Privacy

This website

This website has no analytics and no cookies, and it makes no requests to anybody else's server of any kind. That includes webfonts, because a hosted font is a request to somebody else's server that carries your IP address and the page you were reading, and I did not want a site whose apps promise to send nothing to open by quietly sending something.

The site is made of static files, with no code running on a server behind it and no database, so there is nothing that could hold a record of your visit even in principle.

Access logsA CDN is a network of computers spread around the world, each keeping a copy of this site so that it loads from somewhere near you rather than from one machine in one country, and the one this site uses is Amazon CloudFront.Every time your browser asks one of those computers for a page, that computer can write a line in a file about the request, recording the address your internet connection is using (which is roughly where you are, and often who your provider is), the date and time, which page you asked for, which browser and version you used, and which page you came from, so that a link from somewhere else names that somewhere. That file is the access log, and it is switched on by default almost everywhere, and most sites keep one without ever mentioning it.Sites that do mention it usually say that their logs are minimised or rotated rather than switched off. Minimised means the line is still written but with fewer details in it, or with the last part of your address blanked out, and rotated means the line is written, kept for thirty or ninety days, and then deleted. In both cases a record of you is made first and its consequences are managed afterwards.Switched off means the line is never written at all, so there is no file that could be leaked, handed over on demand, sold if the money runs out, or forgotten about and left somewhere for years, and nobody can look up who read what, including me. The cost is that I cannot tell you how many people have visited this site, because I have not kept that information. for this site are switched off at the CDN, which means they are not minimised or rotated but never written in the first place. You can hover over or tap the underlined words for an explanation of what that means.

The apps

I build every app as a flat file wherever that is possible, which is almost everywhere. A flat file is one that your browser opens and runs by itself without needing anything from a server, and every app published so far is one. A few of the apps I am planning cannot work that way, because their purpose is to connect people for talking to each other, organising and the like, and those will have a server. What applies to them is further down this page, and for the flat-file apps the promises are simpler, since there is no server to make promises about.

The flat-file apps collect nothing, whether that is a name, an age, a birthday, a photograph, a location or anything from the microphone, and they send nothing anywhere. Most of them are a single file that makes no network requests at all, runs from a disk, and works with the network unplugged. A few larger apps, where a single file would make them worse, are served here as a small set of files that load their own pieces from this site and from nowhere else, and the browser is told to refuse any other connection, so it cannot open one of any kind. Each of those also comes as a single file that runs offline, for anyone who would rather use it that way or wants to check it.

The only thing the apps store is a count of the minutes they have been used in the last hour, so that the app can show you that figure and you are not left guessing. It is one number kept in your own browser and shared between the apps, with no identifier attached to it. It never leaves your device, nobody else can see it, and clearing your browser data deletes it. None of the flat-file apps have accounts, and since none of this information is gathered in the first place, there is nothing here to sell, share or broker.

Apps that need a server

Where an app has a server, all of its code will be public, including the part that runs on the server, so that anyone can read what it stores, how long it keeps it, and who can see it. Each of those apps will also say this plainly on its own page before anybody uses it. The server will store as little as the app can work with, and it will not send anything to anybody else's server, which rules out analytics, advertising, and outside services watching how people use it.

There is a limit to this that people should know about. With a flat file you can check everything yourself, because the file you read is the file that runs, but with a server you can read the code and still not be able to see from outside that the machine is running exactly that code. That part needs some trust, which is why I use flat files first and a server only where an app cannot do its job without one.

Checking it yourself, with an A.I.

You should not have to be a programmer to find out whether an app is doing something to your child, and there is now a way to check that takes a couple of minutes. Save the app file, paste it into whatever A.I. assistant you already have access to, and ask it what the app does, whether it sends anything anywhere, whether it keeps anything about the person using it, and whether it tries to keep them using it for longer, and ask it to look for network requests specifically. The answer should be that there are none, and if you get a different answer I would like to hear about it.

An A.I. can be wrong or miss something, so this is a check rather than a proof, and it counts for more when several people do it separately than when one person does it once. It works here mainly because each app is, or also comes as, a single file, and it will work much less well on a large commercial app. I would like this to become a normal thing for parents to do, with other people's apps as much as with mine.

When something does need an account

There will be no accounts unless an app cannot do its job without one. The children's apps are not in that category and never will be, and they ask for nothing at all.

Where an account is necessary it will be as anonymous as I can make it, and the code for that app will be public so that anybody can audit it and see what is stored. The exception is any app with a community, a chat, or people talking to each other, which will need a trusted institution or a business email address to sign up, with a reasonable limit on accounts per institution, so that one compromised account does not open the door to others.

A social app is the hardest of these to keep on mission, and I would rather say so now than find it out later. The values compete with each other, security against privacy and accountability against anonymity, and since the purpose of the account is to keep out bad actors and trolls, it costs some of the anonymity promised elsewhere on this page. The code for those apps will be public and auditable too.

Why it is written this way

Privacy policies tend to say "we take your privacy seriously" when the real answer is complicated, and the answer here is short enough that you can check it yourself. Every flat-file app is, or also comes as, a single HTML file, so you can open one in a text editor and search it for a URL, or open your browser's network tab while the app runs and watch it stay empty. That is a better guarantee than anything written on this page, because it does not ask you to take my word for anything.

The promise is enforced, not just written

Every page on this site is served with a content security policy, a set of rules that your browser applies to the page whether I like it or not, and part of it reads connect-src 'none'. That rule forbids every kind of outgoing request a page can make (fetch, XMLHttpRequest, WebSocket and sendBeacon), and it is not a setting I can quietly switch off on one page, so it applies to the apps as much as to this text. An app with a server will have one exception to it, allowing its page to connect to its own server and to nothing else, and that part of its policy will be published along with the rest of its code.

What this means in practice is that if some future edit here introduced a tracker by accident, the tracker would fail rather than send anything. I think that is a more useful promise than saying I would never add one, because it does not depend on me keeping my word. The same policy also denies the page any access to your location, camera and microphone, and to the browser's built-in payment and advertising-interest features, and, as described above, access logs are switched off at the CDN.

How to reach me

Anything sent to an address at prosocial-apps.org reaches me. Mail sent there is forwarded to a private inbox, and it is not published, added to a mailing list, or used for anything except replying. The one exception is suggestions for apps, which I may describe in public in my own words, without naming who sent them, as the suggestions page explains.