Privacy
The short version
You can read every page here without an account, and reading is not tracked to a person. If you do sign in, ppll stores your email address, your name, and the things you chose to keep — and one button deletes all of it, immediately and for good. There is no advertising and nothing is sold to anybody. Outside Europe, a narrow, time-limited slice of visits may be screen-recorded by a third party to help us see where a page is confusing — details below.
If you have an account
There are two ways in, and you need an account for neither reading nor searching — only for following people, keeping lists and being emailed.
With Google. ppll asks Google for three things
and nothing else — openid, email and
profile — so it never receives your password and has no access
to your Gmail, Drive, Calendar or anything else in your Google account.
With a link to your address. Type an address and ppll emails you a link that signs you in. Until you open that link nothing has been created: there is one short-lived row holding your address, where you were going, and a one-way fingerprint of the link itself — never the link, so a copy of that table cannot sign anybody in. It works once, expires after fifteen minutes, and is swept away after a day. Somebody who types your address by mistake causes exactly one message and no account.
- Your email address. The only piece of personal information an account requires. It is stored because a weekly digest will need somewhere to send it, and because it is how we would reach you about your own account. It is never shown publicly and never given to anyone.
- Your name, when Google gives one, so the site can greet you with something other than an identifier. Signing in by link stores no name at all, because nobody asked you for one.
- An identifier from Google, on that path only, meaning "this is the same person as last time". It is not your password and cannot be used to sign in anywhere.
- Your sessions — one row per browser you are signed in
on, holding when it started, when it expires, and a coarse device word like
Android. Not your IP, not your full browser string. - What you keep: the people you follow and the lists you make. Lists are public unless you mark them private, and a public list is meant to be shared. Follows are private to you — nobody, including the person, is shown who follows them.
That is the entire list, and it is not a promise we maintain by hand: Settings reads it back out of the database itself, so it cannot quietly fall out of date as the site grows.
If you ask for emails
Nothing is emailed to anybody who has not asked. Turning the digest on at Settings → Email and alerts adds one row holding your choices — off, daily or weekly, the hour and weekday you picked, the time zone your browser reported so that hour means your morning and not ours, whether you want highlights or everything, and two random tokens: one that turns the emails off in a single tap with no sign-in, and one that is the address of your own private feed.
Two timestamps ride along with it, and they are the two worth being explicit about:
- How far the last email reached. A date, so the next one starts where the last one stopped and never repeats it.
- When you were last on a page while signed in — a single timestamp, rewritten at most once an hour. It is read for exactly one purpose: if everything an email would have carried was already published before that moment, the email is not sent. It is not a record of what you read. What you have read is worked out in your own browser, kept there, and never sent to us — that has always been true of the feed and this does not change it.
The emails themselves contain no tracking pixel, no
click redirector and no link that identifies you. We cannot tell whether
one was opened, and that is deliberate rather than an oversight: a site that
refuses engagement counters on its pages should not fit one to its mail. Links
back to ppll carry a ?from=digest label, which says a visit came
from an email and names nobody; links to somebody else's site go out exactly as
they are stored, because adding anything to another site's address is editing
it.
Every email carries a one-tap unsubscribe that works without signing in, and the header your mail app uses for its own unsubscribe button. Turning emails off is not the same as deleting your account, and neither touches your follows.
Deleting your account
The Delete button on Settings removes your account, your sessions, your follows, your lists, your list memberships and your email settings in a single operation — it finds them by asking the database which tables point at you, so a feature added next month is covered without anyone remembering to add it here. There is no waiting period, no soft-delete and no tombstone row kept behind — a record about someone who asked to be erased is the thing being erased. Signing in again afterwards makes a new account that remembers nothing about the old one. Export covers exactly the same set, so you can take it before you go.
One thing deletion does not cover, stated because the opposite would be a false promise: if you have claimed a page about yourself, that claim is a separate thing from your reader account — it is an assertion about a public figure, not part of your reading. Deleting your account leaves it standing. It also leaves the contact address you gave when you claimed it, which is stored with the claim and not with your account — so deleting the account does not delete that address. Both end when the claim does: write to hello@ppll.app and it is withdrawn. Settings says this at the moment you delete, too.
We do not remove it automatically, and the reason is worth stating: the only way to connect a claim to an account is to match the two email addresses, and a guess about who somebody is should not be the thing that decides what gets deleted. So we tell you instead of guessing.
Cookies
Two, both strictly functional, neither used for tracking or shared with anyone: one that keeps you signed in, and a short-lived one during sign-in itself that exists to stop somebody else completing a sign-in into your browser. Signed out, with no account, this site sets no cookies at all.
What is measured when you read a page
This part applies to everybody, signed in or not, and none of it is joined to an account — the measurements below are not linked to who you are, even when the site knows.
- Which pages you opened — including what is in the address
bar, because
/and/search?q=someoneare different pages and the second one is the useful one. - Which links and controls you clicked, and in particular whether you left for one of the channels a page lists, or opened the source a quote came from. Those two are the reason this site exists, so they are counted separately from ordinary links. On a person’s page, opening or closing one of the cards is recorded too, with the card’s own label.
- What you typed into this site’s own search box, and how many people it matched. Nothing else you type anywhere is recorded. A name that matched nobody is the single most useful thing we learn — it is somebody telling us, in their own words, who is missing.
- How far down a page you scrolled (in quarters, not pixels) and how long the page was actually in front of you.
- Two signals about the site rather than about you: a control clicked three times in two seconds, and a click on something that looked pressable and did nothing. Each is stored as a count and the control’s label.
- Where the request came from: the country and rough city, a coarse
“operating system / browser” such as
Android/Chrome, the network your connection belongs to — a company name and a network number, each shared by thousands of people and never an address — and the host of the site that linked you, never the full URL you came from.
No cookie and no lasting identifier. A random number is kept in your tab’s own storage so that three pages read one after another are legible as one visit; your browser throws it away when you close the tab. It cannot follow you to another site, and coming back tomorrow makes a new one. Your IP address is never stored — it is used to work out the country and then discarded.
One thing is done with that number, and it is worth spelling out because it is the only comparison this site makes between visits. A browser picks the number at random, so no two people ever draw the same one — but a search engine’s page renderer is built to be repeatable and draws the same number every time it visits. So when a number turns up that another visit already used, we know the visitor was a machine, and the visit is marked as one. That is all it is used for: not to recognise you, not to link two of your visits — yours will never match — and never to build anything that outlives the tab. It replaced a check that tried to guess the same thing from your browser’s name, which is a thing anyone can type.
Almost nobody gets more than what is described above — we never record mouse movement, screen contents, keystrokes outside the search box, or anything typed into a form. That line, measurement rather than session recording, is what the code is written against for everyone signed in, everyone on Settings or the admin pages, and everyone reading from inside the EU, the EEA, the UK or Switzerland.
Outside those places, a slice of visits is screen-recorded by PostHog, a third party we use to watch, anonymously, where a real person got stuck on a page — the one thing pageview counts cannot show. It is on deliberately narrow terms:
- Only readers outside the EU, the EEA, the UK and Switzerland — the jurisdictions where placing a recorder needs your consent, which this site does not ask for and so never places one there. Your country is read the same way it already is above, and discarded the same way.
- Never on Settings, sign-in, a claim page or any admin page, whatever country you are reading from.
- The one text box you can type into — search — is masked in the recording; what you typed is never visible in it.
- No cookie. The recording is tied to the same tab-only, closes-when-you-do session as everything else on this page — it cannot follow you between visits or between sites, and coming back tomorrow starts a new one.
- Time-limited by design, not by promise: the code that turns this on carries an expiry date, and past it recording stops on its own until someone deliberately extends it.
We do not build a profile of you inside PostHog and nothing recorded there is linked to an account here, a name, or an email address.
Where it goes
The measurement code is /static/b.js,
served by ppll.app and reporting to ppll.app. It is the only script on the page
that is not part of the page for the large majority of visits, and for those the
site’s content security policy forbids loading a script from anywhere else.
A copy of the same measurements is sent by our server, not by your browser
to stats.kapps.dev, which is ours, so that several of our sites can
be compared in one place. The one exception is the screen recorder described
above: on the narrow slice of visits where it runs, the policy also allows its
script, from PostHog’s own domain, and nothing else’s. Nobody else
receives any of it.
One of us also gets a phone notification when somebody makes an account, or asks to be emailed about a person. That notification deliberately carries nothing that identifies you — not your address, not your name, not an identifier. It says that it happened, whether the account was made with Google or with an emailed link, and which public figure was asked for, because that is a public page and not a fact about you. Who it was can only be seen on a page of ours that requires our own sign-in. We think being told that the site is working should not cost you the promise above.
Pictures in posts are fetched by us, not by your
browser. When a post on X or Bluesky carries a picture, the page asks
ppll.app for it at /media, and our server fetches it from the platform
and passes it on. Your browser does not connect to X or Bluesky to show it, so
they do not see your visit.
One of us gets a phone notification when a visit turns out to be a real one — more than one page, or a channel opened, or a couple of minutes spent reading. The notification carries exactly what is described above and nothing more: the country and rough city, the coarse device name, the network, where you came from, and the list of pages and clicks in the order they happened. There is one person on the other end, it is not shared with anyone, and it contains nothing that could identify you.
Stop counting this browser — that preference is stored in your browser’s local storage, on this site only.
What is kept in your browser
A few small things, all of them in your browser’s local storage for this site only. None of it is ever sent to the server, so it is not part of the measurements above and nobody here can read it. Clearing this site’s data in your browser removes all of it.
- The counting preference above.
- How you have set up the feed — which sources you are reading, and any person or source you have chosen to hide.
- Which items you have already read, so that refreshing the feed carries on instead of showing you the same things again. It is a list of short codes, one per item, with the day it was read; nothing about you, and no record of it exists anywhere but your own browser. Items older than four months drop off it.
If there is a page here about you
These pages are compiled, not authored. The people listed did not write them and have no account here. A page holds two things: links to places that person publishes — each one checked by hand before it appears — and beliefs compiled by korrents.com, every one carrying a word-for-word quote and a link to where it was said.
Everything on a page is drawn from things that were already public and were published by the person themselves, or said by them in something they chose to take part in. Nothing here is private information, nothing is inferred about anyone, and there is deliberately no attempt at completeness — a few chosen channels are a signpost, and an exhaustive file on a person is a different and much worse thing.
You can have your page corrected, claimed or removed. Write to hello@ppll.app and say which page. No account, no form, and you will not be asked to prove anything.
Removing a page here removes it from ppll only. korrents.com is a separate site with its own record of what people have said — this site reads from it and cannot change it. To be removed there too, write to hello@korrents.com as well.
If you send us feedback
The form at /feedback stores what you typed, the page you sent it from, and an email address only if you chose to give one so we could reply. Leave it blank and the message is anonymous. If you were signed in, the message is linked to your account so a reply can find you; deleting your account deletes that link along with everything else.
One thing is derived rather than typed: to stop the form being used to send the same message a thousand times, your IP address is combined with today’s date and hashed, and only that hash is stored. It cannot be turned back into an address, and because the date is part of it, it cannot be used to connect what you send today to what you sent last week. No raw IP address and no browser details are kept with a message.
Where data lives
Everything is stored in Cloudflare D1 and served from Cloudflare Workers. Cloudflare processes it as our infrastructure provider. Visit measurements are deleted after 180 days. Account data is kept until you delete it, and then it is gone. Feedback is kept until it has been dealt with and is not deleted on a timer — a correction to a page is a thing worth being able to look back at. Ask, and yours is deleted.