Skip to content

What we hold about you

How far each thing travels

Every fact we keep about you sits at a distance. This page shows you that distance, from the outside in.

17/25

Never leaves your file

These stay with you. There is no switch that lets them out, because no switch was built.

Shown to no one at all

Not even to you. It is a key that links your sign-in, and a key is safest when nobody reads it.

  • auth_user_id
Look at yourself from outside

Pick who is looking. The page redraws to show what that person can see.

A stranger, not signed in

If your profile is kept private
Sees nothing at all.
If your profile is public
Sees nothing at all.
If your profile is public, with your town shown
Sees nothing at all.

A member, signed in

If your profile is kept private
Sees nothing at all.
If your profile is public
Can see 7
  • avatar_url
  • bio
  • cover_url
  • display_name
  • first_name
  • handle
  • id
If your profile is public, with your town shown
Can see 8
  • avatar_url
  • bio
  • coarse_location
  • cover_url
  • display_name
  • first_name
  • handle
  • id

You

If your profile is kept private
Can see 24
  • audience_role
  • avatar_url
  • bio
  • city
  • coarse_location
  • coppa_consent_at
  • county
  • cover_url
  • created_at
  • display_name
  • district
  • email
  • findable_by_members
  • first_name
  • guardian_id
  • handle
  • id
  • is_minor
  • political_identity
  • profile_visibility
  • search_indexable
  • show_location
  • state
  • updated_at
If your profile is public
Can see 24
  • audience_role
  • avatar_url
  • bio
  • city
  • coarse_location
  • coppa_consent_at
  • county
  • cover_url
  • created_at
  • display_name
  • district
  • email
  • findable_by_members
  • first_name
  • guardian_id
  • handle
  • id
  • is_minor
  • political_identity
  • profile_visibility
  • search_indexable
  • show_location
  • state
  • updated_at
If your profile is public, with your town shown
Can see 24
  • audience_role
  • avatar_url
  • bio
  • city
  • coarse_location
  • coppa_consent_at
  • county
  • cover_url
  • created_at
  • display_name
  • district
  • email
  • findable_by_members
  • first_name
  • guardian_id
  • handle
  • id
  • is_minor
  • political_identity
  • profile_visibility
  • search_indexable
  • show_location
  • state
  • updated_at

Every field, and who it reaches

  • audience_roleReaches no one

    Which track somebody is on -- family, educator, adult. A guess at their household.

  • auth_user_idReaches no one

    The identity-provider key. Correlates this account with every other system the person signed into.

  • avatar_urlA member, signed in

    A picture of a person is a person. Shown on a public profile; never in a list.

  • bioA member, signed in

    Free text somebody wrote about themselves, which is exactly where people put the things that identify them. Public profile only.

  • cityReaches no one

    Precise. coarse_location is the only location that travels.

  • coarse_locationA member, signed in

    Requires show_location. ALWAYS VAGUE -- a city or a town, never a street. The precise columns (city, county, district) are never the source for this and never travel.

  • coppa_consent_atReaches no one

    Implies is_minor, so it leaks the same fact sideways.

  • countyReaches no one

    Precise, and in Illinois a county plus a first name is often one household. coarse_location is the only location that travels.

  • cover_urlA member, signed in

    A cover image is a public banner. Shown on a public profile; never in a list.

  • created_atReaches no one

    Account age orders people by seniority, and this product has no seniority. It is also a reliable correlation key.

  • display_nameA member, signed in

    The name the person chose to be called. Shown only on a profile they set to public, and never returned in a list a stranger can page through.

  • districtReaches no one

    A civic division is a public fact about a PLACE and a private one about a person -- pinning somebody to a district is pinning them to a few streets.

  • emailReaches no one

    The single most useful field for finding somebody elsewhere.

  • findable_by_membersReaches no one

    Same shape again. Returning it tells a stranger this person deliberately made themselves unfindable, which is a fact about them they did not publish — and it turns the one switch that protects them into a way of finding the people who used it.

  • first_nameA member, signed in

    The founder named this exactly: a stranger sees a first name. Not a surname, which is the difference between recognising a neighbour and being findable by an employer.

  • guardian_idReaches no one

    Links a child to an adult. Never leaves for the same reason.

  • handleA member, signed in

    The @ they bought or earned. It is a public address by design -- a handle nobody may look up is not a handle.

  • idA member, signed in

    needed to link to the profile at all; it is an opaque identifier

  • is_minorReaches no one

    Announcing which accounts belong to children is the exact opposite of protecting them.

  • political_identityReaches no one

    A person's politics, in a column. This is the field this whole project exists to refuse to publish, and there is no consent setting that turns it on -- there is not supposed to be.

  • profile_visibilityReaches no one

    Whether a profile is private is itself a fact about the person, and returning it tells a stranger there is something there to look for.

  • search_indexableReaches no one

    Same shape: a setting is a signal.

  • show_locationReaches no one

    Caught by the census below rather than by me, which is the point of having one. It is a setting, and a setting is a signal: returning it tells a stranger this person deliberately hid where they live, which is a fact about them they did not publish.

  • stateReaches no one

    Harmless alone and a powerful filter in bulk. The old list endpoint let a stranger filter every account by state, which is how a directory becomes a targeting list.

  • updated_atReaches no one

    Reveals when somebody was last active. Nobody needs that.

The switches are not built yet This page shows what the system holds and who can see it. The switches that would change it do not exist yet. A switch a person flips that does nothing is worse than no switch, because they would believe they had turned something off — so there are no switches here, and a_control_that_does_not_save() fails the build on a form, a change handler or any client state in the component.

We count these numbers from the code that hides your data. We do not keep a list by hand.

Your privacy

Nothing about you travels further than you chose, and every step outward is something you switched on.

This page lists every field this system holds about a person, who can see it, and whether any setting could ever make it visible.

The switches are not built yet.

This page shows what the system holds and who can see it. The switches themselves do not exist. We are not rendering toggles that do not save -- a switch you flip that does nothing is worse than no switch, because you would believe you had turned something off.

17

fields no setting publishes

4

off until you turn them on

4

a stranger can see

You cannot be searched for

There is no list of people in this product, for anyone. You reach a person through something they chose to publish -- a public post, a listing they filed, a comment they wrote -- and never through an index of everybody.

Without an account you cannot look people up at all. You can read what people chose to publish.

Who can look at all

anonymoussigned inthe person themselves

17 fields that never leave, whatever anybody switches

There is no setting that publishes these, because there is not supposed to be one. That includes your politics — the field this whole project exists to refuse to publish.

  • email

    The single most useful field for finding somebody elsewhere.

  • auth user id

    The identity-provider key. Correlates this account with every other system the person signed into.

  • political identity

    A person's politics, in a column. This is the field this whole project exists to refuse to publish, and there is no consent setting that turns it on -- there is not supposed to be.

  • city

    Precise. coarse_location is the only location that travels.

  • county

    Precise, and in Illinois a county plus a first name is often one household. coarse_location is the only location that travels.

  • district

    A civic division is a public fact about a PLACE and a private one about a person -- pinning somebody to a district is pinning them to a few streets.

  • state

    Harmless alone and a powerful filter in bulk. The old list endpoint let a stranger filter every account by state, which is how a directory becomes a targeting list.

  • is minor

    Announcing which accounts belong to children is the exact opposite of protecting them.

  • guardian id

    Links a child to an adult. Never leaves for the same reason.

  • coppa consent at

    Implies is_minor, so it leaks the same fact sideways.

  • audience role

    Which track somebody is on -- family, educator, adult. A guess at their household.

  • profile visibility

    Whether a profile is private is itself a fact about the person, and returning it tells a stranger there is something there to look for.

  • search indexable

    Same shape: a setting is a signal.

  • findable by members

    Same shape again. Returning it tells a stranger this person deliberately made themselves unfindable, which is a fact about them they did not publish — and it turns the one switch that protects them into a way of finding the people who used it.

  • show location

    Caught by the census below rather than by me, which is the point of having one. It is a setting, and a setting is a signal: returning it tells a stranger this person deliberately hid where they live, which is a fact about them they did not publish.

  • created at

    Account age orders people by seniority, and this product has no seniority. It is also a reliable correlation key.

  • updated at

    Reveals when somebody was last active. Nobody needs that.

Off until you turn them on

Every one of these starts off. Silence is never consent, and a location is always a city, a town or a region — never a street address, ever.

  • coarse location

    Requires show_location. ALWAYS VAGUE -- a city or a town, never a street. The precise columns (city, county, district) are never the source for this and never travel.

  • avatar url

    A picture of a person is a person. Shown on a public profile; never in a list.

  • cover url

    A cover image is a public banner. Shown on a public profile; never in a list.

  • bio

    Free text somebody wrote about themselves, which is exactly where people put the things that identify them. Public profile only.

What a stranger can see

A first name. Not a surname — that is the difference between recognising a neighbour and being findable by an employer.

  • id

    needed to link to the profile at all; it is an opaque identifier

  • first name

    The founder named this exactly: a stranger sees a first name. Not a surname, which is the difference between recognising a neighbour and being findable by an employer.

  • display name

    The name the person chose to be called. Shown only on a profile they set to public, and never returned in a list a stranger can page through.

  • handle

    The @ they bought or earned. It is a public address by design -- a handle nobody may look up is not a handle.

Search engines are a separate switch

false by default on users.search_indexable and posts.search_indexable, for everyone, forever. Being public IN THE APP and being indexed BY GOOGLE are different audiences, and the founder named them separately.

Why we serve noindex instead of blocking the crawler

Disallow says do not FETCH. noindex says do not LIST. A disallowed URL can still be indexed from inbound links, and because the crawler may not fetch it, it can never read the noindex that would remove it. Disallow on a page you want removed makes it permanent. Allow the crawl; serve noindex.

any feed
One URL carrying many people's choices. A robots directive is per URL, so one person opting in would publish their neighbours.
any session page
account, settings, saved, messenger. A crawler cannot see them and listing them only leaks the shape of the private surface.
any operational page
mission-control, founder-dashboard. Nothing a search result should ever point at.
a private profile
profile_visibility is not public, so there is nothing to index and the person did not ask.

We do not sell or share your personal information

Outpost does not sell your personal information, and does not share it for cross-context behavioral advertising — the two acts California's privacy law lets you opt out of. There is no opt-out link here because there is nothing to opt out of: no advertising SDK, no tracking pixel, no data broker relationship, and a standing rule (Track E) that forbids behavioral targeting, real-time bidding, and engagement-priced placement outright.

The Global Privacy Control

The Global Privacy Control is a signal your browser can send that says: do not sell or share my data. We honour it in the only honest way a no-sale platform can — the opt-out it requests is already permanently in effect for everyone, signal or no signal. This page shows whether your browser is sending it, so you can see the signal arrived.

Checking what your browser sends…

If Outpost ever began selling or sharing personal information, this section would have to change first, in public, and the build gate that pins these sentences would fail until it did. That is the guarantee: the notice cannot silently rot from true to false.

How long we keep it

Your own things are kept until you remove them. Nothing of yours is aged out by a clock while you are still using it. A clock exists only where you are gone, where the thing has its own end — a story's expiry, a campaign's deadline — or where the law asks for one.

53

Rules the code carries out

30

Decided, not yet built

0

Still awaiting a decision

What “not yet built” means. The rule is decided and the code that carries it out is not written yet. We say so table by table rather than letting the schedule imply a machine is doing something no machine does. Every one names the queue row that owes it.

Things you made

  • What you posted, as you wrote it.

    kept until the member deletes the post. No clock ages out a member's own thing while they still use it. On account deletion, 30 days (retention policy §5).

    Carried out by the code

  • What you wrote in reply under a post, and which reply you were answering.

    kept until the member deletes the comment; on account deletion, 30 days (retention policy §5).

    Carried out by the code

  • What you wrote in reply to somebody else.

    kept until the member deletes the comment; on account deletion, 30 days (retention policy §5). The live comment table is post_comments; this is its predecessor.

    Decided — the code for it is not written yet

  • Which mark you put on which post in the live feed. Itemised, like post_reactions, and carrying no weight anywhere.

    kept until the member removes the reaction, or the post it sits on is deleted; on account deletion, 30 days (retention policy §5).

    Carried out by the code

  • Which of the eight marks you put on which post. Itemised, and carrying no weight anywhere.

    kept until the member removes the reaction, or the post is deleted; on account deletion, 30 days (retention policy §5). The live table is reactions.

    Decided — the code for it is not written yet

  • Which posts you kept for later.

    kept until the member unsaves, or the post is deleted; on account deletion, 30 days (retention policy §5).

    Carried out by the code

  • What you saved to read later.

    kept until the member unsaves, or the post is deleted; on account deletion, 30 days (retention policy §5). The live table is saves.

    Decided — the code for it is not written yet

  • Any picture, video or audio you attached to a post: the file, its name, its size, its dimensions and the description you wrote for it. The row is keyed to your post rather than to you, and your post is yours.

    kept with the post it belongs to, and goes when the post goes.

    Carried out by the code

  • Any story you posted -- its text, its picture or clip, its caption, who you let see it, and the hour it expires.

    its own expires_at, or the member deletes it first — whichever comes first. Gone at expiry, by design.

    Carried out by the code

  • Which stories you opened, and when.

    kept with the story, and goes when the story goes.

    Carried out by the code

  • Any document you put in the reading room: its filename, its type, how many pages, where it is stored and what sensitivity it was labelled. It was listed as "government documents in the reading room" until 2026-09-08 — true of what most of them CONTAIN and false of the row, which carries owner_id. A filename is often the most revealing field in a table.

    kept until the member removes the document; with the account.

    Decided — the code for it is not written yet

  • Our log of loading each document you put in the reading room: when, how, and how it went. Your account is on the row as the person who loaded it.

    kept until the member removes the document it belongs to; with the account.

    Decided — the code for it is not written yet

Letters

  • Letters you wrote and letters written to you: the subject, the body, and when each was opened. The body is sealed at rest and only the two of you can read it; it is in your file because it is yours.

    each party deletes their own copy; the row goes when both have. On account deletion, the deleting party's side goes at 30 days and the other party keeps theirs.

    Decided — the code for it is not written yet

People you chose

  • Who you blocked, and when. Never shown to the person you blocked.

    kept until the member unblocks. Never shown to the person blocked, before or after.

    Carried out by the code

  • Who you muted, and when. Never shown to the person you muted.

    kept until the member unmutes. Never shown to the person muted.

    Carried out by the code

  • Who you asked to connect with, who asked you, and what each of you answered.

    answered, withdrawn, or the account goes. A declined request is not kept as a record against anyone [confirmed by the founder, 13 Sep].

    Carried out by the code

  • Who you are connected with. Your name is on the row from either side.

    kept until either party ends it; with either account.

    Carried out by the code

  • Who and what you chose to follow.

    kept until the member unfollows; with the account.

    Carried out by the code

  • Which groups you belong to, your role in each, and when you joined.

    kept until the member leaves, or is removed by a steward; with the account.

    Carried out by the code

  • Groups you asked to join, the answers you gave to their entry questions, and what was decided.

    decided or withdrawn; the answers to the entry questions go with the decision [confirmed by the founder, 13 Sep]; with the account.

    Carried out by the code

  • Any group you founded: its name, its purpose, its rules, its entry questions and who may see it. Joining one is separate and is listed under group_members.

    kept while the group exists; a group is its members' place, not a member's own thing, so no member's clock ends it.

    Decided — the code for it is not written yet

Campaigns and events

  • Any event you created: its title, its description, and the address you gave for it. Attending an event is separate and is listed under event_rsvps; ORGANISING one puts your account on the row and your chosen address in it, and some organisers use their own home.

    the campaign's timeline decides — continued (kept live), archived (kept, read-only) or deleted (gone), the organiser's choice at the deadline; archived by default after 30 days of silence [30 confirmed by the founder, 13 Sep]. Silence archives; it never deletes a campaign other people joined and never silently extends one.

    Decided — the code for it is not written yet

  • Which events you said you were coming to.

    kept until the member withdraws, or the event is archived or deleted. On an archived event the count stays and the names go [confirmed by the founder, 13 Sep].

    Decided — the code for it is not written yet

  • Events you help organise, and the role you were given on each.

    kept until the organiser removes the role, or the event ends its timeline.

    Decided — the code for it is not written yet

  • A milestone an organiser set on an event -- a target, a unit, a figure reached and a link to the evidence. It is keyed to the event, not to a person; the organiser's own account is on the event row, which is listed in your file under events.

    kept with the event, and goes when the event goes.

    Carried out by the code

  • A reminder scheduled against an event and an audience, not against a person. Nothing writes this table yet; if a reminder ever names who asked for it, it moves to your file.

    kept with the event, and goes when the event goes.

    Carried out by the code

  • Any petition you started: its title, its description and what it is aimed at. Signing one is separate and is listed under petition_signatures; starting one puts your account on the row.

    the petition's timeline decides, on the same rule as an event.

    Decided — the code for it is not written yet

  • Petitions you signed, with the name you signed under.

    kept with the petition's timeline, on the same rule as an RSVP.

    Decided — the code for it is not written yet

What you have learned

  • Which lessons you have finished.

    the learner's own record — kept until the learner clears it, or the account goes. A learner's history is theirs to keep, the same as a post.

    Carried out by the code

  • Your answers to lesson questions, and whether they were right.

    the learner's own record — kept until the learner clears it, or the account goes.

    Carried out by the code

  • Which pages you opened while signed in, so a course can pick up where you left off.

    the learner's own record — kept until the learner clears it, or the account goes.

    Carried out by the code

  • Which milestones you have reached.

    the learner's own record — kept until the learner clears it, or the account goes.

    Carried out by the code

  • Reading-level readings taken to pitch a lesson at you, and the date of each.

    the learner's own record — kept until the learner clears it, or the account goes.

    Carried out by the code

Listings

  • Listings you posted, as you wrote them.

    the listing's own expiry, or the member takes it down; with the account.

    Decided — the code for it is not written yet

  • Work you offered or asked for, in your own words. There is no wage figure in it because the board never stores one — only whether the pay is hourly, per job, unpaid or still to be agreed.

    the listing's own expiry, or the member takes it down; with the account.

    Decided — the code for it is not written yet

  • A business listing you submitted or claimed, including the email address, phone number and street address on it, anything you wrote in the note from the owner, how the claim was made and when. It was listed as being about a place rather than a person until 2026-09-08. A place does not have an email address; the person who claimed the listing does.

    the listing's own expiry, or the member takes it down; with the account.

    Decided — the code for it is not written yet

Email we send you

  • Your email address, if you gave it to a mailing list.

    kept until the person unsubscribes.

    Carried out by the code

  • Which lists you are on.

    kept until the person unsubscribes.

    Carried out by the code

  • Topics you TOLD us you were interested in. Never a topic we guessed.

    kept until the person unsubscribes.

    Carried out by the code

  • The one-click unsubscribe link issued to you.

    kept until the person unsubscribes; the token is marked used, never re-served.

    Carried out by the code

  • Which emails were sent to you, and when.

    three years.

    Carried out by the code

  • When you opted in or out, and from where — the record that proves we had your consent.

    there is no grace period and no scheduled job between their request and the erasure. F2 revised: 'on account deletion EVERYTHING goes -- suppression row, moderation action record, consent event included.' It was KEPT under the 2026-09-13 ruling, because a consent trail you cannot produce is a consent you did not have. Sole exception anywhere in this schedule: content already under a legally required report (18 U.S.C. 2258A -> NCMEC), preserved for the statutory period only.

    Carried out by the code

  • Your address, if you asked never to be emailed again. Kept precisely so the request is honoured.

    there is no grace period and no scheduled job between their request and the erasure. F2 revised: 'on account deletion EVERYTHING goes -- suppression row, moderation action record, consent event included.' It was KEPT under the 2026-09-13 ruling: 15 U.S.C. 7704(a)(4) and 16 C.F.R. 316 -- erase the row and the next campaign mails the person who asked not to be mailed. That reason has not stopped being true; he weighed it against a person's right to leave and ruled the other way. THE CONSEQUENCE IS FLAGGED FOR COUNSEL: somebody who unsubscribed and then deleted their account can be mailed again if their address re-enters a list from another source. Sole exception anywhere in this schedule: content already under a legally required report (18 U.S.C. 2258A -> NCMEC), preserved for the statutory period only.

    Carried out by the code

Reports, moderation and the record

  • Posts or people you reported, why, and what was decided.

    three years after the last action; the record of the ACTION is kept and the content is destroyed.

    Carried out by the code

  • Anything you flagged for review, and what a reviewer decided about it -- and, if something of yours was flagged, that fact and the decision.

    three years after the last action; the record of the ACTION is kept and the content is destroyed.

    Carried out by the code

  • A report you made, or a report about something of yours, as it moves through review: who reported, who reviewed, and the outcome.

    three years after the last action; the record of the ACTION is kept and the content is destroyed.

    Carried out by the code

  • Each action a reviewer took on a report that names you, with the reviewer's own account on it. Created 2026-09-12; nothing writes it yet.

    there is no grace period and no scheduled job between their request and the erasure. F2 revised: 'on account deletion EVERYTHING goes -- suppression row, moderation action record, consent event included.' It was KEPT under the 2026-09-13 ruling, because it holds no content and deleting it destroys the ability to answer who acted and when. Sole exception anywhere in this schedule: content already under a legally required report (18 U.S.C. 2258A -> NCMEC), preserved for the statutory period only.

    Carried out by the code

  • Errors you reported to us, and what we did about them.

    the correction itself is a permanent record — the ledger is the promise (retention policy §5). The reporter's email address is kept three years and no longer.

    Decided — the code for it is not written yet

  • Listings you reported, and why.

    three years after the last action.

    Carried out by the code

  • Job listings you reported, and why.

    three years after the last action.

    Carried out by the code

  • A role you hold here, if you hold one.

    kept — keeping is the protection. Who held what power, when, and who gave it; a general erasure right cannot reach it while the organisation exists.

    Carried out by the code

  • The two marks your profile can wear -- Founder (from the day you joined, never written down) and Founding Supporter (a named person's confirmation that you gave, with no amount and no payment detail anywhere) -- and your own choice of whether to show them.

    kept — keeping is the protection. A thank-you that is deleted becomes a person who was thanked and then unthanked; the member's display choice is theirs to change at any time.

    Carried out by the code

Your account

  • Your account: the name you chose, your email, when you joined, and your settings — including whether other members may find you by an exact handle or display name ("Let people find me", on by default for an adult, never for a child).

    Founder ruling B and F2 (revised), 2026-09-14, saved at docs/founder-rulings/2026-09-14-second-answers.md. Kept until the member deletes the account, and then erased IMMEDIATELY, on their word. This row promised a thirty-day grace period until that ruling withdrew it. The withdrawn wording is NOT quoted here on purpose: account_deletion_core.a_grace_period_came_back() scans real surfaces for it, and a scanner cannot tell a promise from a record of one -- so the record describes the old wording rather than reproducing it. The phrase itself is kept once, in that module, where the gate can see it is a constant and not a surface.

    Carried out by the code

A campaign you joined. If an organiser sets a deadline and then goes quiet for 30 days after it, their campaign is ARCHIVED and never deleted: the count of who came stays, the names do not, and nothing moves a deadline you were told about.

Whether a row was actually deleted. This describes the rule and the code in this repository; it does not read the database.

Why? 1 more
  • Whether the nightly job has run. The script exists (apps/api/scripts/retention_prune.py) and no cron runs it yet, so the rows it carries are kept by hand until one does. Every other period with a number on it has no mechanism at all and says so.

What this page cannot tell you

Whether the switches work, because they are not built. What is described here is what the code permits, not what a control panel currently does.

Why? 2 more
  • What another person has chosen. Their settings are theirs and this page describes the shape of the choice, not anybody's answer to it.
  • Anything about a business listing. A shop that listed itself gave an address on purpose so customers could arrive, and it is governed separately.

The rules behind all of this are at /standards, and where we stand on every governance document is at /governance.