Privacy hosting

Policy privacy versus architectural privacy

A privacy policy is a statement of intent that can be revised, and is revised, whenever business or legal circumstances change. It protects you exactly as long as the company finds it convenient. Architecture is different: a field that does not exist cannot be disclosed, revised into existence retroactively, or leaked in a breach.

Everything below is an architectural choice, which is why we can describe it as a schema rather than a promise.

• No identity columns exist in the account table — not nullable, absent.
• Access tokens are stored as Argon2id hashes; we cannot reproduce yours.
• Payment settles on-chain with no processor holding a fiat-linked record.
• LUKS2 passphrases are entered over console at first boot and never transit our systems.
• Resolvers run without query logging; no NetFlow anywhere on the edge.
• Snapshots are encrypted client-side with your key before leaving the host.

Where the boundary sits

We can control what we store and what our network observes. We cannot control your transport, your workload, or what your own software reports to third parties. A privacy-hosted server that runs an application phoning home with a licence key tied to your name is not private, and no hosting feature fixes that.

The honest framing is that we remove one entire category of exposure — the provider — and leave you responsible for the rest. Anyone claiming to solve the rest is selling.