legal process
what is logged
Every page carries an edit log: what happened and when — created, edited, password set or changed, expiry or view limit changed, deleted — plus the size of the page after each edit. It names nobody and holds no page content. It is not linked from any page. A page's owner can read it from the edit console with their token.
what is sealed
Each log entry has a sealed counterpart. A sealed record holds a keyed hash of the acting party's IP address and their client string. Sealed records are not served by the log, not served by the API, and not served to the page's own owner. The IP address is stored as an HMAC, so the raw address cannot be read back out of a database copy.
what is never recorded
Readers are not fingerprinted. A page view increments a counter and updates a timestamp. No IP address, client string, referrer, or per-view row is written for a view. A subpoena cannot produce a list of who read a page, because no such list is created.
how sealed records are released
Sealed records are released only in response to valid legal process — a subpoena, court order, search warrant, or equivalent lawful demand from a body with jurisdiction. Requests must name the specific page identifiers and the time range at issue. Blanket or exploratory requests are refused.
Serve process to atg271@gmail.com.
retention
Pages expire on the schedule their author chose, at most 3 months, and are deleted from the database when they expire, when their view limit is reached, or when the author deletes them. Log entries — ordinary and sealed — outlive the page they describe.