Privacy

The short version

aliinuka works by putting what you said you would do in front of other people. Most of what it stores is content you wrote and chose to share. Beyond that it collects the least it can: a name, a way to reach you, and a password it never stores in readable form.

There is no advertising, there are no tracking pixels, and nothing here follows you to another site. Nothing you do here is sold to anyone, ever.

One measurement script runs, and this is it. Pages report how quickly they loaded and responded — the standard web performance figures — to Vercel, who host this site. It sets no cookie, it does not identify you, and it never sees anything you wrote: the payload is timings, which page you were on, and coarse information about your device and connection. It is there so that a page that has become slow for real people can be found and fixed, and for nothing else. The detail is below.

What you post publicly is public. A commitment is public unless you choose otherwise when you post it, and public includes a miss. Search engines are asked not to list commitments or profiles, but anybody with the link can read them, and what somebody has read they can copy, screenshot, share and keep. See what that means.

This page describes the code as it stands, and it is re-checked whenever the site changes.

Who is responsible

This site is operated by the operator of this site. If you want to know what is held about you, correct it, or have it deleted, write to the contact address.

What is collected

To have an account at all

The contact you give is not verified and nothing is sent to it — there is no email or SMS on this site at present. It exists so that an account can be recovered and so that you can be reached if something is wrong.

Your streak, and the timezone behind it

Checking in records the day, and your account keeps four numbers counted from those days: your current run, your longest, how many times a run has ended, and the last day you checked in.

These are public. Your profile shows your current run as the largest thing on the page, your longest run and your number of breaks beside it, and a grid of the last 28 days marking which ones you checked in on — which also shows which ones you did not. It is four weeks, one mark a day: no times, no moods, and never anything you wrote. If you would rather not publish that, do not check in; nothing else on the site depends on it.

Streaks together. Your desk shows, for each of your connections, how many days in a row you have both checked in, and whether each of you has today. Your connections see the same about you on theirs. Nothing new is stored for it: it is worked out from the same days the public grid already shows.

Streak freezes. Opening the daily quest chest banks a freeze, two at most, and we keep how many you hold. If exactly one day goes by without a check-in and you have one, it is spent on that day and your run carries on. The day is stored as a check-in marked “covered”, with how long the run it saved was (so your notice can say “your 12-day streak”), and the public grid shows covered days as ice, so anybody reading it can tell a day you checked in from a day a freeze covered. How many freezes you hold is shown only to you. We also note on each chest whether it banked a freeze, so undoing one takes back only what it gave.

Your league division. Each week your XP moves you between seven divisions, from the Alley to the Moon. We keep which division you are in, which week was last counted, and whether that week moved you up or down. Only you see it. It is worked out from your own XP and replaced each week, so there is no history of it.

To count days at all we store the timezone your browser already reports — a zone name like Europe/London, not a location or a coordinate. It is read when you check in, and whenever you are signed in and your browser reports a different zone from the one we have. You are never asked for it, and there is no setting for it. A streak is made of calendar days, and without knowing when your next day starts there is no way to tell a missed day from a day that has not happened yet, to show you today’s date and today’s tasks, to print times on your own clock, or to end a deadline or a league week at your midnight. It is never shown to anyone.

Your reminders

A reminder you set is kept as what you wrote and the time you picked, with when it went off and when you closed it, so it goes off once. Only you see it. It shows on the site at that time, and, if you have turned notifications on, is sent to your browser then — so what you wrote can show on your lock screen. A closed reminder stays on your list for a week; you can remove any of them, and they go with the account.

Your XP and rank

Doing things here earns XP: checking in, finishing a task, signing somebody’s commitment, and above all a promise a witness confirmed you kept. Each reward is one row — what kind of thing it was for, which one, the points, and the day. Every row points at something already described on this page, so it records nothing new about you; it is the same history, counted.

Your total XP and the rank it makes are public, on your profile. The list of what earned it is shown only to you. Your daily quests are worked out from that same list and are shown only to you. The XP you earned this week is shown to everybody signed in here, with your name and picture, in the weekly league, which ranks everyone who earned XP that week. If you turn the game off in settings, you are left out of everybody else’s league. Your browser also keeps the last total it showed you, so it knows when to celebrate; that stays on your device and is described on the cookies page.

XP sent to you. The people who run aliinuka can send somebody XP, with a short note if they like. We keep how much, the note, who sent it, when, and when it reached you: it waits until you next open your desk, which pays it and shows it to you. Only you and the people who run the site see it, and it goes with either account.

If your account is stopped

An administrator can lock an account — for spam, for a breach of the terms, or because you asked for it. Locking records when it happened, who did it, and a short reason on your account row. While it is locked you are signed out everywhere and neither your passphrase nor a recovery code will let you back in. Locking does not take your commitments off the record; that is a separate act, and it is done to individual commitments rather than to a person. It can be undone, and undoing it erases all three of those fields.

If you choose to add it

A display name, a short bio, and a profile picture. All three are optional and all three are public. The picture is resized in your own browser before it is sent and is stored with your account.

What you write in the product

Commitments and their deadlines, the steps under them, notes, signatures you give and receive, nudges, private messages, daily check-ins including the mood you pick, written reflections, groups you join, team goals and their daily checks and chat, forfeits, and focus sessions. Who can see each commitment is your choice at the time you make it: anyone, only people you are connected to, or nobody.

Tasks are separate and are never public: what you are doing today, the cue you tied it to, any note you keep with it, your estimate and what it actually took, the times you set for finishing one of them or the whole day’s list, and the names of any sections you file them under (“Work”, “School”). A task has no visibility setting because it has no audience but you.

Your compass is private on the same terms. When you rate your life we keep the score you picked (1 to 5) for each of eight parts of it — body, sleep, mind, people, work or school, money, home and habits, and growth — and the day you rated it. For each direction you set we keep the part of your life it is about, what you wrote for where you want to go and for the daily step, when you started it and when you set it aside, and the days you marked the step done. Nobody else can see any of it: not your connections, not a witness, not your profile’s visitors, and not an administrator’s ledger. It is used for one thing, showing it back to you, and it is in your data download. The one exception is yours to make: in Ask Chester you can switch on “Use my compass”, and then they go with your questions to OpenAI, as Ask Chester says.

Your desk is private on the same terms. For each step you add we keep what it is, the day, the part of your life it is for and the goal it belongs to, if any; for each goal, how many days a week it aims for; and the pace you chose (gentle, steady or all-in). When you answer the desk’s question of the day we keep the question, your answer and the day, in your journal. Nobody else can read any of it, it is in your data download, and it is deleted with your account.

The daily check-in is private too. The first time you open your desk each day it asks how you are, on five points from “Rough” to “Great”, and we keep the answer and the day. It is not shown on your desk and does not change it. It is used to draw “Your days” on your own profile: how your check-ins have gone, week by week and month by month, so you can see whether things are getting better. Nobody else can see your moods or that trend: not your connections, not your profile’s visitors, and not an administrator’s ledger. The public streak grid shows only that a day was checked in, never how you said it was. Your moods are in your data download and are deleted with your account.

The questions Chester asks before you join are private on the same terms. While you answer them nothing is sent to us: the answers are kept in your own browser tab (see the cookies page) and come with the join form when you tap “Join the club”. Then we keep, with your account: the name you gave Chester (as your display name), today’s check-in, the part of your life you picked and the goal you picked or typed in your own words (as your first goal), and the first step you settled on, which you do there and then (as today’s step, done). Your pace starts as gentle. These questions do not rate the parts of your life, so your compass starts empty until you rate it yourself. The answers are used to write your first path and today’s step. Nobody else sees them: not your connections, not your profile’s visitors, not an administrator’s ledger. They are in your data download and are deleted with your account. Before your desk opens the first time you sign a pledge, by drawing: we keep the drawing and when you signed, show it back to you, and show it to nobody else. It is in your data download and is deleted with your account. An account made before these questions keeps what it answered then: what brought you here and the parts of life you said matter most; one that answered an earlier version of them keeps those answers too (how each part of life was going, the goals picked and why the first mattered, what gets in the way, a normal day, pace, how Chester talks and whether Learn about me is on), and with “Use my compass” on, what gets in the way goes to OpenAI with your question. When you clear your notices we keep the moment you did, so the list knows what to leave off.

Whether an administrator has enabled the lockdown and the wheel for your account (they are off for everybody else), and whether you have turned lockdown on, are stored with your account and shown to nobody but you and an administrator. If you miss a commitment under it and your account is frozen, we keep what the two wheels landed on — the forfeit, who wrote it if a connection did, and how many days you were given — and the proof you hand in: what you wrote and one photo, resized in your own browser before it is sent. The proof is private to you. Nobody else can read it, and it is deleted with your account.

If you join a team goal in one of your groups, your part of it is an ordinary commitment, and everybody on that team can see it, your daily answer to “did you work on your part today?” with any line you add, and the last fourteen days of those answers — whatever the part’s own visibility, and whether or not they are your connections. You are told this before you join. The team chat is readable by the team and nobody else. If the team has a checklist, the team sees which items on it you have ticked. Leaving the group takes you off its teams; deleting the group deletes the team goal and its chat, but never your part.

If you are in a group chat, everybody in it can read what you say there and see that you are in it, whether or not they are your connections — you can only be added by somebody you are connected to. We keep who is in each chat, when each of you last read it, its name if it has one, and what was said. Leaving says so in the chat; what you wrote stays for the people still in it until your account is deleted.

In a private thread, a group chat or a team chat, anybody in it can put one emoji on a message, and everybody in it sees who put which. Under the last thing you sent, the people you wrote to see whether it has been delivered — which means you have opened a page on this site since — and whether you have read it, which means you opened the thread. In a group chat that says who has read it, by name. Read receipts are on unless you turn them off in settings, and they work both ways: turn them off and nobody sees when you read, and you stop seeing when they do. “Delivered” is always shown. While you type in a thread, the people in it see that you are typing: we note it for five seconds at a time and delete it when you send. What you have typed is not sent until you send it.

Whether you have turned the game off in settings (XP, ranks, the streak, quests, the league and the board) is stored with your account. It only changes what you are shown; it is not shown to anybody else, and nothing stops being counted.

Anybody who can see one of your commitments can cheer it, and you can cheer theirs. We keep who cheered what and when. Anybody who can see the commitment sees how many cheers it has and who the latest three came from; you are told who cheered. A cheer can be taken back, and takes its name off the commitment with it.

Which pages you keep in your dock is stored with your account, so it follows you to any device, and is shown to nobody.

If you send an idea for improving this, it is stored with your username and shown to the one person who runs this site, together with any answer given to it. Nobody else can read it. That is the only way an answer can come back to you.

If you report a commitment or a person, the report is stored with your username, what you reported, the reason you picked and any detail you wrote, and when. Only an admin can read it, together with which admin closed it and when. The person you reported is not told who reported them. If you delete your account, your name comes off the report and the report stays; if the thing you reported is deleted, the report goes with it.

Please do not write health, financial or other sensitive details into a commitment, a reflection, a direction or a check-in. These fields are free text and are stored as you typed them. They are not analysed, but they are not the right place for information you would not want a witness to read. The compass asks how parts of your life such as sleep, mind and money are going, as a number from 1 to 5 that you choose; that number is stored, shown to nobody but you, and deleted with your account.

If you set up account recovery

Only a one-way digest of each recovery code is kept. The codes themselves are shown once, when you make them, and stored nowhere — which is why nothing here can show them to you again, and why nobody operating this site can read them either.

Technical records

A session record — a random token and an expiry date — so you stay signed in, and the date you last signed in: one timestamp, replaced each time, which only an administrator sees. It is not a record of your visits; nothing here keeps one. After five wrong passphrases in a row, signing in to your account is paused for fifteen minutes: for that, the account holds a count of wrong passphrases and when the pause ends, both cleared the next time you get in. Nothing about who typed them is kept. The one exception is the editor’s journal, a private page only two accounts can open: for those two, when they last opened it and where its “new” begins — two timestamps, replaced each time, used only to show them what is new there. The site itself keeps no logs of IP addresses, no device fingerprint, and no location data. The companies that host the site and the database handle network information such as your IP address in the ordinary course of serving a request; that is described below.

An operator’s log. When an administrator acts — takes a commitment off the record, locks or deletes an account, closes a report, or opens the admin page, which shows every account’s contact — a line records who did it, what, and when. So do the things you do to your own account: signing out your other browsers, downloading your data, and deleting the account. So does every connection an agent makes, each thing it does (which action, and whether it worked; never what it wrote), each time it reads the account, and its end. Each line holds internal ids and a time, never a name, a title or a contact, and is never edited. Only administrators read it; your download includes the lines about you. It is how somebody can check what was done to an account, and by whom.

What is deliberately not collected

• No analytics about you. Nothing counts your visits, builds a profile, or records what you looked at. The one measurement script is described under how page speed is measured, and it reports how fast a page was, not who was on it.
• No advertising, and no advertising identifiers.
• No tracking cookies. See the cookie policy.
• No embeds, iframes or tracking pixels.
• Nothing that follows you to another website. No third party here sees you anywhere but here.
• No fonts fetched from another company while you browse. The typefaces are downloaded when the site is built and served from the same place as the site, so your browser never contacts a font provider.
• No payment details. Nothing on this site takes money.
• No data bought from or sold to anyone. There is no sale or sharing of personal information as those terms are used in US state privacy laws.

How page speed is measured

This site uses Vercel Speed Insights. Vercel already host the site, so they already receive every request your browser makes; this reports something they would not otherwise see, which is how the page actually behaved once it reached you.

What is sent:

• Standard web performance timings — how long the largest thing on the page took to appear, how quickly it responded when you interacted with it, and how much the layout moved while loading.
• Which page you were on, and where you arrived from if that was another page here.
• Coarse information about the browser, the kind of device, and the speed of the connection.

What is not sent:

• Nothing you wrote. No commitment, note, message, reflection, task or idea, and no part of one.
• No account identifier. Signed in or signed out, the report is the same and does not say who you are.
• No cookie and no browser storage. It stores nothing on your device, which is why this did not add a consent banner.

It cannot follow you to another website, and the figures are only ever looked at in aggregate — the point of them is to notice that a page has become slow, not to look at a visit. If you would rather send nothing at all, blocking the request in your browser or an extension costs you nothing here; the site works identically without it.

Notifications

Off unless you turn them on, in settings, for one browser at a time. On an iPhone or iPad they only work once aliinuka is on your Home Screen (Share, then Add to Home Screen); adding it is done in Safari and stores nothing about you here. Turning them on asks your browser for permission, and we keep what your browser’s push service needs to reach it: an address at that service and two keys. With it we send three things — at 8pm where you are, if your streak is running and you have not checked in (“Your 12-day streak”); when somebody writes to you while you are not on the site: their name and what they wrote, cut to a line or two; and a reminder you set, at the time you set it, with what you wrote in it. That means a message can show on your lock screen, so leave notifications off on a device other people see. We also note the day the streak reminder last went, so it goes once.

A notification travels through the push service run by your browser’s maker (Google for Chrome, Mozilla for Firefox, Apple for Safari), encrypted to your browser, which is the only way a browser can be reached when the site is not open. Turning notifications off removes the subscription, and so does deleting the account. Blocking them in your browser ends it at your browser’s end, and we forget it the next time the push service says it is gone.

Agents

An AI agent can act on this site only as an administrator or as a testing session (a throwaway account) an administrator started, never as your account. It gets in with a private code that only administrators can see and that changes every thirty minutes, and it gets one hour. When the hour is up, or an administrator ends it sooner, it is put out. What it created, changed or deleted stays, as anything that account did would, until the administrator deletes the testing session, which deletes its account and everything on it. Nothing a testing session posts is ever public: at most its connections can see it, and its profile page is shown only to itself and administrators.

While it runs we keep which account it acts as, when its hour ends, a one-way digest of its token, and a list of the rows it created, to count them. That list is deleted when the agent ends, and we note why it ended (its hour was over, the code was changed, an administrator ended it), which is what the agent is told if it tries its token again. The rest of the record, the digest and that reason included, goes when its hour would have, because it is also what stops the code that let it in from being used again.

Ask Chester

Ask Chester is an AI assistant with the raccoon as its face. The answers are written by a model from OpenAI, and when it needs to look something up it searches the web with Brave Search. It is only used when you open it and ask something.

• To OpenAI: what you type and Chester’s earlier answers in the same conversation, and the results of his searches. Only if you switch on “Use my compass” beside the box, also what brought you here, the parts of life you said matter most, your latest compass, your live directions with their daily steps and why they matter to you, what you said gets in the way, and your open steps for the coming week (what each says and which day it is on), so he can move or finish one when you ask. Not your name, username, email or phone. We ask OpenAI not to store the conversation for later use (store: false); what it keeps, and for how long, is then set by OpenAI’s own terms for its API.
• To Brave: only the search words Chester writes, which he is told never to fill with anything personal about you. Not who is asking.
• Never sent anywhere: the simple commands — “add gym at 7 tomorrow”, “move my CV step to Friday”, “done with the walk”. They are understood on this site, without the AI, and do not count toward the daily limit.
• What he can change: when you ask, Chester adds, moves or finishes your steps and sets reminders, and each change shows as a card with an Undo. Anything he only suggests changes nothing until you tap it. Those steps and reminders are kept like any you add yourself.
• Quick chats are not kept. A quick chat lives in your open page and ends when you leave it or start over. We keep only the time of each question, to count the daily limit, and that is in your data download.
• Focuses are kept. A focus is a chat you choose to keep (“New focus”, or “Keep as focus” on a quick chat): we store its name, the part of life it is about, and every message in it, yours and Chester’s, with the cards he showed, so you can come back to it and he remembers it. Only you can open a focus. Delete one from its menu and everything in it is gone; they are all in your data download and are deleted with your account. A focus’s earlier messages go to OpenAI with each new question, as a quick chat’s do.
• How he talks: the style and answer length you choose in his panel are kept with your account and change the instructions he is given; nothing else.
• Learn about me is off until you turn it on. While it is on (in Chester’s panel, or on “What Chester knows about you”), Chester keeps short notes from your chats, quick chats and focuses alike — about your life, what matters to you, your goals, what gets in the way, what helps and what hasn’t, and similar topics — and a few lines he calls his read on you. Each note says whether you told him, it is a pattern he has seen in more than one chat, or it is his guess; which focus it came from; and when. He keeps nothing about your physical or mental health unless he asks first and you say yes. Only you can see them, on “What Chester knows about you”, where you can correct, confirm or delete any of them, a whole topic, or all at once. We keep at most 200; past that the one least worth keeping goes (an unconfirmed guess first, never before something you told him). While it is on, with each question you ask him the notes that bear on it (at most 18) and his read go to OpenAI, whether or not “Use my compass” is on, so his answers fit you. Turning off “Let Chester guess” deletes his guesses, patterns and read and stops him making more; turning off Learn about me stops him keeping notes and deletes every note and his read at once. They are in your data download and are deleted with your account.

Chester is an AI and can be wrong. He is not a doctor, a therapist or an emergency service: if you are in danger, see Get help.

Who else touches it

Two kinds of company, both because the site cannot run without them, and neither is permitted to use your information for their own purposes:

• The hosting provider, which runs the site, receives each request your browser makes, including your IP address, and receives the speed measurements described above.
• The database provider, which stores everything described above.

Only if you use Ask Chester, OpenAI and Brave, which receive what Ask Chester says and nothing else.

And, only if you turn notifications on, your browser’s push service, which carries each notification to your browser. It receives the notification’s title, one line and the page it opens, encrypted so that only your browser can read them.

Nobody else. Information may also be disclosed if the law requires it, or to deal with a safety problem or a serious breach of the terms.

How long it is kept

For as long as the account exists. Sessions expire on their own. You cannot delete a commitment yourself. An administrator can take one off the record, or delete it permanently, if you ask at the contact address below.

You can delete your whole account yourself, in settings under “Delete your account”. It asks for your username and your passphrase, typed, and then deletes the account and everything attached to it at once. If you cannot get in, ask at the contact address and it will be done for you.

What you can ask for

These are offered to everyone who uses the site, wherever you live, rather than only to people a particular law happens to cover:

• A copy of what is held about you. You can download it yourself, as one file, in settings under “Your data”. It leaves out your passphrase hash, session ids, recovery-code digests and push keys, which are keys rather than information about you.
• Correction of anything that is wrong — most of it you can edit yourself in settings.
• Deletion of your account and its contents.
• An explanation of anything in this document that is unclear.

Write to the contact address. There is no charge and you will not be asked why.

Deletion is real and it is permanent. It removes your account, every commitment you posted, your steps, check-ins, reflections, compass readings, directions, tasks, reminders, ideas, XP sent to you and recovery codes — and it also removes the things you put on other people’s pages: signatures you gave, notes you left, nudges you sent, forfeits you wrote for someone’s wheel, and your messages. There is no copy and nothing is kept back, except one line in the operator’s log (below) saying that an account was deleted and when, under an internal id that no longer points at anything — not your username, not your contact.

Two limits worth being straight about. A commitment somebody else posted stays theirs: if you confirmed it for them, it stays confirmed and simply loses your name from it — their kept promise is not yours to undo. And deleting your account cannot rewrite other people’s memory of having witnessed something.

Security

Passwords are hashed with argon2id. Sessions are random 256-bit tokens in a cookie that JavaScript cannot read, and which is sent only over HTTPS in production. Only a one-way digest of each token is stored, so a copy of the database could not be used to sign in as anybody. Whether a given commitment is visible to a given person is checked in the database query itself rather than by hiding it in the page, so a private commitment is not merely unshown — it is not sent.

No system is perfectly secure, and this one is built and run by one person. If you find a problem, please write to the contact address before telling anyone else.

What we are not responsible for when you post publicly

Choosing who can see a commitment is yours to do, and so is what you write in it. Once something is public, aliinuka cannot control what other people do with it. To the fullest extent the law allows, we are not responsible for:

• anybody copying, screenshotting, sharing, archiving or quoting what you made public, here or anywhere else;
• embarrassment, or harm to your reputation, relationships, schooling or work, from a commitment, a miss, a note or a profile you made public;
• people you did not expect seeing it — family, classmates, an employer, a stranger — or what they do about it;
• search engines, archives or link previews that keep a copy despite being asked not to;
• personal or sensitive details (health, location, other people) that you chose to put in something public;
• what other users write about you or to you, and any forfeit, dare or stake you agree to with them.

If you are unsure, post it as visible to your connections or to just you. Visibility can be widened later; it cannot be narrowed. If something public puts you or somebody else at risk, report it and an administrator can take it off the record.

Children

You must be at least 18 years old to hold an account. Accounts are not knowingly created for anyone younger, and if one comes to light it will be deleted. If you believe somebody under 18 has an account here, please say so at the contact address, or use the Report link on their profile and choose “A child’s safety” — those reports are read first.

The minimum age may be lowered in the future. If it is, this page will say so before the change takes effect, and will set out what is different for younger users — what they can post, who can see it, and how a parent or guardian can ask for an account to be deleted — before any younger person can sign up.

Where the data is

The site and its database are hosted in the United States. If you use aliinuka from outside the United States, what you write is stored there.

Changes

The date at the top changes when this document changes in substance. It is reviewed whenever the site is changed in a way that affects what is collected. If a change materially affects you, it will be said on the site rather than slipped in.