Privacy — 2bit.pics

We count pages, not people

There is one piece of analytics here: Umami, the open-source analytics software, running on a server the same person who runs 2bit.pics rents and administers. It counts page views, so we can tell which parts of the site people actually use and whether a change made things better or worse. There is no advertising, no tracking pixel, and no third-party analytics company in the picture — no advertising business behind this site to feed — and nothing it records is sold, shared, or used to build a profile of you.

A page view records:

the page you’re on, and its title;
the page that linked you here, if any;
your screen size and your browser’s language;
your browser, operating system, and country — worked out from your IP address and user agent as the request arrives, not stored from them;
how quickly the page loaded and responded for you, as your own browser measured it, and which release of the site you were served.

A few interactions are counted too — which navigation tab you tapped, which share option you picked, how far down a feed you asked for more, and that a photo was opened, liked, or commented on. What’s recorded is which control and, for a photo, how far down the list it sat: never which photo, whose it was, or what any comment said.

What it doesn’t do: it sets no cookies, keeps nothing in your browser, and never writes down your IP address. Views are joined into a visit, and visits into a visitor, by an ID hashed from your IP address and browser details together with a secret that changes every day. The hash can’t be turned back into any of them, and when it changes the trail ends — nothing connects a visitor today to the same person tomorrow. Within a single day it can show a path through the site, but it’s an anonymous hash walking it, tied to no account and meaningless to any other site.

Turning counting off here sets umami.disabled in this browser’s local storage, which the tracker checks before every send (details). Because it lives in local storage, the setting belongs to the browser rather than your account; you’ll need to turn it off on each browser you use, and clearing this site’s data clears it too.

Don’t count my visits Turns off page views from this browser entirely.

What we store in your browser

A few cookies, all but one to do with signing you in and keeping you signed in:

hv_s — your session, encrypted before it’s set so it’s unreadable outside the server. Expires after 30 days, and clearing it simply signs you out.
hv_p — a login in progress, sent only to the sign-in callback and gone ten minutes later.
atm_state — set only when you press Login with Atmosphere: a random one-time code that proves the account you picked there was picked from this browser. It’s sent only to the sign-in callback, which clears it, and expires after fifteen minutes regardless.
identity-checked — your account identifier and today’s date, so we refresh your handle in the site’s index once a day rather than on every page — it’s what lets the sign-in form find your account by its handle. Expires after a day.
scope-check — whether your sign-in includes every permission the site currently needs, so we ask once rather than on every page. It holds your account identifier and a short fingerprint of those permissions, nothing else, and is cleared when you sign out.
reauth-dismissed — set only if you choose “Not now” when asked to sign in again, so the notice stays away for a week. Also cleared when you sign out.
app-icon — set only if you pick a home-screen icon in Display settings and press Save: which picture and background you chose, so the page can point your browser at that icon if you install 2bit.pics as an app. It isn’t tied to your account, lasts a year, and goes away if you pick the default again.

They’re there to operate the service; none is used to track you across sites, and there are no cookies here beyond these.

Your palette and light/dark preference are kept in your browser’s local storage under 2bitpics:theme, which is read on page load to draw the site in your colors. If you’re signed in, they’re also saved with the rest of your settings here, so they follow you to your other devices. Those settings are held by 2bit.pics, not published to your repository, so they aren’t public.

If you install 2bit.pics as an app, a service worker caches the site’s own code — its JS, CSS, and icons — so it loads faster and can open offline. It never caches your photos, profile, or any other page content, since those are only ever fetched fresh for your signed-in session. If you turn on notifications, the same service worker is what receives them and puts them on screen.

With notifications on, 2bitpics:push-refreshed in local storage notes when this browser last confirmed its subscription with us, so it only does that once a day. It holds a timestamp and nothing else.

Where your photos actually live

This is the part worth understanding. Your photos, comments, likes, follows, and profile are records in your own repository on your AT Protocol provider (your PDS). They are not rows in a 2bit.pics database. We read them from the network and display them.

Records published to the network are public. Anyone can read them — the network is designed that way — including people and services with no connection to this site. There is no private posting on 2bit.pics.

We store your account identifier (your DID) inside your session cookie so we know who’s asking. We don’t keep a separate profile of you beyond that and the settings you choose here — and, if you use them, what notifications and reports need, described next.

Notifications on your device

Push notifications are off until you turn them on in Settings, on each device you want them on. Turning them on is the only thing that asks your browser for permission; nothing here prompts you on its own.

With them on, we store, for each device:

the push address your browser’s push service gave it, and the encryption keys that go with it — what lets a notification reach that device and no other;
when it was turned on, and when that device last confirmed it;

and, for your account:

which kinds of notification you’ve turned off;
a short record of what you were recently notified about — the last 50 likes, comments, follows and mentions, and how many there have been on each photo this hour — so the same like never notifies you twice, ten likes become one notification that says ten, and we can stop at a handful an hour.

All of it is kept in the database of the indexing service behind this site (HappyView), never in your repository on your PDS and never published to the network. The push addresses are never shown to anyone, you included — the Settings page only ever sees how many devices you have.

A notification says who did what (“@alice liked your photo”) and links to it. It never carries the text of a comment or a caption, since notifications land on lock screens. The people you’ve blocked, who’ve blocked you, or who you’ve muted never cause one.

It’s deleted when:

you turn notifications off on that device, or on all of them;
you sign out on that device;
your browser’s push service tells us the address no longer works — which is usually what happens when you uninstall the app or clear the site’s data;
you haven’t opened 2bit.pics on that device, signed in, for 30 days.

Reports

If you report a photo, comment, or account, the report — what you reported, the category you picked, any note you added, and your account identifier — is kept in the indexing service’s database (HappyView). Unlike almost everything else here, it’s never written to your repository or published to the network: who reported whom shouldn’t be a public record about either of you.

The site’s moderators can see who filed a report, so they can follow up and notice if reporting itself is being abused. Nobody else can, including the person you reported. A new report sends the moderators — other than any it’s about — a notification saying what was reported and why, never who reported it.

Reports are kept after they’re closed, as the record of what was decided. To have one of yours removed, email privacy@2bit.pics. Reports sent by email go to an inbox only the operator reads.

What our servers see

Ordinary web request data reaches our hosting provider (Microsoft Azure) and the indexing service behind the site’s data (HappyView), which runs there too: your IP address, your browser’s user agent, the pages you requested, and when. It’s used to serve the site, keep it up, and fend off abuse — not to profile you — and we don’t combine it with your account to build a browsing history.

Photos and profile pictures load from cdn.2bit.pics, a content delivery network (Azure Front Door) that keeps copies close to whoever is viewing them. What it serves are images rendered from public records, and only ones a signed-out visitor could see anyway: anything whose author has asked to be hidden from signed-out visitors is drawn in your browser instead, and never cached there. It sets no cookies and doesn’t know who’s signed in; like any web server, it sees the request for each image.

Preview cards — the images that appear when a 2bit.pics link is shared — are rendered from public records and cached briefly on the server. They’re built from photos and handles that are already public.

Other services in the path

Your PDS provider. Holds your account and your records. Their privacy policy governs that, not this one.
Microsoft Azure, our host and image CDN, and HappyView, which indexes the network’s data for the site. Both process request data as described above.
Atmosphere (atmosphereaccount.com), only if you press Login with Atmosphere. Nothing on the sign-in page loads from it; pressing the button is what takes you there. Its account picker then learns which account you chose to sign in to 2bit.pics with, and hands that back to us as a signed token. It never gets access to your account: the sign-in itself still happens with your PDS provider, exactly as when you type your handle. Signing in with your handle doesn’t involve Atmosphere at all.
fonts.bunny.net, which serves the site’s fonts. Loading a page fetches them, so that service sees the request. It’s used specifically because it’s a font host that doesn’t log or track visitors.
Our analytics server, described above. It’s ours rather than an analytics company’s — nobody else has an account on it — but it is a machine rented from a hosting provider, which is listed here for completeness. Only what’s described above is passed to it.
Your browser’s push service, if you turn notifications on: Apple’s, Google’s, Mozilla’s or Microsoft’s, depending on your browser — it isn’t something we choose. It delivers each notification to your device, so it sees that one was sent, when, and how large it was. It can’t read what it says: notifications are encrypted for your device before they leave us. Azure, our host, is where that encryption happens; it handles each notification on the way through and keeps nothing.

Deleting things

Delete a photo or comment on 2bit.pics and the underlying record is deleted from your repository — it goes away at the source. Copies may persist for a while in caches — up to an hour on the image CDN, longer in browsers that already loaded it — in link previews already shared, and on other services that indexed it while it was public. We can’t reach into those.

Hiding someone else’s comment on your photo is different: that comment is a record in their repository, so neither you nor we can delete it. Instead, a small record is published in your own repository listing the comments you’ve hidden on that photo, and 2bit.pics moves them out of the thread, behind a link anyone can still open. Like everything else you publish, that list is public, and other apps on the network may or may not honor it.

Sign out and your sign-in cookies are cleared, and that device stops getting notifications. Your other devices keep theirs until you turn them off in Settings, where one switch turns them off everywhere. To leave entirely, delete your records and close your account with your PDS provider; there’s no separate 2bit.pics account to close.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete personal data held about you, and to object to its processing. Because your content lives in your own repository, most of that is already in your hands — but write to privacy@2bit.pics and we’ll help with anything that isn’t. Alex Akers is the data controller for the small amount handled here.

Children

2bit.pics isn’t for anyone under 13, and we don’t knowingly collect data from them. If you believe a child under 13 is using the site, email privacy@2bit.pics.

Changes to this policy

If what we do with data changes, this page changes and the date at the top moves with it. Substantive changes will be noted on the site rather than slipped in quietly.

Getting in touch

Privacy questions and data requests: privacy@2bit.pics. Anything else: hi@2bit.pics.