Privacy

The short version

Visiting someone's page sets no cookies and contacts no company other than this one. We count the visit, and what we write down about you is four coarse facts, none of which identifies you. There is no advertising network here, no tracking pixel, and nothing is sold or shared for anyone else's marketing.

You do not have to take our word for it. Every page carries a link to /receipt/<handle> — a live readout of what is actually stored about that page's visitors, generated from the database rather than written by hand.

If you visit a page

A view is recorded when the page loads, and a click is recorded when you use one of its links. Each row holds exactly this and nothing else:

• Which page (and, for a click, which block).
• When, to the second.
• The referring site's domain— “instagram.com”, never the full address you came from. The full referrer reaches our server and is reduced to the domain before anything is written; the rest is discarded, not stored.
• A two-letter country code, supplied by our host from your connection. We do not receive or keep the address it was derived from.
• One of four device words— mobile, desktop, tablet, other. Derived from your browser's user-agent string, which is then discarded.

What we deliberately never store

There is no column anywhere for your IP address, your full user-agent string, a visitor ID, a fingerprint, a cookie ID, or anything joining one of your visits to another. This is a fact about the database, not a policy we could quietly relax: the columns do not exist, so there is nothing to fill in.

One consequence worth stating plainly, because it works against us: we cannot tell you how many people visited a page, only how many views happened. Any service quoting you unique visitors is keeping something we chose not to keep.

What is stored in your browser

A public page sets no cookies and writes nothing to local storage. It sets one flag in session storage — the tab's own scratch space, erased when you close the tab — recording that this page was already counted, so a refresh does not count twice. The flag contains no identifier. Two automated tests fail the build if a cookie, a local-storage write, or a request to another company ever appears on a public page.

The editor and dashboard are different, because they have to be: signing in sets one cookie that keeps you signed in. That cookie exists on the pages you use as an owner, never on the page your audience sees.

If you have an account

We store your email address, and a display name and avatar if you add them. Signing in works by emailed link, so there is no password here to lose. We also store the page you build: your handle, your bio, your links and their titles, the theme you picked, and any notes you keep on a block — notes are yours alone and are removed before a page is rendered for anyone else.

When something leaves this site

Four companies are involved in running the service, each doing one job and none of them given anything for their own purposes:

• Vercel hosts the site and hands us the country code described above.
• Neon stores the database.
• Resend delivers sign-in emails, so it sees the email address you sign in with.
• Google Safe Browsing checks links. When a page owner saves a link, that web address is sent to Google to ask whether it is known for phishing or malware. This happens for the owner's links, never for anything about a visitor.

One deliberate design point: when a page shows a thumbnail or a favicon from somewhere else, our server fetches it, not your browser. The site hosting that image learns that orion.directory asked for it. It does not learn anything about you.

We do not sell personal information, and we do not share it for anyone's advertising.

How long we keep it

Your account and your page are kept until you delete them. Deleting a page deletes the view and click rows attached to it.

We would rather state this awkwardly than dress it up: view and click rows are not currently deleted on a schedule. They accumulate for as long as the page exists. A fixed retention window is planned, and this section will name the number when the job that enforces it exists — not before.

What you can ask for

From Settings you can download everything we hold about you — your profile, your page, every block in it, and your full analytics history — as one file, without asking anyone. You can unpublish your page at any time, and you can ask us to delete your account and everything attached to it by writing to [NEEDS-CHELSEA: contact email].

Depending on where you live you may also have a legal right to access, correct, or delete your information, or to object to how it is used. Write to the same address and we will do it; we will not ask you to justify the request.

Children

This service is not intended for children under 13, and we do not knowingly keep information from them. If you believe a child has an account here, write to [NEEDS-CHELSEA: contact email] and we will remove it.

If this changes

If we start collecting something new, this page changes before the collection starts, and the date at the top changes with it. A change that would make the promises above untrue is a change we would rather not ship.