Privacy
Sovereign means answerable — so here is the whole of it, in plain words.
Your account: username, email address, and your password as an argon2id hash — never the password itself.
Your sessions: rolling sign-in tokens, stored only as hashes.
Your words: threads, replies, profile details, chat messages, and the images you upload.
If you sign in with Google or Telegram, we keep only the link between that provider and your account — never their password.
The sky — the moon, the hexagram of the day, the current planetary placements — is calculated on this machine, not fetched from anyone’s API.
The numbers — every gematria value and match — are computed here too, from a lexicon that lives on this box.
Cloudflare stands at the door as the edge proxy and shield: your requests pass through it, and it may set security cookies (like __cf_bm) to separate people from bots.
On the join and sign-in pages, Cloudflare Turnstile runs to prove you are human — it loads from Cloudflare’s domain and processes that interaction only.
Google and Telegram are optional sign-in providers. If you use one, your browser talks to that provider; we receive only your verified identity from them, and we never post to them. (Telegram’s widget asks for write access to work at all — we use none of it.)
No analytics, no trackers, no ad networks: Cloudflare’s browser-analytics beacon is switched OFF at the dashboard, and no other beacon exists here — nothing watches you but the stars.
The fonts are self-hosted; your browser talks to no one else’s servers to render these pages.
No sale or trade of anything about you, ever.
Your profile shows only what you write in it; edit or clear it any time in Settings.
Your posts and uploaded images are yours to delete.
Account deletion and a full data export are in active construction; until they ship, ask the admin directly and it will be done for you by hand.
Provider keys and passwords live only in environment files on this machine, never in the code, never in git.
Sign-in is protected by rate limits and bot checks; two-factor authentication is yours for the asking — and required for admins.
One sovereign box, one guarded backup rhythm — your words do not replicate across a cloud you never met.
