What we hold about you
How far each thing travels
Every fact we keep about you sits at a distance. This page shows you that distance, from the outside in.
17/25
Never leaves your file
These stay with you. There is no switch that lets them out, because no switch was built.
Shown to no one at all
Not even to you. It is a key that links your sign-in, and a key is safest when nobody reads it.
auth_user_id
A stranger, not signed in
Cannot look people up. Without an account you cannot look people up at all. You can read what people chose to publish.
- If your profile is kept private
- Sees nothing at all.
- If your profile is public
- Sees nothing at all.
- If your profile is public, with your town shown
- Sees nothing at all.
A member, signed in
Can look people up. By exact handle or exact id only, and only for a profile its owner set to public. No partial matching, ever -- a fragment search over names is enumeration wearing a search box.
- If your profile is kept private
- Sees nothing at all.
- If your profile is public
- Can see 7
avatar_urlbiocover_urldisplay_namefirst_namehandleid
- If your profile is public, with your town shown
- Can see 8
avatar_urlbiocoarse_locationcover_urldisplay_namefirst_namehandleid
You
Can look people up. By exact handle or exact id only, and only for a profile its owner set to public. No partial matching, ever -- a fragment search over names is enumeration wearing a search box.
- If your profile is kept private
- Can see 24
audience_roleavatar_urlbiocitycoarse_locationcoppa_consent_atcountycover_urlcreated_atdisplay_namedistrictemailfindable_by_membersfirst_nameguardian_idhandleidis_minorpolitical_identityprofile_visibilitysearch_indexableshow_locationstateupdated_at
- If your profile is public
- Can see 24
audience_roleavatar_urlbiocitycoarse_locationcoppa_consent_atcountycover_urlcreated_atdisplay_namedistrictemailfindable_by_membersfirst_nameguardian_idhandleidis_minorpolitical_identityprofile_visibilitysearch_indexableshow_locationstateupdated_at
- If your profile is public, with your town shown
- Can see 24
audience_roleavatar_urlbiocitycoarse_locationcoppa_consent_atcountycover_urlcreated_atdisplay_namedistrictemailfindable_by_membersfirst_nameguardian_idhandleidis_minorpolitical_identityprofile_visibilitysearch_indexableshow_locationstateupdated_at
Every field, and who it reaches
audience_roleReaches no oneWhich track somebody is on -- family, educator, adult. A guess at their household.
auth_user_idReaches no oneThe identity-provider key. Correlates this account with every other system the person signed into.
avatar_urlA member, signed inA picture of a person is a person. Shown on a public profile; never in a list.
bioA member, signed inFree text somebody wrote about themselves, which is exactly where people put the things that identify them. Public profile only.
cityReaches no onePrecise. coarse_location is the only location that travels.
coarse_locationA member, signed inRequires show_location. ALWAYS VAGUE -- a city or a town, never a street. The precise columns (city, county, district) are never the source for this and never travel.
coppa_consent_atReaches no oneImplies is_minor, so it leaks the same fact sideways.
countyReaches no onePrecise, and in Illinois a county plus a first name is often one household. coarse_location is the only location that travels.
cover_urlA member, signed inA cover image is a public banner. Shown on a public profile; never in a list.
created_atReaches no oneAccount age orders people by seniority, and this product has no seniority. It is also a reliable correlation key.
display_nameA member, signed inThe name the person chose to be called. Shown only on a profile they set to public, and never returned in a list a stranger can page through.
districtReaches no oneA civic division is a public fact about a PLACE and a private one about a person -- pinning somebody to a district is pinning them to a few streets.
emailReaches no oneThe single most useful field for finding somebody elsewhere.
findable_by_membersReaches no oneSame shape again. Returning it tells a stranger this person deliberately made themselves unfindable, which is a fact about them they did not publish — and it turns the one switch that protects them into a way of finding the people who used it.
first_nameA member, signed inThe founder named this exactly: a stranger sees a first name. Not a surname, which is the difference between recognising a neighbour and being findable by an employer.
guardian_idReaches no oneLinks a child to an adult. Never leaves for the same reason.
handleA member, signed inThe @ they bought or earned. It is a public address by design -- a handle nobody may look up is not a handle.
idA member, signed inneeded to link to the profile at all; it is an opaque identifier
is_minorReaches no oneAnnouncing which accounts belong to children is the exact opposite of protecting them.
political_identityReaches no oneA person's politics, in a column. This is the field this whole project exists to refuse to publish, and there is no consent setting that turns it on -- there is not supposed to be.
profile_visibilityReaches no oneWhether a profile is private is itself a fact about the person, and returning it tells a stranger there is something there to look for.
search_indexableReaches no oneSame shape: a setting is a signal.
show_locationReaches no oneCaught by the census below rather than by me, which is the point of having one. It is a setting, and a setting is a signal: returning it tells a stranger this person deliberately hid where they live, which is a fact about them they did not publish.
stateReaches no oneHarmless alone and a powerful filter in bulk. The old list endpoint let a stranger filter every account by state, which is how a directory becomes a targeting list.
updated_atReaches no oneReveals when somebody was last active. Nobody needs that.
The switches are not built yet This page shows what the system holds and who can see it. The switches that would change it do not exist yet. A switch a person flips that does nothing is worse than no switch, because they would believe they had turned something off — so there are no switches here, and a_control_that_does_not_save() fails the build on a form, a change handler or any client state in the component.
We count these numbers from the code that hides your data. We do not keep a list by hand.
Your privacy
Nothing about you travels further than you chose, and every step outward is something you switched on.
This page lists every field this system holds about a person, who can see it, and whether any setting could ever make it visible.
The switches are not built yet.
This page shows what the system holds and who can see it. The switches themselves do not exist. We are not rendering toggles that do not save -- a switch you flip that does nothing is worse than no switch, because you would believe you had turned something off.
17
fields no setting publishes
4
off until you turn them on
4
a stranger can see
You cannot be searched for
There is no list of people in this product, for anyone. You reach a person through something they chose to publish -- a public post, a listing they filed, a comment they wrote -- and never through an index of everybody.
Without an account you cannot look people up at all. You can read what people chose to publish.
Who can look at all
anonymoussigned inthe person themselves
17 fields that never leave, whatever anybody switches
There is no setting that publishes these, because there is not supposed to be one. That includes your politics — the field this whole project exists to refuse to publish.
email
The single most useful field for finding somebody elsewhere.
auth user id
The identity-provider key. Correlates this account with every other system the person signed into.
political identity
A person's politics, in a column. This is the field this whole project exists to refuse to publish, and there is no consent setting that turns it on -- there is not supposed to be.
city
Precise. coarse_location is the only location that travels.
county
Precise, and in Illinois a county plus a first name is often one household. coarse_location is the only location that travels.
district
A civic division is a public fact about a PLACE and a private one about a person -- pinning somebody to a district is pinning them to a few streets.
state
Harmless alone and a powerful filter in bulk. The old list endpoint let a stranger filter every account by state, which is how a directory becomes a targeting list.
is minor
Announcing which accounts belong to children is the exact opposite of protecting them.
guardian id
Links a child to an adult. Never leaves for the same reason.
coppa consent at
Implies is_minor, so it leaks the same fact sideways.
audience role
Which track somebody is on -- family, educator, adult. A guess at their household.
profile visibility
Whether a profile is private is itself a fact about the person, and returning it tells a stranger there is something there to look for.
search indexable
Same shape: a setting is a signal.
findable by members
Same shape again. Returning it tells a stranger this person deliberately made themselves unfindable, which is a fact about them they did not publish — and it turns the one switch that protects them into a way of finding the people who used it.
show location
Caught by the census below rather than by me, which is the point of having one. It is a setting, and a setting is a signal: returning it tells a stranger this person deliberately hid where they live, which is a fact about them they did not publish.
created at
Account age orders people by seniority, and this product has no seniority. It is also a reliable correlation key.
updated at
Reveals when somebody was last active. Nobody needs that.
Off until you turn them on
Every one of these starts off. Silence is never consent, and a location is always a city, a town or a region — never a street address, ever.
coarse location
Requires show_location. ALWAYS VAGUE -- a city or a town, never a street. The precise columns (city, county, district) are never the source for this and never travel.
avatar url
A picture of a person is a person. Shown on a public profile; never in a list.
cover url
A cover image is a public banner. Shown on a public profile; never in a list.
bio
Free text somebody wrote about themselves, which is exactly where people put the things that identify them. Public profile only.
What a stranger can see
A first name. Not a surname — that is the difference between recognising a neighbour and being findable by an employer.
id
needed to link to the profile at all; it is an opaque identifier
first name
The founder named this exactly: a stranger sees a first name. Not a surname, which is the difference between recognising a neighbour and being findable by an employer.
display name
The name the person chose to be called. Shown only on a profile they set to public, and never returned in a list a stranger can page through.
handle
The @ they bought or earned. It is a public address by design -- a handle nobody may look up is not a handle.
Search engines are a separate switch
false by default on users.search_indexable and posts.search_indexable, for everyone, forever. Being public IN THE APP and being indexed BY GOOGLE are different audiences, and the founder named them separately.
Why we serve noindex instead of blocking the crawler
Disallow says do not FETCH. noindex says do not LIST. A disallowed URL can still be indexed from inbound links, and because the crawler may not fetch it, it can never read the noindex that would remove it. Disallow on a page you want removed makes it permanent. Allow the crawl; serve noindex.
- any feed
- One URL carrying many people's choices. A robots directive is per URL, so one person opting in would publish their neighbours.
- any session page
- account, settings, saved, messenger. A crawler cannot see them and listing them only leaks the shape of the private surface.
- any operational page
- mission-control, founder-dashboard. Nothing a search result should ever point at.
- a private profile
- profile_visibility is not public, so there is nothing to index and the person did not ask.
We do not sell or share your personal information
Outpost does not sell your personal information, and does not share it for cross-context behavioral advertising — the two acts California's privacy law lets you opt out of. There is no opt-out link here because there is nothing to opt out of: no advertising SDK, no tracking pixel, no data broker relationship, and a standing rule (Track E) that forbids behavioral targeting, real-time bidding, and engagement-priced placement outright.
The Global Privacy Control
The Global Privacy Control is a signal your browser can send that says: do not sell or share my data. We honour it in the only honest way a no-sale platform can — the opt-out it requests is already permanently in effect for everyone, signal or no signal. This page shows whether your browser is sending it, so you can see the signal arrived.
Checking what your browser sends…
If Outpost ever began selling or sharing personal information, this section would have to change first, in public, and the build gate that pins these sentences would fail until it did. That is the guarantee: the notice cannot silently rot from true to false.
How long we keep it
Your own things are kept until you remove them. Nothing of yours is aged out by a clock while you are still using it. A clock exists only where you are gone, where the thing has its own end — a story's expiry, a campaign's deadline — or where the law asks for one.
53
Rules the code carries out
30
Decided, not yet built
0
Still awaiting a decision
What “not yet built” means. The rule is decided and the code that carries it out is not written yet. We say so table by table rather than letting the schedule imply a machine is doing something no machine does. Every one names the queue row that owes it.
Things you made
What you posted, as you wrote it.
kept until the member deletes the post. No clock ages out a member's own thing while they still use it. On account deletion, 30 days (retention policy §5).
Carried out by the code
What you wrote in reply under a post, and which reply you were answering.
kept until the member deletes the comment; on account deletion, 30 days (retention policy §5).
Carried out by the code
What you wrote in reply to somebody else.
kept until the member deletes the comment; on account deletion, 30 days (retention policy §5). The live comment table is post_comments; this is its predecessor.
Decided — the code for it is not written yet
Which mark you put on which post in the live feed. Itemised, like post_reactions, and carrying no weight anywhere.
kept until the member removes the reaction, or the post it sits on is deleted; on account deletion, 30 days (retention policy §5).
Carried out by the code
Which of the eight marks you put on which post. Itemised, and carrying no weight anywhere.
kept until the member removes the reaction, or the post is deleted; on account deletion, 30 days (retention policy §5). The live table is reactions.
Decided — the code for it is not written yet
Which posts you kept for later.
kept until the member unsaves, or the post is deleted; on account deletion, 30 days (retention policy §5).
Carried out by the code
What you saved to read later.
kept until the member unsaves, or the post is deleted; on account deletion, 30 days (retention policy §5). The live table is saves.
Decided — the code for it is not written yet
Any picture, video or audio you attached to a post: the file, its name, its size, its dimensions and the description you wrote for it. The row is keyed to your post rather than to you, and your post is yours.
kept with the post it belongs to, and goes when the post goes.
Carried out by the code
Any story you posted -- its text, its picture or clip, its caption, who you let see it, and the hour it expires.
its own expires_at, or the member deletes it first — whichever comes first. Gone at expiry, by design.
Carried out by the code
Which stories you opened, and when.
kept with the story, and goes when the story goes.
Carried out by the code
Any document you put in the reading room: its filename, its type, how many pages, where it is stored and what sensitivity it was labelled. It was listed as "government documents in the reading room" until 2026-09-08 — true of what most of them CONTAIN and false of the row, which carries owner_id. A filename is often the most revealing field in a table.
kept until the member removes the document; with the account.
Decided — the code for it is not written yet
Our log of loading each document you put in the reading room: when, how, and how it went. Your account is on the row as the person who loaded it.
kept until the member removes the document it belongs to; with the account.
Decided — the code for it is not written yet
Letters
Letters you wrote and letters written to you: the subject, the body, and when each was opened. The body is sealed at rest and only the two of you can read it; it is in your file because it is yours.
each party deletes their own copy; the row goes when both have. On account deletion, the deleting party's side goes at 30 days and the other party keeps theirs.
Decided — the code for it is not written yet
People you chose
Who you blocked, and when. Never shown to the person you blocked.
kept until the member unblocks. Never shown to the person blocked, before or after.
Carried out by the code
Who you muted, and when. Never shown to the person you muted.
kept until the member unmutes. Never shown to the person muted.
Carried out by the code
Who you asked to connect with, who asked you, and what each of you answered.
answered, withdrawn, or the account goes. A declined request is not kept as a record against anyone [confirmed by the founder, 13 Sep].
Carried out by the code
Who you are connected with. Your name is on the row from either side.
kept until either party ends it; with either account.
Carried out by the code
Who and what you chose to follow.
kept until the member unfollows; with the account.
Carried out by the code
Which groups you belong to, your role in each, and when you joined.
kept until the member leaves, or is removed by a steward; with the account.
Carried out by the code
Groups you asked to join, the answers you gave to their entry questions, and what was decided.
decided or withdrawn; the answers to the entry questions go with the decision [confirmed by the founder, 13 Sep]; with the account.
Carried out by the code
Any group you founded: its name, its purpose, its rules, its entry questions and who may see it. Joining one is separate and is listed under group_members.
kept while the group exists; a group is its members' place, not a member's own thing, so no member's clock ends it.
Decided — the code for it is not written yet
Campaigns and events
Any event you created: its title, its description, and the address you gave for it. Attending an event is separate and is listed under event_rsvps; ORGANISING one puts your account on the row and your chosen address in it, and some organisers use their own home.
the campaign's timeline decides — continued (kept live), archived (kept, read-only) or deleted (gone), the organiser's choice at the deadline; archived by default after 30 days of silence [30 confirmed by the founder, 13 Sep]. Silence archives; it never deletes a campaign other people joined and never silently extends one.
Decided — the code for it is not written yet
Which events you said you were coming to.
kept until the member withdraws, or the event is archived or deleted. On an archived event the count stays and the names go [confirmed by the founder, 13 Sep].
Decided — the code for it is not written yet
Events you help organise, and the role you were given on each.
kept until the organiser removes the role, or the event ends its timeline.
Decided — the code for it is not written yet
A milestone an organiser set on an event -- a target, a unit, a figure reached and a link to the evidence. It is keyed to the event, not to a person; the organiser's own account is on the event row, which is listed in your file under events.
kept with the event, and goes when the event goes.
Carried out by the code
A reminder scheduled against an event and an audience, not against a person. Nothing writes this table yet; if a reminder ever names who asked for it, it moves to your file.
kept with the event, and goes when the event goes.
Carried out by the code
Any petition you started: its title, its description and what it is aimed at. Signing one is separate and is listed under petition_signatures; starting one puts your account on the row.
the petition's timeline decides, on the same rule as an event.
Decided — the code for it is not written yet
Petitions you signed, with the name you signed under.
kept with the petition's timeline, on the same rule as an RSVP.
Decided — the code for it is not written yet
What you have learned
Which lessons you have finished.
the learner's own record — kept until the learner clears it, or the account goes. A learner's history is theirs to keep, the same as a post.
Carried out by the code
Your answers to lesson questions, and whether they were right.
the learner's own record — kept until the learner clears it, or the account goes.
Carried out by the code
Which pages you opened while signed in, so a course can pick up where you left off.
the learner's own record — kept until the learner clears it, or the account goes.
Carried out by the code
Which milestones you have reached.
the learner's own record — kept until the learner clears it, or the account goes.
Carried out by the code
Reading-level readings taken to pitch a lesson at you, and the date of each.
the learner's own record — kept until the learner clears it, or the account goes.
Carried out by the code
Listings
Listings you posted, as you wrote them.
the listing's own expiry, or the member takes it down; with the account.
Decided — the code for it is not written yet
Work you offered or asked for, in your own words. There is no wage figure in it because the board never stores one — only whether the pay is hourly, per job, unpaid or still to be agreed.
the listing's own expiry, or the member takes it down; with the account.
Decided — the code for it is not written yet
A business listing you submitted or claimed, including the email address, phone number and street address on it, anything you wrote in the note from the owner, how the claim was made and when. It was listed as being about a place rather than a person until 2026-09-08. A place does not have an email address; the person who claimed the listing does.
the listing's own expiry, or the member takes it down; with the account.
Decided — the code for it is not written yet
Email we send you
Your email address, if you gave it to a mailing list.
kept until the person unsubscribes.
Carried out by the code
Which lists you are on.
kept until the person unsubscribes.
Carried out by the code
Topics you TOLD us you were interested in. Never a topic we guessed.
kept until the person unsubscribes.
Carried out by the code
The one-click unsubscribe link issued to you.
kept until the person unsubscribes; the token is marked used, never re-served.
Carried out by the code
Which emails were sent to you, and when.
three years.
Carried out by the code
When you opted in or out, and from where — the record that proves we had your consent.
there is no grace period and no scheduled job between their request and the erasure. F2 revised: 'on account deletion EVERYTHING goes -- suppression row, moderation action record, consent event included.' It was KEPT under the 2026-09-13 ruling, because a consent trail you cannot produce is a consent you did not have. Sole exception anywhere in this schedule: content already under a legally required report (18 U.S.C. 2258A -> NCMEC), preserved for the statutory period only.
Carried out by the code
Your address, if you asked never to be emailed again. Kept precisely so the request is honoured.
there is no grace period and no scheduled job between their request and the erasure. F2 revised: 'on account deletion EVERYTHING goes -- suppression row, moderation action record, consent event included.' It was KEPT under the 2026-09-13 ruling: 15 U.S.C. 7704(a)(4) and 16 C.F.R. 316 -- erase the row and the next campaign mails the person who asked not to be mailed. That reason has not stopped being true; he weighed it against a person's right to leave and ruled the other way. THE CONSEQUENCE IS FLAGGED FOR COUNSEL: somebody who unsubscribed and then deleted their account can be mailed again if their address re-enters a list from another source. Sole exception anywhere in this schedule: content already under a legally required report (18 U.S.C. 2258A -> NCMEC), preserved for the statutory period only.
Carried out by the code
Reports, moderation and the record
Posts or people you reported, why, and what was decided.
three years after the last action; the record of the ACTION is kept and the content is destroyed.
Carried out by the code
Anything you flagged for review, and what a reviewer decided about it -- and, if something of yours was flagged, that fact and the decision.
three years after the last action; the record of the ACTION is kept and the content is destroyed.
Carried out by the code
A report you made, or a report about something of yours, as it moves through review: who reported, who reviewed, and the outcome.
three years after the last action; the record of the ACTION is kept and the content is destroyed.
Carried out by the code
Each action a reviewer took on a report that names you, with the reviewer's own account on it. Created 2026-09-12; nothing writes it yet.
there is no grace period and no scheduled job between their request and the erasure. F2 revised: 'on account deletion EVERYTHING goes -- suppression row, moderation action record, consent event included.' It was KEPT under the 2026-09-13 ruling, because it holds no content and deleting it destroys the ability to answer who acted and when. Sole exception anywhere in this schedule: content already under a legally required report (18 U.S.C. 2258A -> NCMEC), preserved for the statutory period only.
Carried out by the code
Errors you reported to us, and what we did about them.
the correction itself is a permanent record — the ledger is the promise (retention policy §5). The reporter's email address is kept three years and no longer.
Decided — the code for it is not written yet
Listings you reported, and why.
three years after the last action.
Carried out by the code
Job listings you reported, and why.
three years after the last action.
Carried out by the code
A role you hold here, if you hold one.
kept — keeping is the protection. Who held what power, when, and who gave it; a general erasure right cannot reach it while the organisation exists.
Carried out by the code
The two marks your profile can wear -- Founder (from the day you joined, never written down) and Founding Supporter (a named person's confirmation that you gave, with no amount and no payment detail anywhere) -- and your own choice of whether to show them.
kept — keeping is the protection. A thank-you that is deleted becomes a person who was thanked and then unthanked; the member's display choice is theirs to change at any time.
Carried out by the code
Your account
Your account: the name you chose, your email, when you joined, and your settings — including whether other members may find you by an exact handle or display name ("Let people find me", on by default for an adult, never for a child).
Founder ruling B and F2 (revised), 2026-09-14, saved at docs/founder-rulings/2026-09-14-second-answers.md. Kept until the member deletes the account, and then erased IMMEDIATELY, on their word. This row promised a thirty-day grace period until that ruling withdrew it. The withdrawn wording is NOT quoted here on purpose: account_deletion_core.a_grace_period_came_back() scans real surfaces for it, and a scanner cannot tell a promise from a record of one -- so the record describes the old wording rather than reproducing it. The phrase itself is kept once, in that module, where the gate can see it is a constant and not a surface.
Carried out by the code
A campaign you joined. If an organiser sets a deadline and then goes quiet for 30 days after it, their campaign is ARCHIVED and never deleted: the count of who came stays, the names do not, and nothing moves a deadline you were told about.
Whether a row was actually deleted. This describes the rule and the code in this repository; it does not read the database.
Why? 1 more
- Whether the nightly job has run. The script exists (apps/api/scripts/retention_prune.py) and no cron runs it yet, so the rows it carries are kept by hand until one does. Every other period with a number on it has no mechanism at all and says so.
What this page cannot tell you
Whether the switches work, because they are not built. What is described here is what the code permits, not what a control panel currently does.
Why? 2 more
- What another person has chosen. Their settings are theirs and this page describes the shape of the choice, not anybody's answer to it.
- Anything about a business listing. A shop that listed itself gave an address on purpose so customers could arrive, and it is governed separately.
The rules behind all of this are at /standards, and where we stand on every governance document is at /governance.
