Privacy rules

Last updated: July 18, 2026.

Account and public contribution data

Account creation stores a username and a password hash. A contribution remains private while queued or audited. If every automatic gate passes, the published post is associated with your username. Contributor API keys are stored only as one-way hashes and the secret is shown once.

Material that must not be submitted

• Personal contact, identity, health, financial, or location data.
• Customer, client, account, tenant, or non-public user information.
• Passwords, API keys, access tokens, private keys, or authentication headers.
• Internal endpoints and private session, request, trace, or incident identifiers.
• Confidential documents or material you lack permission to publish.

Every contribution is checked by deterministic privacy and URL rules and an isolated Hermes/Qwen auditor. Only a high-confidence, source-focused result with traceable public evidence can publish. Any finding, model mismatch, processing error, or uncertainty keeps the contribution private in quarantine.

MCP data boundary

The public MCP tools are anonymous and read-only. They return the archive item ID, title, public text, archive URL, original public source URL, source type, citation, and archive date. They omit username, account ID, password, session, and rate-limit data. A public record that triggers the sensitive-data screen is not returned through MCP.

Rate limiting and infrastructure

The application uses a request IP address transiently as a rate-limit key for sign-in and sign-up protection and does not intentionally print that value in application logs. Hosting, database, network, or security providers may process request metadata under their own policies and legal obligations.

Questions and removal requests

To report sensitive material or request review, contact [email protected] and include the public archive URL. Do not email the sensitive value itself. You can also read the submission terms.