What is stored, and how to delete it

A cookie called bk_device, set the first time you mark something as done. It holds random bytes and nothing else — no name, no address, nothing derived from you. It lasts two years.

It exists so the same browser cannot inflate a counter by tapping the same button repeatedly. What the database stores is not the cookie value but a salted hash of it, so a copy of the database cannot be replayed against the site.

It takes an email address and nothing else. There is no password — we send a link, and pressing the button on the page it opens is what signs you in. We keep the address, when you joined, and when you were last here.

The account exists so your own record follows you: the kind things you marked and the chains you started, visible from any browser you sign in on rather than only the one you were holding at the time. When you sign in, anything that browser had already recorded becomes yours — only things that belonged to nobody, so a shared or handed-on phone never transfers one person’s history to the next person who signs in on it.

This is the part that is genuinely different. With an account, the database holds a link between you and each kind thing you recorded. Whether a reader sees your name is your choice, act by act — but choosing not to show it is a decision about what is displayed, not about what is stored. If this site were breached or ordered to hand something over, that link is what exists to hand over. Several of the situations here are private ones, and you should weigh that rather than take our word for it.

Signing out affects one browser and deletes nothing. Deleting your account removes the account, its sessions, and the link from it to everything you recorded.

Every act you record can carry a name or not, and it is decided one act at a time rather than once for everything. People are often glad to be named bringing a neighbour’s bins up and would rather not be named visiting someone in hospital, and a single setting for both would be the wrong shape.

We call it “your name is not shown” rather than “anonymous”, because once an account exists the second word is not true and we would rather not use it.

Marking something as done records which idea, and when. You may optionally add a one-line note, a first name, a town and a country. All four are optional, none is verified, and none is used to build a profile of anybody.

The country is asked for rather than worked out, and nothing here is derived from your IP address. The picker starts empty and stays empty unless you choose something.

It may offer you a country to save the scrolling — a button saying, for example, “United Kingdom?”. That guess comes from your device’s time zone, which your browser already knows and which involves no request to anyone and nothing about your network. It is never filled in for you: if you do not tap it, nothing is recorded. A time zone names a country at best, never a town.

The monthly email is the one place the site asks for an address. It stores that address, whichever situations you ticked, and the date the last edition was sent to you. Nothing else.

Your address is not connected to anything you do on the site. It is not linked to the cookie, to anything you marked as done, to a note you left or to a chain you started, and the code that builds the list cannot reach any of those. What the email contains is chosen from the situations you ticked when you signed up and from the public library — the same edition could be built for somebody who has never used the site.

You have to confirm the address by clicking a link before anything is sent, so nobody can add yours. The emails carry no images, no tracking pixel and no rewritten links, which means we do not know whether you opened one. Every edition has a link that stops them, and a second one that erases the address completely.

The home page can tell you what has happened since you were last here. The date of your last visit is kept by your browser and is never sent to us — the site asks “what has changed since this moment?” without being told whose moment it is, so there is no record anywhere of who returns or how often.

What comes back is the same public activity that is already on the recent page. Clearing your browsing data clears the date, and the panel simply stops appearing until you have visited twice more.

Saving an idea puts it in your browser’s own storage and sends nothing to us. There is no row for it, no cookie and no request, so the site genuinely does not know what anybody has saved.

That cuts both ways: the list will not follow you to another browser or phone, clearing your browsing data clears it, and the delete button below cannot reach it. You can empty it yourself from the saved page. A calendar reminder made from a saved idea is a file your device builds and hands to your calendar; we never see that either.

You can send a chain code to one person by email. We use the address to send that one message and keep no record of it: what is stored is a one-way hash, which is enough to stop the same chain reaching the same person twice and useless for anything else. It cannot be read back, cannot be mailed, and is not an address we could give to anybody.

One recipient per send, and the field is the limit — there is no list, no “add another”, and nothing that reads your contacts. The message carries no image, no tracking pixel and no rewritten link, so we do not know whether it was opened. Nobody is signed up to anything by receiving one, and we do not email them again about it.

If a kind act was done for you and you were given the code, you can leave a line saying what happened. It does not appear straight away: somebody reads it first, because a sentence describing a kind act can identify the person it was done for, and that person never agreed to be on a website.

You need no account for this and we ask for nothing. A first name and a town are optional and are the only things about you that would ever be shown — leave them blank and the line appears as “Someone”. If it is published and you want it gone, ask us and it comes down.

You can keep an occasion — a name and a date, such as the anniversary of a death or the week somebody starts treatment — so that a reminder arrives at the moment it is useful. Those dates are held in your browser’s own storage and are never sent to us. There is no row for them, no cookie and no request made when you add one, so the site does not know that you have kept any, how many, or what they say.

That matters more here than anywhere else on the site, because what you type is about somebody else: a first name, and the date they died or went into hospital. We took the view that the only acceptable version of this feature is the one where there is nothing for anybody to leak, subpoena or sell, which is why it will never be an account feature. The calendar file is assembled on your device and handed straight to your calendar — we never see it, and we cannot tell that you downloaded one.

The same cost applies as to the saved list: these dates live in one browser, will not follow you to your phone, and clearing your browsing data clears them. You can remove any single one, or all of them, from the occasions page. The delete button below cannot reach them, because we have nothing to delete.

Every act and every note has a way to say something is wrong with it, including the ones we wrote ourselves. Nothing is required of you: no account, no address, no explanation beyond picking a reason.

If you leave an address so we can tell you what happened, it is kept with that one report and used for nothing else — it is not added to any list and you will not hear from us about anything but this. Reporting does not hide anything on its own: one report is not a verdict, and a page that vanished on a single unexamined complaint would be trivially easy to misuse.

Raw IP addresses. Rate limiting uses a hash of the address combined with the current date, so the key changes at midnight and yesterday cannot be matched to today. It is enough to stop abuse and useless for following anybody.

No tracking pixel, no fingerprinting, no advertising, and no data sold or shared with anyone.

There is one script on the site, from Cloudflare Web Analytics, and it counts page views. It sets no cookie, gives your browser no identifier, and cannot recognise you on a second visit or on any other site. What it reports is how many people opened a page and which link they followed to get here — not who.

That matters more here than on most sites, because the addresses are the sensitive part: a page about a death in the family or about not having enough money says a great deal about whoever is reading it. An ordinary analytics tag would hand those addresses to an advertising network along with a lasting identifier for you. This one has nobody to attach them to.

It is also why you are not being asked to accept anything. There is no cookie and no personal data here, so there is nothing to consent to.

Notes and recorded acts are kept until you delete them, because they are what the public pages are made of. The rate-limiting hashes are meaningless after a day. The cookie expires after two years if you do nothing. An email address is kept until you erase it; if you only stop the emails, the address stays with a mark against it, so that a later signup cannot quietly start sending again.

Everything held for this browser is on one page, with a button that deletes all of it — the records, the notes and the cookie. It is immediate and permanent, and because there is no account behind it, nobody can undo it afterwards, including us.

Clearing your browser’s cookies removes the link to your records but leaves the records in place, which is why the button exists.

An email address is separate, because it has to be: the site cannot tell that the browser in front of it belongs to an address on the list, and would have to start linking the two in order to offer that. The unsubscribe link at the foot of every edition both stops the emails and, if you want, erases the address.

Nothing here is written for children, and an account is not meant for one: if you are under 13, please do not make one. Everything on the site works without an account, and used that way it asks for nothing that identifies anybody. Several ideas in the library are about children; none of them is addressed to one.