Short version: almost nothing. There are no ad trackers and no third-party scripts watching you — the only thing counting anything is an analytics instance we run ourselves, which sets no cookies and never sees who you are. This page is the long version.
Last updated August 20, 2026
There is one piece of analytics here: Umami, the open-source analytics software, running on a server the same person who runs 2bit.pics rents and administers. It counts page views, so we can tell which parts of the site people actually use and whether a change made things better or worse. There is no advertising, no tracking pixel, and no third-party analytics company in the picture — no advertising business behind this site to feed — and nothing it records is sold, shared, or used to build a profile of you.
A page view records:
A few interactions are counted too — which navigation tab you tapped, which share option you picked, how far down a feed you asked for more, and that a photo was opened, liked, or commented on. What’s recorded is which control and, for a photo, how far down the list it sat: never which photo, whose it was, or what any comment said.
What it doesn’t do: it sets no cookies, keeps nothing in your browser, and never writes down your IP address. Views are joined into a visit, and visits into a visitor, by an ID hashed from your IP address and browser details together with a secret that changes every day. The hash can’t be turned back into any of them, and when it changes the trail ends — nothing connects a visitor today to the same person tomorrow. Within a single day it can show a path through the site, but it’s an anonymous hash walking it, tied to no account and meaningless to any other site.
Turning counting off here sets umami.disabled in this browser’s local storage, which the tracker checks before every send (details). Because it lives in local storage, the setting belongs to the browser
rather than your account; you’ll need to turn it off on each browser you
use, and clearing this site’s data clears it too.
Two cookies, both needed to sign you in and keep you signed in:
hv_s — your session, encrypted before it’s set so it’s unreadable
outside the server. Expires after 30 days, and clearing it simply signs you
out.hv_p — a login in progress, sent only to the sign-in callback and
gone ten minutes later.Both are strictly necessary to operate the service; neither is used to track you across sites, and there are no cookies here beyond these two.
Your palette and light/dark preference are kept in your browser’s local
storage under 2bitpics:theme. That never leaves your device —
it’s read on page load to draw the site in your colors.
If you install 2bit.pics as an app, a service worker caches the site’s own code — its JS, CSS, and icons — so it loads faster and can open offline. It never caches your photos, profile, or any other page content, since those are only ever fetched fresh for your signed-in session.
This is the part worth understanding. Your photos, comments, likes, follows, and profile are records in your own repository on your AT Protocol provider (your PDS). They are not rows in a 2bit.pics database. We read them from the network and display them.
Records published to the network are public. Anyone can read them — the network is designed that way — including people and services with no connection to this site. There is no private posting on 2bit.pics.
We store your account identifier (your DID) inside your session cookie so we know who’s asking. We don’t keep a separate profile of you beyond that.
Ordinary web request data reaches our hosting provider (Netlify) and the indexing service behind the site’s data (HappyView): your IP address, your browser’s user agent, the pages you requested, and when. It’s used to serve the site, keep it up, and fend off abuse — not to profile you — and we don’t combine it with your account to build a browsing history.
Preview cards — the images that appear when a 2bit.pics link is shared — are rendered from public records and cached briefly on the server. They’re built from photos and handles that are already public.
Delete a photo or comment on 2bit.pics and the underlying record is deleted from your repository — it goes away at the source. Copies may persist for a while in caches, in link previews already shared, and on other services that indexed it while it was public. We can’t reach into those.
Sign out and both cookies are cleared. To leave entirely, delete your records and close your account with your PDS provider; there’s no separate 2bit.pics account to close.
Depending on where you live, you may have the right to access, correct, export, or delete personal data held about you, and to object to its processing. Because your content lives in your own repository, most of that is already in your hands — but write to privacy@2bit.pics and we’ll help with anything that isn’t. Alex Akers is the data controller for the small amount handled here.
2bit.pics isn’t for anyone under 13, and we don’t knowingly collect data from them. If you believe a child under 13 is using the site, email privacy@2bit.pics.
If what we do with data changes, this page changes and the date at the top moves with it. Substantive changes will be noted on the site rather than slipped in quietly.
Privacy questions and data requests: privacy@2bit.pics. Anything else: hi@2bit.pics.