LEGAL // TRANSPARENCY
Transparency Report
We cannot be forced to hand over data we do not have. This page records what has and has not happened on this server.
Warrant canary
STATUS: INTACT- As of the date below, this service has received zero government or law-enforcement requests for user data.
- No gag orders, national security letters, or secret subpoenas have been served on the operators.
- No warrants, court orders, or informal requests have been received from any local, state, or federal agency.
- No backdoors, lawful-intercept hooks, or deliberate weaknesses have been introduced into this software.
If this canary is ever removed, altered, or left stale without explanation, assume compromise and verify independently. Canary last affirmed: Oct 30, 2026 · valid through Nov 29, 2026.
Latest signed event
SEQ #1 · AFFIRM · Oct 30, 2026 · signed by admin
Note: —
Signature (hex)
59bd797dc592fc9576d96bd84fb1104797410cfd78f19e12e0234bd7cbef56b84cce30dd3876631e1473ba9a2e3a9c6285711ba87d2c55f4bfb464f94905f20e
Public key (base64 SPKI DER)
MCowBQYDK2VwAyEA0Q3x/Ym+9XNdyuKfJbb7UqgeOIn+k+lfzbvgBE0Cd9Y=
Verify offline: decode the base64 SPKI public key to PEM (openssl pkey -pubin -inform DER -pubout), reconstruct the canonical payload per src/lib/canary.ts (buildCanonicalPayload), then openssl dgst -sha256 -verify.
Third-party data sharing
| Category | Status |
|---|---|
| Advertising networks | None exist |
| Analytics services | None exist |
| Cloud hosting services | None, self-hosted on local hardware |
| Payment processors | None, no payments are processed |
| Email delivery services | Operator alert emails only — bodies are PGP-encrypted to the operator's key before leaving the server, so the outbound smart host (Resend) relays ciphertext it cannot read; members never have an email field |
| CDNs & font services | None, all assets are served locally |
LEGAL // SERVER FACTS
Local server facts
Fedora CoreOS, self-hosted
A single physical machine under the operator's physical control.
SQLite (WAL mode)
One database file on a local volume. No managed cloud database.
Zero IP logging
The Next.js application performs no request-IP retention.
AGPLv3, fully public
Every line running here is auditable in the public repository.