Skip to content
Filter

Type at least two letters.

Home / Security and privacy

Security and privacy

The short version

You can read everything here without an account, without cookies and without being tracked. An account exists only so you can save bookmarks across devices and write privately to the author.

What is stored

  • In your browser: your theme, bookmarks, reading progress and any message not yet sent. This stays on your device until it is synced to your account (if you are signed in).
  • With an account: your email address, the name you chose, and your password (kept by Google Firebase as a salted hash; the site and its author never see it). One small record holds your bookmarks, how far you have read, and your theme.
  • Messages: what you write to the author, with the time and the post it was about.
  • Not stored: no advertising or analytics scripts, no third-party fonts or trackers, no tracking cookies. Drafted sets no cookies of its own; Firebase keeps your sign-in in your browser's storage.

Who can see your messages

Only you and the author. Messages are private conversations, not public comments: the database refuses to show a thread to anyone else, and only the author can reply (you can answer the author's replies). The author can see which account sent a message.

Deleting your data

Delete your account from your profile and everything above is erased: your record, every message you wrote, and every conversation you started. You can also delete a single message at any time.

How the site is protected

  • The pages are static files served over HTTPS only (HSTS), with a strict Content Security Policy, no framing, and a locked-down browser permissions policy.
  • The database denies everything by default. Each rule lets a reader reach only their own data, and messages can be created only by a server function that checks your identity, enforces limits and refuses spam.
  • The author is whoever has verified ownership of one email address, so there is no admin password or role to leak.
  • Dependencies are audited and the checks run before every deploy.

Reporting a problem

If you find a vulnerability, please email mail@saranmahadev.in before sharing it publicly. You will get a reply within three days. Good-faith research that avoids other people's data and service disruption is welcome, and I will not take action against it. Details are in security.txt.