Privacy
The short version. We ask for a username and a password. No email, no phone number. We don't track you: no analytics, no advertising, no third-party scripts. When you delete a file, it is deleted. We do not keep a copy, and we never will unless you upload it again.
What we store
Everything doxxed.bio holds about you is listed below. There is nothing else.
| What | Why | Visible to others |
|---|---|---|
| Username and alias | The address of your page | Yes |
| Password | Stored only as a bcrypt hash. We never hold the password itself and cannot read it or recover it for you | No |
| Display name, typing lines, links | The contents of your page | Yes |
| Avatar, banner, background video | The contents of your page | Yes |
| View count | A number in your page footer, plus one count per day so your dashboard can draw a chart. No visitor details sit behind either figure | Yes |
| User ID and creation date | Your ID is sequential; the date is shown when someone hovers it | Yes |
| Two-factor secret and recovery codes | Only if you turn two-factor on. The secret is what your authenticator app checks against; recovery codes are stored as hashes, so we cannot show them to you again after enrolment. Both are destroyed when you turn it off | No |
What we don't store
- No email address. Registration is a username and a password, nothing more
- No IP addresses
- No browser, device or advertising profiles
- No location data
- No payment details, because nothing here is paid for
There is no visitor log to hand over, sell, or lose. A view adds 1 to a counter and nothing else is written.
How view counting works
A page view should mean a person, so the same visitor is only counted once per day per page. Recognising a repeat visit needs something to compare against, and this is exactly what that something is. Here it is in full, so you can check it against what we say above:
- Your IP address and browser user-agent are combined with the page's ID and a secret key, and run through a one-way hash. The result is a short string of characters
- The IP is never written down. It exists only for the instant that calculation takes. The hash cannot be reversed back into it
- The secret key changes every day, so today's hash and tomorrow's look completely unrelated. Nobody, including us, can follow a visitor from one day to the next
- The hash row deletes itself after 24 hours. It only ever existed to answer "have we already counted this visit today?"
- It is never joined to a profile, an account or anything else, and it is never shared
Requests that aren't a person opening the page are not counted at all. That covers link previews, crawlers, scripts, and the browser preloading a link in the background.
Cookies
One cookie, doxxed_session. It is httpOnly, SameSite=Lax, marked Secure in production, and lasts 30 days. It contains a signed token holding your user ID and nothing else, and exists solely to keep you signed in. There are no analytics or advertising cookies.
Third parties
None are embedded. Fonts and icons are served from our own server rather than a CDN, so no outside company sees the people who visit your page.
The links you add point at other websites. Once a visitor clicks one they are on that site, under its rules and its tracking, not ours.
Deleting things
Deletion here means deletion, not a hidden flag:
- Removing or replacing an avatar, banner or background video unlinks the file from the server immediately. There is no copy, no backup folder and no recycle bin, so restoring it means uploading it again
- Releasing an alias or changing your username returns that name to the pool for anyone to claim
- Deleting your account removes your profile, every file you uploaded, and your view count, and releases your names
What we can't promise
Two things we can't promise, so they are worth saying plainly:
- Your page is public. Anything on it can be screenshotted, copied or cached by search engines while it is up. Deleting it from our server does not reach copies that already exist elsewhere
- If whoever operates this server takes infrastructure-level backups or disk snapshots, deleted data could survive in those until they are rotated. That happens below the application, and this policy cannot speak for it
Contact
Questions about your data, or want something removed? support@doxxed.bio