Privacy

Everything CoPonder keeps, and who can see it. The goal: someone with a copy of our database, backups and code learns nothing about you beyond what the site shows everyone, plus the short list under Kept to run the site.

Why CoPonder is private

Every part of the site follows these rules.

We don't collect. No email, no phone number, no IP addresses, no browser details, no location, no payment details. What you read isn't logged, except a little for you alone, locked with your key, and an anonymous mark when you come by during a vote. → Never stored
Private by default. What's yours alone, like your dislikes, ⬆️ ⬇️ votes, private likes and reactions, mutes, hidden tags, bookmarks, notes on people and 🔐 drops, is locked with your own key, made from your password and never stored. The few things the site needs to run, like the day you joined or the last notification you saw, stay readable, each listed with its reason and how long it's kept. So do hidden ponds, members-only drops and the notes you hide in your drops: the public can't see them, but the people who run the site can. → Locked with your key, → Kept to run the site, → Limits
No hidden links between accounts. We don't keep who privately liked or reacted to what, who muted whom, or who reported whom once it's settled. Who invited you is kept on purpose, so a wave of fake accounts can be traced back, and only the admins and the one who invited you see it. Every other hidden link between accounts we keep, like blocks, bans, strikes, credit asks and the mod log, is listed with its reason. → Kept to run the site
Times to the day. A time the site doesn't show is kept to the day, unless its line below says why it needs more.
Deleted means deleted. Delete a drop or your account and its words, pictures, search entries and notifications go. Only backups hold them a little longer. → Download and delete
Nothing kept past its time. Each thing kept to run the site says why and for how long, and the site deletes it on time. → Kept to run the site
No other companies but these. Each one is listed, with what it sees. → Other companies
Honest labels. We only call something private if nobody, us included, can read it. Where the people who run the site can read what the public can't, the site says so right there.
AI sees only what's public. Anything we ever build with AI reads only what everyone can see, never who wrote it or when.
No private messages we can read. Private messages and private groups will come only end-to-end encrypted.
This page can't leave anything out. It's built from the same list our code is checked against: storing anything that isn't listed here makes our tests fail.

Scripts

No trackers, no ads, and only our own scripts, from CoPonder itself. None of them talks to another site, so nothing can fingerprint you, follow you around, or sell what you do. No other script runs on this site. Each one, and what it tells us:

✍️ Live formatting (logged in, in the box where you write, and the box where the admins look up an account) shows your formatting as you type. It asks CoPonder only for the people, ponds and your own titled drops you start to type after an @ or a [[, or the account an admin starts to type (never kept, never logged), the card of a link you write (fetched by our server, as for a preview, and kept with your unsent drop, locked with your key), and the list of emoji for 😀, the same file for everyone. Settings turns it off. The emoji you pick in 😀 are remembered in your own browser, each account's apart, for its Recent row, and never sent to us.
The book reader (a chapter in a 📕 book) fits its pages to your screen and remembers the word you stopped at. Logged in, it tells CoPonder only that, locked with your key. Logged out, it keeps it in your own browser and tells us nothing. On a book's cover page it only makes → and a swipe turn to the first chapter, and tells us nothing.
The upload helper (logged in, in the box where you write) shows the pictures and videos you pick, drop or paste right in your browser, and sends them, with any descriptions you wrote for them, only when you press a button of the box, as the box itself would. It also runs on Settings → Profile, and on the step that asks for your picture after you sign up, where it shows the picture you pick in its circle, and sends nothing until you press Save or Next.
The task helper (logged in, a list with boxes on your own drop) ticks a box right where you tap it, and tells CoPonder only that tap, as the box itself would.
The drag helper (logged in, every page but an error page) lets you drag a drop onto one of your folders, and tells CoPonder only that you put it there, or took it back out with Undo, as 🪷 Add to pond would. It also asks for what a person or a pond behind Show more in your trees holds when you open it, as opening their page would.
The Goes in helper (logged in, the box under your notebook, 🌊 Ocean and your stream, and the form where you edit a drop you can put in ponds) lists the places you can drop in, from the page itself, and turns each place you pick under Goes in into a chip. It asks for nothing and stores nothing: the places go with your drop only when you press a button of the box.
The drawer helper (every page with ☰ but an error page) puts the focus on the drawer's ✕ when you open it with a key. On a page with no folders of its own, it asks for your own folder trees the first time you open the drawer, as 🌊 Ocean shows them. It stores nothing.
The share helper (every page but an error page, logged in or out) makes Share open your phone's own share sheet, or copy the link on a computer, and copies an @handle you tap beside someone's name. It asks for nothing and stores nothing, so we never learn what you share or copy, or where.
The menu helper (the same pages) closes a menu like ⋯ when you tap outside it or press Escape, and shows the fish's Donate bubble at the top until you close it, and again when you tap the fish. It asks for nothing. Once you close the bubble, it remembers that in your own browser, and never tells us. It shows once more after you next log in, and tapping the fish forgets it too.
The crop helper (a pond's Moderator tools) shows a cover picture you pick right in your browser, under a box you move to choose the part that becomes the cover. It sends the picture and where the box is only when you press Save cover, as the form itself would, asks for nothing else and stores nothing.
The desk helper (on a computer, a person's or a pond's page in 📅 Calendar view) packs the cards on it tight, like a pinboard. It asks CoPonder for nothing, sends nothing and stores nothing. Those pages start in 💧 Drip view, one column of drops. Logged in, the view you last picked is kept locked with your key. Logged out, it lives only in the page's address.
The handle helper (signing up, logging in and recovering an account, and tagging a picture) turns a space or a hyphen you type in the Handle box, or a picture's creation tag box, into an _ as you type it. It asks for nothing and stores nothing.
The count helper (Settings → Profile, and the steps after you sign up) counts the characters of your display name and bio as you type. It asks for nothing and stores nothing.
The bell helper (logged in, every page but an error page) asks CoPonder for the top corner of the page every 30 seconds while the page is in front of you, and shows the number on 🔔 in it and in the tab's title, and what waits in your menu. Each ask is a visit like loading a page, so a page left open keeps you logged in. When something new is said to you, it shows it in a corner of the page for a few seconds. It opens your alerts over the page, and its filters, Unread only, Older, Mark read, Mark all read, Follow back and a reply you write in an alert are sent to CoPonder only when you press them, as the page's own links and forms would. When you open an unread alert, or reply from it, it tells CoPonder you read it, as its Mark read would. It stores nothing.
The row helper (logged in, every page but an error page) sends a vote, a reaction, a Repost or an Undo repost you press under a drop, or a choice in its ⋯ like Bookmark, as the button itself would, then asks for the page you're on, as reloading it would, and changes only that drop, so the page doesn't jump. Holding a finger on a reaction, a right click, or See who opens who reacted, and pointing at a reaction on a computer shows who gave it: it asks for that list, as opening it would. Pick your 3 sends the three you picked, which are kept in your vault alone. It also runs 🙂's picker, its search, the bar a drop shows when you point at it on a computer and a phone's long press on a drop, which ask for nothing. It stores nothing.
The timeline helper (only the admins' timeline of who joined) zooms the chart and says who a line is when they point at it or tap it. It asks for nothing and stores nothing.

What we keep

Everything we store is one of five kinds: public, locked with your key, anonymous, secret, or kept to run the site.

Public

Your profile, your drops and everything on them, who follows whom, the likes and reactions you show, and ponds with their settings. Anyone can see these on the site, and every pond that's listed, 🎟️ invite only or not, is read by anyone. Four exceptions:

A hidden pond and everything in it (its name, secret address and member count, its drops with their words, times, pictures, videos, tags, mentions, [[links]], link cards and search entries, and the ponds inside it) show only to its members. The people who run the site can read them.
A members-only drop, and what belongs to it, shows only to its pond's members. The people who run the site can read it.
🔐 Private drops and folders show only to their owner.
Notes you hide in your drops (between two percent signs) show only to you. They're stored with the drop, not locked, so the people who run the site can read them.

Your likes show to everyone when you join: who liked a drop, your Likes tab, and your name in a like's notification. Turn off Show my likes and reactions in Settings, under Privacy, and they're locked with your key: the author is told someone liked their drop, never who, and your like only adds to the number. Accounts made before 24 October 2026 keep the choice they had, hidden unless they showed them.

Your ⬆️ ⬇️ votes on drops are always private, whatever the switch says: the score counts them, and nobody can see who voted which way, not the drop's author, not the people running CoPonder.

Your reactions follow the same switch, Show my likes and reactions. On, the reactions you give show who gave them: pointing at a reaction under a drop names the first few, and its Reactions list names everyone. Off, they're locked with your key and only add to the number, which the list counts as private. 👎 is always private, whoever gives it. Reactions given before 30 October 2026, when they could only be private, stay private for good. Turn the switch off later and the reactions you gave by name are locked too.

Your Wall shows to everyone: the drops that mention you, from anyone when you join. In Settings, under Privacy, you can keep it to people you follow, or hide its list from others (the drops on it stay as public as their writers made them). Accounts made before 24 October 2026 start at people they follow.

Joining a pond is private, but what you drop in a pond, or add to one, does show you're in it.

Your name goes on a drop only if you say yes. When someone asks to credit you as one of a drop's makers, only the two of you see the ask (and the people who run the site), until you answer. Say yes and your name is on the drop for everyone who can read it. Say no, or take your name off later, and nothing is left behind, not even that you were asked, apart from backups. The same goes for being asked to be one of a folder's makers, except that the mod log keeps that one of its moderators asked you, or removed you, as it keeps an invitation to moderate, seen only by the people who run the site. Your role in a drop's credits is only what you write, and nobody else can change it. Credited, the drop shows on your page and to your followers, and you hear about its likes and replies.

Leaving with drops you made with others. Deleting your account, you pick for them: delete them, or hand them on to their other makers, without your name. Handed on, each of its makers votes on who holds its pen next. A vote is seen only by the maker who cast it. The others see only how many voted. Votes go once the pen is given, or when a maker's name comes off.

An invite link shows whoever opens it who made it, and a few of their public drops, until it's used.

The full list (52)

A tag request's lines: an alias, an implication or a category, each from one tag to another or to a category, in force once the request is approved
Copies of the X, Bluesky, Reddit, TikTok and YouTube posts and websites that drops link to, with their pictures, copied once so readers never contact those sites (a moving GIF also as a small video clip, which readers get instead)
Copies of the pictures and GIFs drops show from other sites, copied once so readers never contact those sites (a moving GIF also as a small video clip, which readers get instead)
Creation tags: the tags anyone may put on the pictures of a drop that isn't 🔐 private, each with who added it, shown on it. They go with the picture. When the account that added one is deleted, the tag stays and its name comes off
Drops and reposts: their words, author, time (to the second, as each drop shows it to its readers), replies, quotes, and whether one was deleted. A 🔐 Private drop's row shows only to its author and holds no words, only the day it was made (its words and time are locked with your key). A 🔐 reply's row names no drop it answers
Drops handed on: a drop whose dropper left CoPonder and handed it to its other makers, who vote who holds its pen. Until they do, it says "Handed on" and nobody edits it
Drops' 18+ marks: whether a drop is marked 18+, and whether a moderator marked it
Drops' [[links]]: where each leads, as its words name it (a pond's address or someone's name, and a drop's title or number), for 🕸️ Threads from here, which shows a link only to those who can read both drops. A 🔐 drop's links are kept only in your vault, locked
Drops' earlier titles, after a rename, as the addresses they had in their pond or their author's drops folder, so old links still lead to the drop for whoever may read it (a drop there with that title they can see answers first), until the drop loses its title, leaves its pond or is deleted. A 🔐 drop's are locked in your vault
Drops' edits: whether and when a drop was edited (to the second, shown with the drop)
Drops' hashtags
Drops' makers: who a drop credits as its makers, once they said yes (its credits read "👥 by Ana @ana, Bob @bob"), gone when either takes it off, a block comes between them, the drop is deleted, or the maker's account is. A dropper deleting their account picks: their drops made with others go, credits and all, or they hand them on to their makers, who keep their credits
Drops' mentions: who each drop @mentions (for the Wall)
Drops' pictures, with the descriptions their writers give them (ALT), and smaller copies for where they're shown small (a moving GIF also as a small video clip, which readers get instead). A removed drop's stay hidden while it's held for an appeal
Drops' pins: which of your drops you pinned to the top of your drops, in your order (an order, not a time). A pinned 🔐 drop shows only to you, so its pin is seen by you and the people who run the site alone
Drops' places: the pond a drop was made in and its place in that pond's order (which its Contents shows), the other ponds it's in, its place in each, whether a moderator took it out, and who put it there with 🪷 Add to pond (its author, or for someone else's drop one of that pond's moderators, named in that pond, and nobody when a [[!pond]] tag put it there). A 🔐 drop's pond, one of your 🔐 folders, shows only to you, and so does a 🔐 drop you put in another of your 🔐 folders. A drop you made public out of a 🔐 folder stays in it this way
Drops' readers: whether a drop is for its pond's members only, a hidden pond's (the people who run the site can read those, the public can't), a 🔐 Private drop with no pond (only its author sees it), or a members-only drop whose pond an admin deleted (only its author sees it, and the people who run the site can read it)
Drops' search index, made from their words
Drops' titles, shown as their heading and as their address in their pond (/pens/Whats-the-best-pen) or their author's drops folder (/@ana/drops/My-Story). A 🔐 drop's title is locked with its words, and in one of your 🔐 folders its address is kept as a code made from it with your key, so it finds the drop for you
Drops' videos, kept as files beside the database and remade without their location or anything else from the camera, with their size, length and a still picture, seen by whoever can read the drop. A removed drop's stay hidden while it's held for an appeal
Folders' makers: who made a book, comic, gallery or folder together, credited on every drop in it, with the role each wrote
Follows: who follows whom
Likes you show: who liked which drop, and the day
Makers' roles: what each maker of a drop did, in their own words, shown in its credits ("Bob @bob · Line work"). The dropper's is on the drop, a folder maker's on the folder
Pictures' tag history: every tag added to a picture or taken off, who did it, the day (not the time), the change it undid, and whether the admins hid the line, whose tag and who then only they read. It goes with the picture. When the account that made a change is deleted, the line stays and its name comes off. A change the tag data's alias made is marked, by nobody
Pond settings: open to anyone, invite only (anyone reads it, only its members drop in and reply) or hidden (members only, locked, at a secret address, and the pond, its name, address and drops show only to its members and the people who run the site), who can drop in (anyone, its members, or only its moderators), who can reply (anyone who can see it, its members, or nobody there, talking about its drops in the pond around it instead), and who reads its 📜 Log (anyone who can see the pond, or only its members)
Ponds inside ponds: which pond a pond is in (Part 1 inside My Book), and its place in that pond's order. One inside a hidden pond, name and all, shows only to those who can get into it
Ponds' covers: the picture, at up to 1600 by 2560 pixels and as a small copy for its cards, when it was uploaded (none until its moderators upload one), and whether it's 18+, so it shows only to readers who chose to see 18+ pictures. Seen by whoever can get into the pond
Ponds' kinds: a book, a comic, a gallery or a folder, which sets how a pond's card looks
Ponds' moderators
Ponds' owners: whose name a pond is under (/@handle/…). Deleting the account wipes those ponds' names, descriptions and rules
Ponds' rules, which its moderators write and show above its box
Ponds' stars: whether an admin put a pond on the front page with ⭐ Front page, and when. The time, to the second so two stars on one day keep their order, only sets the shelf's order (newest star first) and is never shown. Empty when it isn't on it
Ponds' tags, which search finds a pond by: its kind (a book, a comic or a gallery) and the hashtags in its description, shown only to those who can open the pond, and none for a 🔐 folder
Ponds: name, description, who made them and when. A 🔐 Private folder's row shows only to its owner, keeps no name or description, and holds a code made from its web address with your key in place of the address (the rest is locked)
Reactions you show, given while Show my likes and reactions is on: who gave which reaction to which drop, and the day (👍 is a like, 👎 is always private)
Replies' ✓ That's it: whether the author of the drop a reply answers said ✓ That's it to its 💭 line, shown with the line to those who see that drop
Replies' 💭 So you're saying… line, the writer's summing up of the drop it answers, shown above the reply's words when its 💭 is tapped
Reposts of ponds: which pond a repost shows, as a card in the reposter's Drops and their followers' feeds
Tag requests: asking for aliases, implications and categories, who asked, the drop in the Tag requests pond that holds the reason and where people talk about it, whether it's pending, approved, rejected or withdrawn, and the day (not the time). When the account that asked is deleted, its name comes off
Tags' categories: whether a tag names a character, a fandom, a species, something about the picture itself (meta), something true but not seen (lore), or anything else (general), with who set it last and the day. When that account is deleted, its name comes off. Many come from Wikidata's free data, set by nobody here and marked so (seeded) until someone sets them
The admins' locks on creation tags: a tag locked on a picture can't be taken off, one locked off can't be put on. A tag locked on shows with 🔒, one locked off shows to the admins alone. They go with the picture
Whether a creation tag came from an implication (an approved request: eagle means bird too)
Whether a pond is the site's own, the Tag requests pond
Wikidata's tag aliases: a tag that stands for another, mice for mouse, from its free data, set by nobody here. One of ours always comes first
Your account's state: active, suspended or deleted
Your handle, display name, bio and profile picture
Your name's picture, shown instead of it: the picture, when you uploaded it, how wide it is, how light its ink is, and whether its outline always shows
Your name's style: the font, effect, color and second color you picked for your display name
Your old handles, if the admins renamed your account, kept for good so its old addresses lead to it and nobody else takes them
Your privacy choices: whether your likes show, whether your Wall shows drops that mention you from anyone or only from people you follow, and whether visitors see your Wall's list (the drops on it stay public either way)
Your 🐟 Feed the fish link, the address where readers can tip you, shown as a button on your page and your work

Locked with your key

Your private likes, dislikes, reactions and mutes, your ⬆️ ⬇️ votes, the tags you hide, 🔖 bookmarks, the ponds you joined or followed, your notes on people, most of your settings, your unsent drops, and your 🔐 Private drops, their pictures and your 🔐 Private folders. Only you can read these. They're locked with a key made from your password, which the server never keeps: not the people running CoPonder, not the admins, nobody else. Nobody is told about a bookmark or a note. Counts come from anonymous markers, and bookmarks have none.

The full list (6)

Which drop each of your 🔐 replies answers, locked with your key, so your page finds them under it. No two look alike, even on one drop, so a note in the margin of someone's drop doesn't tie you to them or their drop
Your unsent pictures: those attached to a drop you haven't sent yet, those of a link card, and the GIFs in the preview of a drop or an edit, or of the card shown under the box as you write
Your vault: your private likes, dislikes, reactions and mutes, the #tags you hide, your 🔖 bookmarks, the ponds you joined, your settings, the drop and the edit you haven't sent yet, the card of a link you're writing, your Tackle box (the last few ponds and people whose pages or drops you opened), your private notes on people (the note you keep on someone's page), where your 🔐 drops sit in ponds anyone can see (which pond, their place there and their titles, like chapter 5 of your book), the earlier titles of your renamed 🔐 drops, so your old links still lead you to them, the [[links]] in your 🔐 drops, so only you see the threads they make and nobody is told, who joined with your invite codes before the invite tree, and the words of your last few drops whose video failed (3 at most, for 30 days)
Your 🔐 Private drops and replies: their words, the drops' titles, when you made them (to the second), whether you ticked 18+, the size in pixels of each picture and its description (ALT), and which drop each reply answers
Your 🔐 Private drops' pictures
Your 🔐 Private folders' names, descriptions, web addresses and kinds

What the server still knows about your 🔐 drops: which locked drops are yours, how many, the day you made each (its number, given in turn with everyone's drops, can narrow that down), roughly how long each is (to 4 KB), how many pictures each has, in what order, and roughly how big each picture is (rounded up to a power of two, like 300 KB to 512 KB), so it can delete them with your account. Never their words or what their pictures show. Of your 🔐 replies it also knows that they're replies, never which drop they answer, whose, or which of them answer the same drop. A 🔐 drop sitting in a pond anyone can see is, on the server, a 🔐 drop in your notebook: which pond, its place there and its title are only in your vault.

And about your 🔐 folders: that they're yours, how many, the day you made each, which of your locked drops are in each (the one it was made in, and any you added it to), which locked drops in a folder have a title and which share one, and which of your public drops you keep in one (a drop you made public out of a folder stays in it for you). Never their names, what they're about, their web addresses, what kind of thing each is or the titles of what's in them.

Changing your password keeps all of it. If an admin resets your password, it's lost, because nobody else has the key: the counts it made are kept, and your 🔐 drops and folders are deleted.

Anonymous

The markers that make the counts (pond members, private likes, dislikes, reactions and ⬆️ ⬇️ votes), names and visits during a vote on a moderator, first reports, and the site's monthly totals, all kept with no account attached. Votes on a moderator are anonymous: nobody can see who signed, not the moderator, not the admins, not the people running CoPonder, and a vote's count doesn't change when someone deletes their account.

The full list (6)

First reports: the first time an account reports a drop, a marker only the reporter's key makes, naming no account, with the drop and the day, so admins can spot a moderator who keeps dismissing what new people report again. Kept 365 days on purpose, even after the drop is removed (so its record survives) or the account deleted (once its key is gone, nothing can tie a marker to it)
Monthly totals for the whole site, so the admins can see whether a change helped: how many active accounts there are, how many never dropped anything, how many follow nobody, how many drops are up and how many of those are in a thread, quoting or quoted by another, or linking to or linked to by one, with the day they were counted. Just the numbers, naming no account, and 🔐 drops are never counted. Kept as long as the site runs
Names on a vote about a moderator: a marker made from the signer's key, naming no account and with no time, with the reason picked. Only the signer's own key finds it again, so they can take it off. Deleted when the vote is counted, or if the admins still have to decide on it, when they do. Deleting the account leaves it, since nothing ties it to the account once its key is gone
Pond memberships, as markers that name no account and have no time (they make the member counts)
Private likes, dislikes, reactions and ⬆️ ⬇️ votes, as markers that name no account and have no time (they make the counts)
Visits during a vote: while a pond you joined votes on one of its moderators, one marker made from your key when you come by, naming no account and with no time, so the vote can count the members who came by without knowing who. Deleted when the vote is counted. Deleting the account leaves it, naming no one

Secrets

Kept only as one-way hashes, or locked with a key made from your password or recovery code:

Login session tokens, stored only as hashes
Your data key, locked with a key made from your password
Your data key, locked with a key made from your recovery code
Your password, stored only as a one-way verifier

Kept to run the site

What the site needs while you're away: logins, blocks, notifications, invites, bans, reports, the mod log, removed drops held for an appeal, and earlier versions of edited drops. The people who run the site can read these. Each is kept only for the reason and time shown. Times that aren't public are kept to the day unless noted.

The full list (39)

A drop waiting for its video: its words, title, 💭 So you're saying… line, author, where it goes (every place you picked for it) and who reads it, exactly as it will be dropped, which of its ponds you joined, only where its checks need that again (the ponds its tags name, the places you picked where only members drop or reply, and hidden ponds around them), which dropping there shows anyway, and the video as you uploaded it, as a file. For a video you add as you edit a drop, only which drop it goes in. Nobody sees it, you included, until it's up. If its video failed, the day it failed: so it goes up whole once its video plays everywhere, checked again then as Drop checked it. Kept until it's up, usually a minute or two. If its video failed, its words wait for you until you open them or log in (then only in your vault, locked with your key), at most 30 days, and only your newest 3.
A removed drop's words, title and 💭 So you're saying… line, held hidden with its pictures, video and edit history, which pond's moderators removed it (or the admins), the reasons it was reported for (never who reported it or how many), the day, and its author's appeal and its day, seen only by its author and the moderators and admins who decide the appeal. A drop removed for illegal content is never held: so its author can appeal, and if it comes back, it's back where it was. Kept 90 days from the removal, or until its appeal is decided, the drop is deleted or its author's account is.
Accounts banned from a pond, and the day: so a ban works while the account is offline, shown to the pond's moderators and admins. Kept until lifted, or the pond or the account is deleted.
An invite only or hidden pond's invite link, and who made it: so its moderators can share it and the server can check it, and accounts made through it use up its maker's site invites. Kept until a moderator makes a new one, or its maker stops moderating the pond (an admin's link stays), is suspended, stops being an admin while not moderating it, or is deleted.
Blocks and the day they were made (someone you block sees on your page that you did, as on other sites): blocks are enforced while you're offline. Kept until unblocked.
Drops waiting for the search index: the number of a drop just made or changed: so search finds its new words. Kept until the change is saved, a moment, so it's empty the rest of the time.
Earlier versions of edited drops, their titles, 💭 So you're saying… lines and the picture descriptions an edit replaced too, and pictures removed from a drop in an edit (a 🔐 Private drop keeps no earlier version): so admins can review a reported drop. Kept 30 days, or while a report about the drop is open or it's removed and held for an appeal, and never past the drop's deletion or the end of its hold.
From before the invite tree: which account used your invite code, and the day: so you can see who joined with your codes. Kept until your next login or visit to the Invites page (then only in your vault), at most 14 days.
How many invite codes you made this week (and which week that is), and how many of yours were used: to enforce the weekly invite limit. Kept while the account exists.
Internal settings, such as when an upgrade ran: to run upgrades once. Kept indefinitely.
Invitations to moderate a pond, and the day: so you can accept or decline them. Kept until accepted or declined.
Members' votes on whether one of a pond's moderators stays: the pond, the moderator, the day of the first name, the day the admins were asked to look, the day they kept the moderator, and the day a vote that fell short ended, never who started it or who signed, shown to the pond's members, its moderators and the admins: so a pond's members can vote out a moderator, and ask the admins to look. Kept while the vote runs (14 days), then 30 days if it fell short (so the same vote doesn't start again at once), or until the admins decide on it, or the moderator stops moderating the pond. A vote that passes is deleted at once.
Offers to moderate a pond that has no moderators: who offered, the day, and the day the admins said no, seen only by the admins and the one who offered: so the admins can say yes or no, and a no isn't asked again at once. Kept until the admins say yes, the pond gets a moderator, or you take it back, leave the pond, are banned from it, the pond is deleted, or you delete your account. A no is kept 30 days.
On a 🎬 Your video is up! notice, the places you picked for that drop that didn't take it when it went up, which it names while you can still get into them: to tell you where your drop couldn't go. Kept 60 days, with the notice.
Ponds waiting for their tags: the number of a pond just made or changed: so search finds it by its new tags. Kept until the change is saved, a moment, so it's empty the rest of the time.
Reports, their reason, the day, and how they were resolved: moderation history. Kept indefinitely, without the reporter.
Strikes an admin gave an account: the reason, the admin and the day: an account with 3 strikes within 365 days is removed. Kept 365 days.
The day of each follow: to order follower lists. Kept until unfollowed.
The day your account was made: for account-age rules. Kept while the account exists.
The mod log: which admin or moderator did what (resolved a report, removed a drop, suspended, gave a strike, reset a password, marked 18+, ...) to which account, drop or pond, the day, the reasons a removal settled (never how many reports, never who reported), and whether it was done with the admins' powers. Part of it is public, never naming whom an act was done to: each pond's 📜 Log shows what its moderators (by name) and the admins did there, to anyone who can see the pond, or only its members if its moderators choose, and the admins' log shows everything the admins do, to everyone, never which admin: so admins can see who did what, and everyone can see how a pond and the site are run. Kept 365 days.
The newest notification you've seen: for the unread count. Kept while the account exists.
The web addresses of ponds an admin deleted, with the pond's number: so no new pond takes an old address and the links to it, and the mod log can still name it. Kept for good, as a deleted account's handle.
Unused invite codes, who made them, and the day: so codes can be used and listed for their maker. Kept until used, then deleted.
Votes on a drop handed on: which of its makers each maker votes to hold its pen: to give the pen to the maker more than half of them pick (only how many voted is shown, and each maker sees their own vote). Kept until the pen is given, the voter's name comes off the drop, or the drop goes.
When a drop took its title: when it was made, or the edit that gave it the title (to the second): so the first drop to take a title in a pond, or a drops folder, keeps its address, which a day couldn't settle (a 🔐 drop's is the day it was made, which its row has already). Kept while the drop keeps that title.
Whether an account is an admin: to give admins the admin pages. Kept until removed.
Whether the admins took away your tagging (then you can't add or take off creation tags, and the rest of your account is as it was): so tag abuse can be stopped without suspending anyone. Kept until the admins give it back, or the account is deleted.
Whether you've read each notification: to show you which alerts are new to you. Kept 60 days, with the notice.
Whether your old private data has moved into the private store: to move it once. Kept while the account exists.
Which account each login session belongs to, and when it expires (to the second, so a login lasts its full time from when it was last renewed): to keep you logged in. Kept 30 days after last use.
Which account has unsent pictures, their size and the day: to show them in the box where you write. Kept until you drop them, remove them, or they're 1 to 2 days old.
Which account invited you (whose invite code or pond invite link you signed up with: the invite tree), or, for an account made before the tree, the owner's, marked as filled in: so the admins can trace a wave of fake or bot accounts back to the account that brought it in, and suspend that whole branch. Only the admins see it, and the one who invited you sees you on their Invites page (not when it was filled in). Kept as long as your account's row, which stays after you delete your account, so the accounts you invited stay linked to it.
Which admin suspended an account: so admins know who did it. Kept until unsuspended.
Which of a pond's moderators voted to ban or unban which account, and the day: a ban, and lifting one, needs more than half of the pond's moderators, shown to them and to admins. Kept until the vote passes, the moderator stops moderating the pond, the account voted on becomes a moderator of it or an admin, or the pond or either account is deleted.
Which of a pond's moderators voted to delete it, and the day: a group's pond nothing new was dropped in for 90 days goes once more than half of its moderators voted, shown to them as a count. Kept until the pond is deleted, something new is dropped in it, the moderator stops moderating it, or their account is deleted.
Which 🔐 Private drop each locked picture is in, and their order in it: so it's sent only to the drop's author, and deleted with the drop. Kept until the drop is deleted or made public.
Who filed an open report: so admins can spot report abuse. Kept until the report is resolved.
Who removed a drop: an admin, or a pond's moderator who verified a report about it: so admins know who did it. Kept while the drop's row exists.
Your notifications (what happened, and the drop or pond it was about), with their exact time. A private like shows as "Someone", with no account stored. Someone asking to credit you on their drop is one too, and the only record of the ask: answered, cancelled or blocked, it's deleted, so a no leaves nothing: to show them to you, with how long ago. Kept 60 days (an ask nobody answers lapses then).

Never stored

IP addresses, email addresses, phone numbers, browser details (user agents), your location, payment details, and the pages you visit. IP addresses are held in memory for a few minutes for rate limiting, never written down. Only server errors are logged, without who caused them. You join with an invite and get back in with a recovery code.

Pictures and videos you upload are cleaned. Hidden details like GPS location and camera info are stripped: a picture's before it's saved, a video's as it's processed, a minute or two after you drop it. The video as you sent it is then deleted.

The only record of where you've been is yours, locked with your key: your Tackle box (the last few ponds and people whose pages or drops you opened), the word you stopped at in each book chapter, and for each person you follow, the newest drop of theirs you could see when you last came by (so 👣 Following can dot who has something new). While a pond you joined votes on a moderator, coming by leaves a mark that says a member came, never who (see Anonymous).

🧵 Your trail, the drops you followed to reach the one you're reading, lives only in the page's address. It isn't kept, links to other sites don't carry it, and an address with a trail opened from anywhere but CoPonder's own pages shows the plain page. If you copy the address yourself, the trail goes with it. Share gives the drop's address without it.

Other companies

Links to X, Bluesky, Reddit, TikTok and other websites are copied, not embedded. The post or page is copied once when it's shared, pictures included, so you read our copy and never touch those sites or their scripts. Pictures and GIFs that drops show from other sites are copied the same way. Who sees what:

Cloudflare carries all traffic to this site and can see it in plain text, including your IP address and your password when you log in.
YouTube, for videos in drops: logged in, the player loads from YouTube (youtube-nocookie.com) as soon as you see the drop, so YouTube sees your IP address. Turn off Play YouTube in drops in Settings, under Privacy, and a video shows as our copy of its card until you press ▶ Play. Logged out, and for accounts made before 24 October 2026 that haven't turned players on, it's the copy until you press ▶ Play.
X (through fxtwitter.com), Bluesky, Reddit, TikTok and YouTube, for link cards: when a drop links to one of their posts or videos, our server fetches it and its picture straight from them once, when you write (with live formatting), preview or drop it (twice if you drop it while live formatting is still fetching its card). They see our server, never you, and nothing is fetched when you read.
Other websites, for link cards: when a drop links to some other site, our server fetches that page's preview the same way, through a VPN. The site sees the VPN, not you or our server. The VPN's company sees which sites our server reaches, never who asked.
Other websites, for pictures in drops (Markdown ![text](https://…)) and GIFs linked from Discord, Klipy, Tenor and Giphy: our server copies each picture or GIF once, when the drop is made or edited (a GIF already when you preview the drop), through the same VPN. The site sees the VPN, not you or our server, and nothing is fetched when you read.

Download and delete

You can take it all with you. Settings → Your data → Download my notebook gives you everything you made as one .zip of folders and notes that Obsidian opens, your 🔐 drops and folders unlocked with your key. Only you can download yours. It's made as it downloads: no copy is kept, and nothing about it is logged. Other people's drops come as links, never their words, except the drops they credited you on. Any 📕 book you can read downloads as an e-book (EPUB) too, from 📥 Download on its cover or its Contents, holding what you can read in it: it's made as it downloads, and no copy is kept.

Deleting a drop or your account removes its text, pictures, videos (their files within the hour), search entries and notifications.
A drop that its pond's moderators or the admins remove is gone at once for everyone but you and the admins. Its words, title, pictures and video are kept hidden for 90 days so you can appeal: only you, and the moderators and admins who decide your appeal, see them. Then, or once your appeal is turned down, they're deleted. A drop removed for illegal content is deleted at once.
Your account's row stays, with its handle and who invited it, so the accounts you invited stay linked to it (only the admins see that). Deleting your account also deletes your 🔐 Private folders, wipes the names, descriptions and rules of the other ponds under your name, and deletes their cover pictures. Their short addresses, like pond/@you/my-book, stay, so links to them still lead somewhere.
If an admin deletes a pond, nobody's drops go with it: they stay with their authors, in no pond, and members-only ones stay members only, for their author alone (the people who run the site can read them, as before). Its address is never given to a new pond. If you delete a folder of yours, the same goes for the drops in it, except your own if you pick to delete them with it, and its name is free for you to use again.
Backups are made daily and before each update of the site, and the newest 14 daily and 3 update backups are kept. So a deleted item can stay in a backup for about 14 days, or until 3 more updates, whichever is later. Videos aren't in those backups. Instead, a snapshot of the videos alone is taken each night, and a deleted video can stay in one for about 14 days. The second copy of every backup sits on encrypted disks, so the disks alone can't be read.

Limits

If the people who run the site were forced to change the running server, the changed code could capture the passwords and keys of people who log in afterward. Only end-to-end encrypted messaging (planned) protects against that.
Nothing here protects you if your own device is compromised.
A weak password can be guessed by someone with a copy of the database, and that would open your private data. Use a long password.
When you report a drop, its pond's moderators and the admins see how many open reports it has for each reason, never who sent them. Spam, harassment, 18+ and Other reports about a drop whose home is a pond with moderators (not one it was only shared into) go to those moderators, who verify or dismiss them without ever learning who reported. Illegal content and ToS reports, and everything else, go to the admins, who see the reporter of an open report until they resolve it. The first time you report a drop, an anonymous marker made with your key notes that someone new reported it, so admins can spot a moderator who keeps dismissing what new people report again (see Anonymous).
Hidden ponds, their drops and the ponds inside them aren't encrypted. The public can't read them, but the people who run the site can, and admins see them so they can act on reports. A hidden pond's address is kept out of the server's log, but the people who run the site can read it. Where you pick where your drop goes, a 🤫 after a pond's name marks a hidden pond, or one inside it.
A pond's moderators and the admins see who is banned from it, and which of its moderators voted to ban or unban someone, until the vote passes. Its moderators see how many of them voted to delete it, once nothing new has been dropped in it for 90 days, and the admins see which. Who joined or followed a pond stays private.
Notes you hide in your drops (between two percent signs) are shown only to you, but they're stored with the drop, not encrypted: the people who run the site could read them.
When pictures or a video go up in pieces (with JavaScript on, anything over 90 MB), the pieces wait on our disk as you sent them, not encrypted, until your drop is made. Someone with a copy of the disk at that moment would have them, the pictures of a 🔐 Private drop too. Your words are never in them. An upload you leave unfinished is deleted within two hours, when the site restarts, or when you delete your account.