Privacy

This page is short because the service holds very little. Sites served by dids.lol set no cookies and run no analytics, and the pages you are reading now do neither.

Visitors to a site hosted here

When someone loads a site dids.lol serves, the origin resolves the hostname and path to a stored file and streams it back. It sets no cookie, runs no script of ours, and stores nothing that identifies the visitor. Request logs, where they are kept at all, are operational — retained briefly for debugging and abuse response, and never joined to an identity.

A site’s author cannot add tracking through dids.lol either: a fixed Content-Security-Policy applies to every served site and forbids third-party scripts.

This site

The public pages on dids.lol are static files with no scripts and no cookies. Nothing here tracks you.

People who publish

When you use the interface application at app.dids.lol, the service holds:

• A session — your DID, the tokens your server issued, and a key bound to them — encrypted inside a cookie set on app.dids.lol only, which page JavaScript cannot read. It ends when you sign out or when it fails to refresh.
• Short-lived state in a cache: the in-flight sign-in request and rate-limit counters. Minutes at most.
• Your registrations — the domains you have claimed, their verification and certificate state, and the addresses of the records you published.
• Copies of your files, kept durably so your site keeps serving.

There is no user table, no password, no email address, and no draft store. Everything you publish is public by construction: it is a record in a repository on the AT Protocol network. A record you keep in a space is not on the public firehose, but a site published from one is a public website like any other.

What we send elsewhere

To do its job the service talks to your personal data server (to read records and fetch blobs), to the DID directory (to resolve identities), to the DNS (to check the records that prove you control a domain), and to a certificate authority (to obtain a certificate for that domain). Those requests carry what they must and nothing else. An abuse report you submit is forwarded to the operator.

Deleting things

Delete your record and the site stops serving; release the domain and the registration and certificate go with it. Copies of your files are removed on the ordinary collection schedule once nothing references them. Signing out ends the session immediately and revokes it at your server.

Questions about privacy go to [email protected].