make are worked out on your screen each time and kept nowhere.
• Putting one back. Put it back in Profile takes a herb out of your basket, and nothing remembers it was there.
• Showing it. Off until you switch it on, and only for a claimed username: Show my herb basket on the CB puts a Herbs tab in your profile for anybody signed on. While it is off, your profile says only that you have not made it public, the same whether your basket is empty or full.
• Deleting it. Forget me under Account empties it, with everything else; Delete my account does the same with your username.
• What we do not keep. The same as the radio: no IP address, nothing in any log, and no list of who has which herb or who looked. Every answer about your basket asks search engines not to index or archive it.

We keep your herbs because you gathered them and asked the street to remember, and keeping them is what that takes. Pressing a herb’s button is your consent to it, and Forget me takes it back.

Your profile card

Pressing somebody’s handle on the channel, or their name on Who’s online, opens their profile: their card, and beside it their avatars, pets, badges and jobs, battle jacket, chimeras and props, each as they have chosen to show it. The card is the fifth thing the street keeps under a person, after pets, avatars, jobs and patches, and it is yours alone, because only your password signs on as your username. That was Ryan’s call, 2026-10-17, after requests for profiles more like Discord’s.

• What is on it. Only what you fill in, at Edit my profile card in Profile: a theme, a banner, a decoration round the avatar you wear, a frame round your profile, an effect over it, a face for your name and a nameplate, each chosen from the street’s own lists, which our server checks against those lists and refuses anything else; and, in your own words, your pronouns, a tagline (one line, since 2026-10-23), a few hundred characters about yourself, up to five links to your other places, and your favourite room on the street with a line on why. A part left empty shows nothing. Whether you are in the community directory is on it too, and it is off until you tick it.
• Who sees it. Unless you choose otherwise, whatever you fill in is shown to anybody signed on to the CB who opens your profile, the way the avatar you wear is, because you wrote it to be shown. Since 2026-10-26 (Helen Edgar’s question, Ryan’s call) your card can instead be private, shown to you and nobody else, or open to the public, on its own page, which you choose on the card. Your nameplate is shown under your name on Who’s online, while you are seen in a room; to do that, which nameplate you chose is kept where Who’s online can read it, under a scrambled form of your handle, and it is shown only beside a claimed username, a mark we take from your pass. Opening somebody’s profile sends your pass and their handle, and we keep neither.
• What it never says. When you claimed your username or joined, and nothing on it is counted. A room that keeps to itself cannot be named as a favourite, because naming it would list it.
• Links. Each must start with https:// or http://, with no name or password in it. It is shown as you typed it, with the site it goes to written after it, the way a link on the channel is, so nobody is sent somewhere it does not say. Following one opens that site, which has its own privacy policy, in a new tab with no referrer.
• Saving and changing it. Save my card sends your pass and everything on the card, and replaces what was there. Nothing is sent while you choose, and closing the window without saving sends nothing.
• Deleting it. Clear my card, which asks once more, deletes it and takes your nameplate off Who’s online and you out of the community directory first. So do Forget me and Delete my account under Account, which delete your profile sets too.
• Profile sets. A set is your card’s look kept under a name you give it, to wear again with one press: its theme, banner, decoration, frame, effect, name face and nameplate, and which avatar you wear, or none. Nothing you wrote is in a set, so wearing one changes how your card looks and leaves your pronouns, your words, your links and your favourite room as they are. Your sets are shown to nobody: anybody who opens your profile sees what is on your card, and is not told what sets you have, that you have any, or which one you are wearing. Save as a set and Update send your pass and the set’s name, and our server reads the look off your card as it is saved and the avatar you wear, so a set only ever holds something that was on your card. Pressing a set sends your pass and which set, and saves its look onto your card and wears its avatar, as Save my card and wearing an avatar do. We keep each set’s name, its look, which avatar and an id, under a scrambled form of your handle beside your card, and nothing about when: not when it was saved, nor when you last wore it, nor which one you wore. Up to 24 at once. Clear my card leaves them; Delete it deletes one, and Forget me and Delete my account delete them all. That was a request from our community, 2026-10-19.
• A moderator clearing it. If a card breaks our covenant, a moderator can clear it from their desk, which deletes it and takes your nameplate off Who’s online and you out of the community directory exactly as Clear my card does, and leaves your username, its password, your pets, avatars, chimeras, jobs and patches as they were, so you can fill in a new card. We keep nothing about it: not who cleared it, not when, and not what the card said. That was Ryan’s call, 2026-10-18; until then a card could only go with the whole username.
• Where it is kept. Under a scrambled form of your handle, the same as your pets, at Netlify, beside the channel. Every answer about a profile asks search engines not to index or archive it.
• What we do not keep. The same as the radio: no IP address, nothing in any log, no time the card was saved, and no list of who has a card or who looked at one.

We keep your card because you filled it in and saved it to be shown, and keeping it is what that takes. Saving it is your consent to it, and clearing it takes it back.

Your profile’s own page, and who may open it

Every claimed username’s profile has a page of its own, at stimpunks.world/profile.html# and the username, so you can share it wherever you like. That was Helen Edgar’s question and Ryan’s call, 2026-10-26. You choose who may open your card, on the card itself, under Who can open your card, and nobody else can choose it for you:

• The community. Anybody signed on to the CB, on the radio and on your page. This is what every card was before, and it is what yours is until you choose something else.
• Only me. Your card is shown to you and nobody else, on the radio and on your page; anybody else who opens your profile is told you keep your card private. It also takes your nameplate off Who’s online and you out of the community directory. The avatar you wear is still shown, as it is beside your name on Who’s online, and so is each tab you have switched on to show on the CB, by its own switch.
• Anybody with the link. Your page shows your card, the avatar you wear and each tab you have switched on to show on the CB (your avatars, pets, badges and jobs, battle jacket, chimeras, crystals and herbs) to anybody who opens it, signed on or not. It never shows your props, your chat status or a way to message you, to anybody: those are the community’s and stay on the radio. BASE, for a moderator, is shown only to people signed on.

• What the page sends. The username is after the # in the address, so it never reaches our server in the address. The page sends it to us in the body of one request, with your CB pass if you are signed on, and we keep neither. To somebody signed off, our server answers the same thing for every username it will not show, whatever the reason: private, for the community, nothing on the card, or nobody by that name. So the page cannot be used to find out which usernames exist.
• Search engines. A search engine reads every address after a # as the one page, profile.html, which says only what the page is, so no profile is ever indexed or listed, open to the public or not. Every answer about a profile asks search engines not to index or archive it. No profile is in the sitemap, the street’s list for AI agents, or anywhere else we publish. Somebody you give the link to can still pass it on, as with any link.
• Animations. Everything on your card is drawn on your page as on the radio. What moves moves at MAX GLITTER, or after the reader presses Let it move, which lasts for that visit and is kept nowhere, not even in their browser.
• What is kept. Which of the three you chose, on your card, and nothing else: no list of who has a public card, nothing about who opened anybody’s page, and no IP address or log, the same as the radio.
• Taking it back. Choose another and save your card, and the page shows the change straight away. Clear my card, a moderator clearing it, Forget me and Delete my account put it back to the community, with nothing on it.

We keep your choice because you made it, and showing your card to the people you chose is what that takes. Choosing is your consent, and choosing again changes it.

Home

Home is the CB’s dashboard, where the house on the radio’s bar and the joining page take you (Ryan’s brief, 2026-10-27). It keeps nothing, and it sends nothing new.

• What it asks. Only what the radio and the forums already answer, with your pass, each the way they already ask: what is new to you, whether props are waiting for you, the events you can see, who pressed Be seen here, the forums’ latest topics, the Brass Tacks Board, and the forums’ categories you may read. It reads the street’s own public files for the rest: the changelog’s feed, the list of rooms and the job board. Asking what is new never tells our server you have read anything.
• When it asks. Once when the page opens, and again only when you press Look again. No timer, and nothing while the page is shut.
• The rooms you follow. These are the radio’s, kept in this browser under love-cb and sent nowhere, as Unreads says. Following or not following a room from Home asks the radio to change them; Home itself writes nothing in your browser.
• What it never says. How many of anything. Something new is a dot, and nobody is counted.

The community directory

The community directory lists everybody on the CB who has chosen to be in it, so people can find each other. That was Ryan’s ask, 2026-10-23. Nobody is in it until they choose to be: Show my profile in the community directory, on your profile card, starts off, and only you can tick it, because only your password signs on as your username.

• What it shows of you. Your username, BASE if you are one of our moderators, which we take from the moderators’ list, your nameplate, your tagline, your pronouns and the avatar you wear, each as it is on your card and on Who’s online. Your name there opens your card, as it does anywhere on the CB.
• Who sees it. Anybody signed on to the CB, the same people who can open your card. Nobody else: the page itself is public, and the list is only sent to a pass. Opening it sends your pass, and we keep nothing about who looked.
• What it never says. How many people are in it, and when anybody joined or was last on. It is in alphabetical order and in no other. Its search box narrows the list in your browser and sends nothing.
• What is kept. Whether you are in it, on your card; and, while you are, a copy of your username, nameplate, tagline and pronouns in one list our server reads the directory from, under a scrambled form of your handle, at Netlify, beside the channel. Save my card brings the copy up to date. Every answer about the directory asks search engines not to index or archive it.
• Coming out of it. Untick it and save your card, and your line is deleted. Clear my card, a moderator clearing your card, Forget me and Delete my account all take you out of it too.
• What we do not keep. The same as the radio: no IP address, nothing in any log, no time you were listed, and no list of who looked.

We keep your line because you ticked the box to be listed, and listing you is what that takes. Ticking it is your consent to it, and unticking it takes it back.

Props

A prop is a sentence or a short paragraph thanking somebody, acknowledging them or celebrating them, usually for something they did for you or for the community. Props are the seventh thing the street keeps under a person, after pets, avatars, jobs, patches, profile cards and chimeras, on a Props tab in their profile. That was Ryan’s call, 2026-10-18, after the forums’ Props & Gratitude category.

• Your Props tab is shut until you open it. Show my props on the CB in Profile opens it, and only you can confirm a prop, because only your password signs on as your username. While it is shut, nobody can give you props and your tab shows none of them. What you confirmed is kept, and comes back when you open it again.
• Giving somebody props. Open their profile, from their handle on the channel or their name on Who’s online, and write it on their Props tab. Anybody signed on can, and a prop carries their username on somebody else’s profile, which only they can sign on as. Sending one sends your pass, their handle and your words, at most 500 characters. One of yours waits for each person at a time.
• Nothing goes up until its person says yes. A prop waits, read only by the person it is for, in Profile, and by whoever wrote it, until they press Confirm, which puts it on their Props tab, or Reject, which deletes it. Nobody is told it was rejected: it simply stops waiting, which its writer can see.
• Being told. If you switch on When somebody gives me props under Notifications, a device switched on as your claimed username is told when somebody gives you props: who wrote them, and their first 180 characters unless you switched the words off for that device. It never says how many are waiting, and the writer is never told anything: not whether you were notified, nor whether you read, confirmed or rejected what they wrote. Nothing about the notification is kept. Pressing it opens the street with Profile open at Your props. Without it, props wait for you there until you next open Profile.
• Who reads it once it is up. Anybody signed on to the CB who opens that person’s profile, with the writer’s username on it and whether they were the base station, which we take from their pass. Opening somebody’s Props tab sends your pass and their handle, and we keep neither.
• Taking one off. The person it is for can take any prop off their tab, from Profile or from the tab; whoever wrote it can take it back, waiting or up; and a moderator can take one down. Each asks once more, and nothing is kept about it: not who took it off, not when, and not what it said.
• What is kept. Whether your tab is open, and each prop waiting for you or up on it: its words, its writer’s username, whether they were the base, a scrambled mark of the claimed username that wrote it, so that a username deleted and claimed again by somebody else cannot take back what its owner wrote, and an id. Nothing about when, and nothing is counted: nobody is shown how many props anybody has, or has waiting. Up to 100 on a tab and 20 waiting at once.
• Where it is kept. Under a scrambled form of your handle, the same as your pets, at Netlify, beside the channel. Every answer about props asks search engines not to index or archive it.
• Deleting them. Forget me and Delete my account under Account delete your Props tab, everything on it and everything waiting for you. Props you wrote for other people stay up on their tabs, with your username on them, the way a forum post does; take each back from their tab first if you want them gone.
• What we do not keep. The same as the radio: no IP address, nothing in any log, and no list of who gave whom props or who looked at a tab.

We keep props because somebody wrote them to be shown and the person they are for confirmed them, and keeping them is what that takes. Confirming one is your consent to it, and taking it off takes it back.

Events

Events on the CB are times somebody has scheduled for something: a coworking hour in a room’s call, a film in a room, a meeting at a link off the street. They came on 2026-10-23, Ryan’s ask and calls, after Discord’s scheduled events. They are under Events on the radio, and at the top of the channels on the chat page.

• Who can see one. An event is in a channel. On World, everybody signed on to the CB can see it; in a room, whoever may go into that room can, so an event in one of the Town Hall’s private rooms, or in a staff category’s room in the forums, is seen only by the people who can go in. A room that keeps to itself has no events, because an event is listed and announced outside its room.
• Scheduling one. Anybody signed on can, on World or in a room they can go into: in its call, in the room itself, or at a link off the street. It carries your username for everybody who can see it, and whether you were the base. Sending one sends your pass, its title, what it is about if you write anything (up to 2,000 characters), where, the date and time you typed, your device’s time zone, how long it runs and how it repeats. The time zone is kept with it, because a repeating event keeps to its maker’s clock when summer time starts or ends. Up to 20 at once each.
• Changing or cancelling one. Whoever scheduled it, and any moderator who can see it, can change it, cancel one time a repeating event would happen, or cancel it altogether. A change keeps who scheduled it and who is interested. Nothing is kept about who changed it, when, or what it said before.
• Saying you are interested. Anybody who can see an event can say they are interested, and take it back. Your username is then on it for everybody who can see the event: an event names who is interested, in alphabetical order, and never how many, the way a reaction names who and never counts. Whoever schedules one is interested in it from the start, and can take that back too. Each list holds up to 500 names.
• Being told. Two switches under Notifications, each off until you switch it on. When an event I’m interested in starts tells a device switched on as you, up to five minutes before it starts: its title unless the words are off for that device, where and when. New events on World and in rooms I follow tells a device about an event scheduled on World or in a room it follows: who scheduled it, its title unless the words are off, where, and when it first starts. Never who else is interested, and nobody is told about an event they scheduled. Pressing one opens the chat page at Events.
• Joining an event’s call. While an event in a call is on, its card says who is in that call (see calls) and has a way in: on the chat page, Join the call here opens the room’s channel and its call; Join it in the room goes to the room’s own page with its Join this room’s call button ready, which you press yourself. Nothing is sent for either until the call opens, which is a call like any other.
• Add to my calendar. Makes a calendar file of the next time an event happens, in your browser, and hands it to your device. Nothing is sent to us, or to anybody, for it.
• What is kept. For each event: an id, its title, its words, its channel and where in it, its link if it is off the street, when it first starts and in which time zone, how long it runs, how it repeats and any times of it cancelled, its maker’s username and whether they were the base, and the username of everybody interested; and, for its maker and everybody interested, a scrambled mark of the claimed username, so that a username deleted and claimed again by somebody else is not them. Nothing about when it was scheduled or changed, or when anybody said they were interested. So that each start is told once, which starts have been told, kept for a day. All of it is at Netlify, beside the channel, and every answer about events asks search engines not to index or archive it.
• How long. An event that happens once is shown to nobody once it has ended, and is deleted within the hour. A repeating one is kept until whoever scheduled it, or a moderator, cancels it.
• Deleting them. Forget me and Delete my account under Account delete every event you scheduled, and take your username off every event you said you were interested in.
• What we do not keep. The same as the radio: no IP address, nothing in any log, and no record of who looked at an event.

We keep an event because somebody scheduled it for other people to see, and a username on it because they said they were interested, and keeping them is what that takes. Taking either back, or cancelling the event, deletes it.

Direct messages

Messages, a part of the CB between the channel and Watching together, is for writing to one other person. That was Ryan’s call, 2026-10-18, after requests from our community as it moves off Discord.

• A username at both ends. Every username is claimed, so a message to one is read by whoever holds its password and nobody else. Messages are kept under the username and when it was claimed, so if a username is deleted and somebody else claims the same name, nothing of the old owner’s reaches them.
• Nobody new can write to you until you switch it on. Let people message me, under Messages, is off until you switch it on. While it is on, anybody with a claimed username can ask to message you: their first message waits, and they can write nothing more until you answer it, press Accept, or press Reject, which deletes it and tells nobody. A conversation already going goes on if you switch it off; you can still write to people who take messages.
• Every message goes two weeks after it was sent, the same as the channel, and a conversation keeps its latest hundred, unless our administrators set direct messages otherwise (How long each channel keeps). Who talked to whom is not kept a minute past the last message between them: a conversation with nothing left in it is gone, and the next message after a quiet two weeks asks again. You can edit your own messages, which shows that they were edited and keeps nothing of the words they replaced, and take them back, which deletes them for both of you.
• Disappearing messages, once a conversation is accepted (since 2026-10-29, a request from our community, after WhatsApp’s). Either of you can set a conversation’s new messages to go 24 hours or 7 days after they are sent, or switch it Off, and either of you can change it again. It reaches only messages sent after the change: every message keeps the time it was sent under, so switching it on does not delete what is there, and switching it off does not keep anything longer. The conversation keeps which it is set to and nothing about who set it or when; the radio says it is on above your messages, for both of you. It is never longer than our administrators keep direct messages. A message does not go when it is read, which is what was asked for first: that would tell whoever sent it that you had read it, which nothing here ever tells anybody, and it would leave you no time to report a message that should not have been sent. It does not stop a screenshot, a copy, or a notification that has already reached a device, and a message you report stays on the moderators’ desk for its thirty days, whatever the conversation is set to.
• Stickers and reactions, once a conversation is accepted. As on the channel: a sticker is a copy of something of yours, made when you send it, and a reaction says who pressed it and never how many. Both go with their message, and neither can go with a first message, which is words only.
• Replies, once a conversation is accepted. As on the channel: a reply keeps which message in the conversation it answers and nothing else of it, and says so once that message has gone.
• Pictures, once a conversation is accepted. Ryan’s call, 2026-10-19, after somebody in our community could not send him a screenshot privately: a first message is words only, so nobody’s first contact with you can be a picture, and once a conversation is accepted either of you can add a picture to a message. It is the channel’s picture in every way that matters: redrawn in your own browser before it is sent, which takes off everything a camera or a phone wrote into it, where it was taken first of all, and refused by our server if any of that is still in it; a description is offered and never required; and it has no public address. It is kept beside the conversation, with which of you sent it and when, is fetched with your pass by the two of you and nobody else, and goes the moment its message goes: taken back, at its two weeks, pushed out by the fiftieth after it, or with the whole conversation when either of you blocks the other, rejects it or deletes their username. One you added and never sent is deleted within the hour. Ask anybody recognisable in a picture before you send it.
• Blocking. Block, under a conversation, stops that person writing to you and you to them, and deletes your conversation for both of you. They are not told: if they try to write, they are told you are not taking messages from them, the same words as if your switch were off. A block is kept in your own record, by a scrambled form of the name you blocked, so it holds if that name is deleted and claimed again, and nobody but you is shown your block list. Unblock under All messages takes it off.
• They are not end-to-end encrypted. Your words travel to our server encrypted, like everything on this site. Since 2026-10-25 they are sealed at rest, Ryan’s call: every conversation, every picture sent in one, your switch and your blocks, and any report copied from them are encrypted where they are kept at Netlify, with a key of their own that nothing else on the street uses, so somebody who got at the stored files alone could not read them. Our server still opens them, to show the two of you your conversation, and a report to our moderators, which is why this is not end-to-end. Without that key, Messages is shut rather than written in the clear. Anything written before that day is sealed the next time it is written, or within the hour. Nothing on the street shows a conversation to anybody but the two people in it. No moderator can read one: there is no way for them to, on the desk or anywhere else. End-to-end encryption, where only your devices hold the keys, would be a much bigger thing to build and to keep working on every device, and it is not this.
• Reporting a message. Report, on a message the other person sent you, is the one way a message reaches the moderators. It copies that message’s words, its picture if it has one, who sent it and when, your username and a note if you write one onto the moderators’ desk. A reported picture is shown on the desk only when a moderator presses to see it. The person you report is not told. A report stays until a moderator closes it, which deletes it, or for thirty days at most, even if either of you deletes your username, because it is how the moderators look after the street. Nothing else about the conversation goes with it.
• Being told. If you switch on When somebody messages me under Notifications, a device switched on as your claimed username is told when somebody writes to you. The sender is never told anything about it.
• What is sent. While Messages is open on your radio, and only then, it asks for your conversations, or the one on your screen, every few seconds: your pass, and the username you are talking with, in the body of the request rather than the address. Folded, in a tab behind another, or with Messages shut, it asks nothing. On the chat page your conversations are listed beside the channels, so while that page is in front of you it also asks for that list, at most every half minute and sooner when somebody new has written; which conversation you pick there is kept nowhere, not even in the page’s address.
• What is kept. Whether you take messages, and who you blocked. For each conversation: the two usernames, which of you asked, whether it was accepted, and its messages, each its words, its picture and description if it has one, the sticker if it is one (a copy of one of your avatars, chimeras, pets or patches, or your battle jacket, taken when you sent it), who reacted to it with what, who sent it, BASE if a moderator did, and when it was sent and last edited. An empty marker for each of you, with when it was written, so your list can be found without anybody keeping a list of who talks to whom. Nothing about who read what, for anybody else: no read receipts, nothing telling the other person a message was seen, nothing saying somebody is typing, and nothing is counted: no number of unread messages anywhere. For yourself, when you last read each conversation is kept so the radio can mark what is new to you; see what is new to you.
• Deleting them. Forget me and Delete my account under Account delete your switch, your block list and every conversation you are in, for both of you. Reports stay on the desk for their thirty days.
• What we do not keep. The same as the radio: no IP address, nothing in any log, no copy anywhere, and no list of who has written to whom. Every answer about messages asks search engines not to index or archive it.

We keep messages because the two of you wrote them to each other, and keeping them for two weeks is what a conversation takes. Accepting a conversation is your consent to it, and Block, Forget me and deleting your username take it back.

Your chimeras

A chimera is one creature you made out of two animals in Chimera Obscura. Making one, changing it and naming it happen in your browser and send nothing: a link to it carries it after the # in the address, which never reaches any server. Chimeras are the sixth thing the street can keep under a person, after pets, avatars, jobs, patches and profile cards, and only when you press Keep it in my Profile. That was Ryan’s call, 2026-10-18.

• A chimera is a list of choices, never a picture. What is kept is which animal gave each part, every one a word out of the room’s own shelf, which our server checks against that shelf and refuses anything else; and its name, if you give it one. Nothing about when you made it is kept. The drawing is made fresh from the choices wherever it is shown.
• Keeping one. Signed on to the CB, Keep it in my Profile in the room sends your pass, the choices and the name. Renaming or deleting one from Profile sends your pass, which chimera and what changed. We keep up to 24 at once.
• Where they are kept. Under a scrambled form of your handle, the same as your pets and your avatars, so the store does not list handles, at Netlify, beside the channel. Only your password reaches them: nobody else can sign on as your username.
• Showing them, if you choose to. With a claimed username, Show my chimeras on the CB in Profile shows them in your profile, with their names, to anybody signed on to the CB who opens it. It is off until you switch it on. We keep only that it is on, and when you switched it on; switching it off, Forget me and deleting your username delete that. Opening somebody’s profile sends your pass and their handle, and we keep neither; the answer never says whether somebody has chimeras they have not shown.
• As a onesie. Fantasy Fancy Dress makes a onesie after a chimera. Wear it as a onesie in Chimera Obscura carries the chimera there after the # in the address, which never reaches any server. Bring my chimeras there, signed on, sends your pass and asks for the chimeras you kept, as Profile does, and sends nothing else. Keeping the bodymind wearing it is the Dress-Up Den’s, as your avatars say, and an avatar in a chimera onesie keeps which animal gave each part of that chimera, as a chimera does.
• As a sticker. Sticker on the radio can send one of your chimeras to the channel you are tuned to, with its name and which animal gave which part. It is a message like any other, kept and deleted with the channel’s messages.
• Deleting them. Delete any one from Profile, which asks once more; Forget me under Account deletes them all with your pets, and whether they are shown; and Delete my account deletes them with your username.
• What we do not keep. The same as the radio: no IP address, nothing in any log, and no list of who has a chimera or who looked at one. Every answer about your chimeras asks search engines not to index or archive it.

We keep your chimeras because you pressed Keep and asked the street to remember them, and keeping them is what that takes. Pressing Keep is your consent to it, and deleting them takes it back.

The Slake

The MUD Room has a world out its back door called the Slake, a multi-user dungeon with nobody to fight. Playing it on your own happens inside the page and sends nothing. Meeting other people on it is part of the CB and runs on the radio’s rules, with one switch of its own, Be seen out here, which is off every time you arrive and is never remembered.

• What it sends, and when. Only once you are signed on to the CB and have pressed Be seen out here, and only while the tab is in front of you. Then, every few seconds and whenever you move, it sends your pass, which place you are in, and a random number the page makes up for this visit, which nobody else is ever shown and which is how your visit moves and leaves without a list of visits anywhere. When you say something, your words come too. Switch it off, put the tab behind another or leave the page, and it tells us you have gone and sends nothing more.
• Who can see you. Anybody else who is signed on, has chosen to be seen, and is in the same place as you, by your handle. Being seen is also the only way to see: nobody can watch the Slake without being seen on it. Nobody is given a list of who is out there, or a number of people, and the map shows only you. A username says whoever holds its password is there, and nothing more about who they are.
• What we keep. While you are seen, one record: your handle, whether you signed on as the base station, which place you are in, the time of your last check, and the visit’s random number. Moving replaces it rather than adding to it, so where you have been is not kept. It is shown to nobody thirty seconds after your last check, and deleted when you stop being seen or leave, or within two minutes by anybody else’s check, or by the hourly sweep at the latest. What is said in a place is kept like the radio’s channel: the latest hundred things said there, each with its handle, its words and its time, each deleted two weeks after it was said, unless our administrators set every channel otherwise, and the base station can take one off sooner. There is no archive, no backup and no copy.
• What we do not keep. The same as the radio: no IP address, nothing in any log, no list of who was out there, and no record of where anybody went. Your tide, what you are carrying, the places you have found and the map stay in your page and are gone when you close it.
• Where it is kept. Beside the channel, at Netlify, under Netlify’s privacy policy.

We keep that you are in a place because you chose to be seen there, and keeping it for as long as you are is what that takes. Pressing Be seen out here is your consent to it, and pressing it again takes that back. We keep what you say in a place for two weeks because you said it to whoever is there, the same as on the radio, and you can ask us to delete it sooner.

Things that look like forms

A few rooms have boxes you can type into, and none of them sends anything. The Guild’s hand-in box checks a code inside the page, and sends which job to us only once you have switched on keeping your jobs in your Profile. The Zibaldone’s attribution slip puts a block of text on your own clipboard, and you decide where it goes. The Foundry sets the words you type in a typeface, in your browser. The MUD Room’s command line plays the game inside the page and sends nothing, except what you say while you are seen on the Slake. The CB is the one exception: its boxes, the chalkboard’s, the pebble bowls’, the suggestion box’s, the fence’s on Pando Calrissian’s hill, the Fridge of Sighs’ and what you say on the Slake included, send what you type, to us, as written up above.

Your rights

Because we hold so little, most of what the law gives you a right to ask about is not here to ask about. What there is:

• Your photograph, your recording or your name in a credit: ask us to see it, correct it or take it down, and we will.
• What you said on the CB: ask us and we will delete it now rather than at its two weeks. After that there is nothing left to ask about.
• What you said on the Slake: ask us and we will delete it now rather than at its two weeks. Where you were is already gone.
• What you chalked on the board: ask us and we will rub it out now rather than at the end of its week.
• What you pinned on Pando Calrissian’s fence: ask us and we will take it down now rather than at the end of its week. Your waterings are not there to ask about: the tree never knew they were yours.
• What you dropped in the suggestion box: take it down yourself, from the box, or ask any moderator and they will.
• Your pets: Forget me under Account on your radio deletes them, with your avatars, at once, or ask us and we will.
• Your avatars: delete any one from Profile, or Forget me there deletes them all at once, and the one you wore comes off Who’s online first.
• Your chimeras: delete any one from Profile, or Forget me there deletes them all at once.
• The jobs kept in your Profile: switch off Keep my jobs in my Profile on the Guild’s board, or Forget me under Account deletes them with everything else.
• Your battle jacket: Forget me under Account takes every patch off it, or ask us and we will.
• Your crystal pouch: put any crystal back from Profile, or Forget me under Account empties it, or ask us and we will.
• Your herb basket: put any herb back from Profile, or Forget me under Account empties it, or ask us and we will.
• Your props: take any one off your Props tab, or Forget me under Account deletes them all with everything waiting for you. A prop you wrote for somebody else: take it back from their tab, or ask a moderator and they will take it down.
• Your username: Delete my account under Account deletes it, its password, your pets, your avatars, your chimeras, your jobs, your patches, your crystals, your herbs, your profile card, your props and your chat status at once. Ask a moderator if you cannot get in, and they can delete it for you.
• An animal’s name in a shelter or on the list of everybody adopted: tell us which animal and we will take the name off. Nothing says which ones were yours, so only you can tell us.
• A word on the Fridge of Sighs: nothing says which words were yours, so we cannot find them for you; but if a word or a sentence should not be there, tell us what it says and we will take it down.
• Our host’s logs: Netlify holds those. Ask us and we will ask on your behalf, or contact Netlify directly.
• What your browser keeps: it is on your device and yours to clear. We never keep a copy, the CB pass included.

If you are in the EU or the UK, you also have the right to access, correct, erase, restrict, object to and move your personal data, and to complain to your data protection authority. We do not sell or share personal information for advertising, so a Global Privacy Control signal from your browser has nothing here to opt you out of — the answer is already no.

Reporting a security problem

If you have found a hole in this site, report it privately on GitHub; the policy is in SECURITY.md and security.txt. A report there is handled by GitHub under GitHub’s privacy statement.

When this page changes

If what this site does with your information changes, this page changes first, the date at the top moves, and the change is written up in the changelog on the day, where the feed will pick it up.