Privacy Policy

What we collect

Account data: your email address, display name, profile picture (if provided via Google or GitHub), optional bio and links, and a securely hashed password when you set one. We never store passwords in readable form.

Usage data: posts, comments, reactions, bookmarks, reports and view counts tied to your account. Sessions store the browser user-agent and IP address so the Security page can show you active devices.

Anonymous statistics: each page view is counted once per visitor per 30 minutes using an irreversible fingerprint of IP and browser (a keyed hash — the original values cannot be recovered from it), plus the page section and, when the network provides it, a country code. No account, raw IP or user-agent string is attached to these counts, and they are only ever published as daily aggregates on the About page. Requests with Do-Not-Track enabled are not counted at all.

Operational data: server logs with request timestamps and coarse error information, kept for debugging and abuse prevention.

What we never collect

We do not read or store your private messages between platforms, we do not require wallet connections, and we do not attach trackers to your browsing outside Merklane. The statistics beacon stores no raw IP addresses and sets no cookies of its own. Optional analytics cookies stay disabled until you explicitly allow them in the cookie banner.

Why we process data

To operate the service: authentication, sessions, showing your bookmarks across devices, delivering email you requested (verification, magic links, password resets, waitlist confirmations).

To keep the service safe: rate limiting, spam and scam prevention, moderation queues and audit records.

Third parties

Email delivery runs through Resend, which processes addresses strictly to send the messages you triggered. OAuth sign-in runs through Google and GitHub — those providers see only the authentication flow, not your Merklane activity.

Your controls

Export or correct your profile data from the profile page. Delete your posts at any time. Revoke individual sessions or all other sessions from Security. For full account deletion, contact us — we remove personal data and keep only what retention law requires.

Retention

Sessions expire automatically (30 days idle) and can be revoked instantly. Verification tokens expire between 15 minutes and 24 hours and are single-use. Backups rotate on a fixed schedule.