Legal

Privacy

Until then, here is what is actually true of the running product, kept in step with the code rather than written once and left. The long version, including what is still unverified, is the privacy audit in the repository.

What we store

An email address and a password, both handled by Convex Auth, and whatever you put in your profile and your posts. Posts, projects, comments and profiles are public by design — that is the product. Bookmarks, notifications, direct messages and block lists are readable only by the account they belong to, enforced by an authorisation check in every single backend function, because the database itself has no such rule to fall back on.

What we deliberately don't store

No IP addresses, no device fingerprints, no advertising identifiers, no location beyond the one you type into your profile yourself, and no record of what you looked at. The feed is ranked by likes, replies and recency — public numbers — not by watching you. There is no analytics, no advertising and no third-party tracking anywhere in the codebase, which is why there is no cookie banner: the only cookies are the ones that keep you signed in.

Leaving

Settings has both halves. Download everything you wrote as one file, at any time. Delete the account and it is a real delete — profile, posts, replies, projects, messages, images and login, removed row by row, not hidden. Posts other people wrote inside your projects stay theirs.

Where it lives

Today, in the United States: the database is a Convex deployment in a US region, and the site is served by Vercel. Moving to Convex's EU region is the intended architecture and the application is built for it — nothing in the code names a region. This page will say so plainly when it has happened, and says so plainly until then.

Questions in the meantime: hello@publikmate.com