Changelog

  1. policy

    Privacy policy wording cleanup and advertising cookies (policy version 2026-10-29)

    • The privacy policy, terms and legal pages were reworded and shortened, and the template disclaimer at the foot of the legal pages is gone.
    • The copyright page now sends notices to the contact mailbox and no longer shows empty agent fields.
    • The policy now also explains, for when Google ads are shown, how Google uses advertising cookies and how to opt out in Google's Ads Settings.
  2. policy

    Advertising from Adsterra, also in the EEA, UK and Switzerland (policy version 2026-10-13)

    • We may show advertising from the ad network Adsterra. Visitors in the EEA, the United Kingdom and Switzerland are shown Adsterra ads only after they choose Accept all (or turn on Advertising) in the privacy choices banner; refusing or closing the banner keeps them off, as does a Global Privacy Control signal.
    • When you accept, Adsterra and its ad partners may set cookies and receive data about your visit, under Adsterra's own privacy policy (linked from the banner and from the list of third-party services on the privacy page). You can withdraw at any time through Privacy choices in the footer; the page then reloads and the ads stop.
    • Because this changes what the banner says, everyone is asked for their choices again once.
  3. policy

    Searching by name (policy version 2026-10-04)

    • You can now search for an account by a person's name, not only by username. The text you type is sent to our server and on to the data provider, only when you ask for a name search and never while you type.
    • We do not store what you typed: it is not written to a log, an analytics row or an error report. The list of matching public accounts is kept for up to 24 hours under a hash of the search text, so the same search is not paid for twice.
  4. policy

    One consistent description of how we handle IP addresses (policy version 2026-10-04)

    • Every page now says the same thing about IP addresses. Our analytics store no IP address, whole or shortened. Your IP address is used in memory only, for rate limiting, abuse protection, a guess at your country and a daily-rotating hash that counts unique visitors; the hash and its salt never leave memory and the salt is replaced every UTC day.
    • We now list the narrow exceptions plainly: a keyed one-way hash of your IP address is saved with a removal, copyright or privacy request and with a per-day fair-use counter for loading post comments, and attempts to sign in to the private administrator page are written to an audit log with their IP address.
    • Our hosting provider and the network in front of it necessarily see every IP address in order to deliver the site and keep their own logs under their own policies.
    • The privacy policy has a new "Your IP address" section, the purposes and retention tables list the exceptions, and the removal, methodology and about pages and our articles use the same wording. We also corrected the line that said unique visitors and sessions are not counted: they are, from the in-memory hash, and only the resulting numbers are stored.
  5. policy

    IP-derived records now expire (policy version 2026-10-04)

    • The per-day comment fair-use counter used an unsalted hash of the IP address and was kept indefinitely. It now uses a hash made with a random key that exists only in memory and changes every day, and its rows are deleted after two days.
    • Administrator sign-in attempts (with the IP address they came from) are deleted after 90 days. The IP hash saved with a removal request is blanked after 30 days.
    • We now count, per day, how many times each feature was used and by how many different people, never what was typed or searched.
  6. policy

    Visit log now described accurately (policy version 2026-10-04)

    • We corrected statements that implied nothing links a visit to the accounts looked up. For seven days we keep an anonymous visit log: when a visit started, country, device type, browser, how the visitor arrived, how many pages and searches, and which public accounts were looked up during that visit.
    • The log has no IP address, no cookie and no user or account identifier, nothing joins one visit to another, only the operator can read it, and it is deleted after seven days. After that only daily counts remain, including how often each public username was looked up, which has no link to any visit.
    • The privacy policy, methodology, about page, purposes and retention tables, llms.txt and our articles now describe the same three layers: no IP address stored in analytics, a seven-day anonymous visit log, and daily counts.
  7. policy

    Watchlist refresh, described accurately (policy version 2026-10-04)

    • Your watchlist is kept in your browser and the list itself is never saved on our servers. We now say plainly that when you open it, your browser asks our server for the current stories of each account on it, one request per account, so our server handles those accounts at that moment. Each request is counted like any other lookup; we do not keep them together as a list.
  8. policy

    Backups described accurately (policy version 2026-10-04)

    • The retention table said backups were kept for about two days. In fact one backup is made each night, the newest 14 are kept, and each contains both databases. A record deleted after its own retention period, such as a seven-day visit-log entry, can therefore remain in older backups for up to 14 more days. The table now says so.
  9. policy

    Privacy policy: the server access log section removed (policy version 2026-09-28)

    • The privacy policy no longer describes web-server access logs as a separate processing activity. What we record about a visit and how long we keep it is now stated in one place — the list of data we collect and the retention table — rather than two that had to be read together.
    • No change to what the site actually records or to how long it is kept: your IP address, the pages you open and the usernames you search, raw records deleted after 45 days and IP addresses shortened after 7.
    • Because the policy text changed, the cookie panel asks for your choices again. Nothing you previously rejected has been switched on.
  10. policy

    We stopped storing anything that identifies you (policy version 2026-09-28)

    • Our own analytics now keeps daily counts only. No visitor cookie is set, no IP address is stored in our analytics, whole or shortened, and no record links a visitor to the accounts they looked up.
    • The cookie banner for analytics is gone, because there is no longer anything to consent to. The consent cookie, its localStorage copy, the analytics opt-out cookie and the language cookie were all removed with it.
    • What we still count: page views, reading time, scroll depth and clicks per page, with country, device, browser, referrer and campaign as attributes of a count — plus how often each public username was looked up, with no information about who looked. That last one is how we understand what the service costs us; account owners can ask on the removal page to have it deleted.
    • What we gave up to get there: unique visitors, sessions, bounce rate and returning-versus-new. Counting distinct people needs an identifier, so we removed the numbers instead of approximating them.
    • The privacy policy shrank to match, and now includes a list of what we do not have. The controller section no longer gives a postal address and no longer names an EU or UK representative: those duties follow from processing personal data about visitors, which the site no longer does. A contact mailbox is the way to reach us.
  11. policy

    Privacy policy, terms and cookie choices rewritten (policy version 2026-09-24)

    • Privacy policy rewritten to match what the site actually records: IP address, searched usernames and first-party analytics, with lawful bases, a retention table, an international-transfers section and a full cookie and storage table.
    • Added sections for California (CCPA/CPRA), Brazil (LGPD), India (DPDP Act) and Israel, and a stated way to exercise your rights with a 30-day response time.
    • Cookie panel: Accept and Reject are equal, analytics and advertising are separate choices, nothing is pre-ticked, and the panel asks again when this policy or the list of third-party services changes.
    • A Global Privacy Control signal from your browser is now treated as an advertising opt-out, and a Do Not Sell or Share My Personal Information link appears when advertising services are enabled.
    • Google ads are not served to visitors in the EEA, UK and Switzerland unless a Google-certified consent platform is in place.
    • Terms of use rewritten (acceptable use, liability, governing law). Copyright page now names a designated agent and explains counter-notices. Removal requests are described as reviewed by hand.
    • Server access logs no longer keep the Referer header, so a searched username cannot appear next to an IP address there. Cached profile metadata is now deleted a week after it expires.
    • New legal hub at /legal.
  12. added

    First build

    • Story, highlights and profile viewer with an Instagram-faithful player.
    • Local, on-device watchlist — no account required.
    • Status pages tracking uptime for every major tool in this category.
    • 30 languages, with English, Portuguese (Brazil), Turkish and Indonesian written and reviewed by hand.