privacy

visitors (anyone opening a link, paste, image, page)

for short-link clicks and page views: time, country / region / city (from Cloudflare's IP geolocation), network (ASN), device type, OS, browser, language, referrer, UTM tags.
no raw IP address is stored. unique visitors are counted with a hash of IP + user-agent salted with a key that rotates daily and is then discarded, so visits can't be linked across days.
if your browser sends DNT: 1 or Sec-GPC: 1, only the country is kept.
raw click events are deleted after 180 days; daily totals are kept.
no cookies for visitors, no ad trackers, no third-party analytics.

members

username, display name, password hash (argon2), passkey public keys, optional two-factor secret.
sessions: browser user-agent, country, last-seen time. one cookie per s1d host, used only to keep you signed in.
everything you create, plus who invited you.

webhook inboxes

requests sent to an inbox (including the sender's IP) are stored for the inbox owner and deleted after the retention period.

whoami

the whoami page shows what your browser reveals. it stores nothing. if you press "run" on the leak tests, your browser looks up a few random hostnames at bash.ws (a third-party DNS-leak service) so it can report which DNS resolvers you use.

sharing

nothing is sold or shared. data lives on one server in Germany, behind Cloudflare.

your rights