Nobody can trace a note back to you

You are about to write something you have not said to anyone. It is reasonable to want to know exactly what happens to it. This is the technical answer, and the last section is the one that matters most.

What we never ask for

No account. No email address. No username, no password, no phone number, no verification of any kind. There is no sign-up because there is nothing to sign up to. Nothing on this site knows a name, because no field on this site ever asks for one.

What a note actually is

In the database, a planted note is six columns and nothing else:

• a random identifier
• its position in the spiral
• the text you wrote
• when it was planted
• how many people have reported it
• an author fingerprint — see below

There is no column for a name, a device, a session, a browser or a location. Not empty ones: they do not exist.

Your IP address, and what happens to it

Every connection on the internet carries an IP address. We cannot not receive yours — it is how the answer finds its way back. What matters is what happens next, and what happens next is that it is never written down.

First it is reduced. An IPv6 address is cut to its /64 prefix, the block your provider hands your home, so the eighteen quintillion addresses you could rotate through collapse into one. Then it goes through HMAC-SHA256 with a secret key, and we keep the first 32 hexadecimal characters. That string is the fingerprint. The address itself never reaches the database.

The secret key is the part that does the work, and it is worth being concrete about why. There are only about 4.3 billion IPv4 addresses. A plain SHA-256 of every single one can be computed on a laptop over a lunch break, giving a lookup table from hash back to address. That table is useless here: without the key, the fingerprint of your address is not a value anywhere in it. The key lives in the server's environment, not in the database. Someone who walked off with a copy of the database would not have it.

And then it is deleted

The fingerprint exists for exactly one job: the rate limits, which look back three minutes and one day. Past that it is risk with no purpose. So it is wiped, on every plant:

update notes set author_hash = ''
 where author_hash <> ''
   and created_at < now() - interval '2 days'

Two days rather than one, because the daily limit counts back exactly 24 hours and a clock disagreeing with itself at the boundary should not hand anyone a free note.

After two days the fingerprint on your note is an empty string. The database cannot say that your note and another came from the same place — not because we promise not to look, but because the value is gone.

What your browser keeps

Four things, all on your device, none of them ever sent to us: whether you have seen the welcome card, the language you chose, when your planting cooldown ends, and the list of notes you have reported.

That last one is deliberate. Keeping it on your side is what lets us not remember, for you, which notes you objected to. And there are no cookies at all — this site sets none, in any circumstance.

Nothing from anyone else

No analytics. No tracking pixel. No fonts loaded from another company's server. Nothing embedded. The Content-Security-Policy this site sends with every page refuses to load scripts, styles, images, fonts or connections from anywhere except this domain. The share buttons reach WhatsApp, X or Facebook only at the moment you press one.

What we cannot promise

Everything above is worth exactly as much as this section is honest, so here it is without softening.

• Your internet provider knows you connected here. Nothing built on this side can change that.
• The site runs on Vercel and the database on Supabase. Both see traffic in transit and both keep their own operational logs, on their own terms and outside our control. That is a property of putting anything on the internet, not a decision of ours.
• For up to two days the fingerprint exists. Someone holding the database and the secret key and a specific address to test could confirm a guess. Confirm, not discover — they would have to already suspect you.
• If what you write identifies you, none of this helps. The text is public and permanent, and notes are not removed on request: that is the same promise that keeps every other note standing.
• This is not Tor. If you are in a situation where being linked to what you write would be genuinely dangerous, use tools built for that, not a website about trees.

How to check any of this yourself

Right now, in this browser. Open your developer tools: under Cookies you will find nothing at all, and under Local Storage exactly the four keys named above. Switch to the Network tab and reload the page — every single request goes to this domain and nowhere else.

The strongest thing on this page is not a promise. It is that after two days there is nothing left to promise about.