Privacy
What is saved, what is shared, and what passes through the server.
Public project details
A project's name, address, description, sections, allowed link types and domains, contribution-lock setting and signed creation record are public and stored permanently on the server. Do not put private information in these fields. There are no accounts or private projects.
Copies in your browser
Your accepted links, project copies and unfinished actions are kept in this browser's IndexedDB storage. Unfinished actions omit your email address and verification code. While any Hrefuge page is open, Hrefuge checks offered versions of saved projects that can receive contributions, validates their signed contributions and normally saves any missing contributions automatically. It never removes contributions already in your copy.
You can refuse automatic updates for one project. Offered versions for that project then remain unsaved until you request, review and accept one. While any Hrefuge page is open, it also offers all saved copies whose sharing has not been paused. Anyone receiving or exporting a copy can keep and share it. Forgetting your local copy does not erase other people's copies or the public project details.
A short-lived sharing token and each copy's sharing and update preferences are kept in IndexedDB so another open Hrefuge page can continue without creating duplicates. Hrefuge also keeps a bounded list of already incorporated snapshot hashes so navigation does not download the same old versions again. These hashes contain no link labels or addresses. Tokens expire shortly after use, and forgetting a copy removes its related settings and hashes. Hrefuge does not use advertising, analytics, third-party fonts, previews or tracking cookies.
Transient processing and transfers
When you contribute, the server processes your base copy and proposed links to check the rules and sign the contribution. If your browser cannot check a signature, it may send a copy to the server for validation. These operations do not permanently store contributed labels, addresses or complete copies.
Checking for automatic updates can request a copy from another browser without the project page being open. During any browser-to-browser handoff, the server temporarily holds the requested JSON copy. Access ends at its expiry, no later than five minutes after upload, or when receipt is acknowledged. The temporary file is removed on acknowledgement or a cleanup run. Physical removal can lag behind expiry if scheduled cleanup is delayed.
Short operational records
The server keeps expiring verification, report, rate-limit, offer and transfer records so actions can be checked and connections coordinated. These contain identifiers, hashes, times and counts, not contributed link bodies. HMAC values derived from addresses support verification limits without storing the raw address in application records.
Verification receipts allow the exact authorized result to be recovered after a lost response. A project report stores a hash of its private moderation token and public project details until it expires. Operational records are removed by scheduled cleanup. Hosting providers can separately retain request logs, mail records and backups under their own policies; application cleanup cannot remove a host's earlier backup.
The email address is used to deliver a code for one exact creation or contribution. Hrefuge does not save the plaintext address or code in application action records. A project report emails the configured site maintainer only the project's public details and a private removal link; it does not identify the person who pressed Report. The configured mail service processes recipients and messages and may retain delivery records. Email verification does not create an account or identify an author publicly.
Following links
Web links open in a new tab without sending this page as the referrer. Magnet and file-transfer links may open a compatible application on your device. Hrefuge does not fetch previews or check the linked contents. The destination service's and application's own privacy policies apply when you use them. A valid signature is a protocol check, not an endorsement.
Keeping or removing your data
Export JSON to keep a copy outside this browser. Use Forget this copy in My copies to remove a saved project and its pending actions from this browser. Clearing the site's browser data removes all local copies. A maintainer can disable a reported public project and stop its server sharing, but copies already held by others cannot be erased remotely.