Privacy you can check in the page source.
Privacy policies describe intentions. Page source describes behavior. Here is the behavior, stated so an engineer could refute it if it were false.
The honest boundary, first
Only Whisper DMs are end-to-end encrypted. Public posts, notes, media and mail are server-side data — protected, but visible to operators by necessity of search and rendering. We won't claim otherwise. The accurate sentence is the one we print: Your DMs are end-to-end encrypted. Your posts are yours — not tracked, not sold, not trained on.
What we don't load
No Google Analytics. No Meta pixel. No Sentry. No third-party CDN, no font CDN, no cookie-consent theater because there are no third-party cookies to consent to. The only external service in the stack is the payment processor — card processing requires exactly that, and nothing else does.
What we run instead
The stack is self-hosted on hardware we own: mail (JMAP), object storage (S3-compatible), search, translation, classification, and the AI models themselves. When Chart drafts a diagram or translation renders your posts in 55 languages, the inference happens on our GPUs — your content is not sent to a third-party AI provider's training pipeline.
The three claims that matter
Your encrypted messages are unreadable by us
Whisper encrypts client-side with X25519 (nacl.box); the server stores and relays ciphertext only. This is the same class of design as Signal's — unlike every mainstream social DM.
Even the backup key is zero-knowledge
The secret key is wrapped in your browser with an Argon2id-derived key and stored as opaque ciphertext. Forget your passphrase and your 128-bit recovery code, and the messages are unrecoverable — for everyone. Architecturally, we don't hold the keys.
Paid content can't leak, because it's never sent
Paywalled blocks are stripped server-side from anonymous responses — the body never ships to non-subscribers and unlock logic fails closed. On most platforms, "subscriber-only" is a CSS overlay you can defeat with devtools.
Your data has an exit
Open standards throughout: SAML 2.0 / OIDC sign-on, JMAP mail that works in standard clients, two-way CalDAV calendar sync, bookmarks import/export, notes export to EPUB 3.3 and PDF with BibTeX/RIS/Zotero bibliographies, CSV contacts. Account deletion cascades a true hard delete.
Speed is a privacy side-effect
This site is static HTML and one stylesheet: no framework runtime, no third-party JS, system fonts. It renders before you finish a sentence. Core Web Vitals aren't a growth hack here — they're what's left when you refuse to load someone else's script. The apps run on the same principle: self-hosted, no third-party JS.
Come for the privacy; stay because the suite works.
Self-service registration. No waitlist, no credit card, no trial clock.
Your public profile lives at me.peopoli.com/@yourname