Your data

Plainly, in the order it matters: what is kept, where it lives, who can see it, and how to get rid of it.

If you have not made an account

Choosing Try it now gives you a working timeline that never leaves your browser. It is held in that browser's own storage, on your own device. No account is created, no record of it exists on our side, and nobody else can reach it — not even us.

The flip side is that it is only as durable as that browser. Clearing your site data, using private browsing, or switching to another device will lose it. That is what the banner along the top is warning you about. Creating an account copies the timeline to the server, and only then is the local copy cleared.

If you have made an account

Then we store, and only store:

• Your email address — to sign you in and to recover your account. It is never shown publicly and never shared.
• Your username — shown as the author on any timeline you publish. It does not have to be your real name, and we would rather it wasn't.
• Your password, as a hash — see below.
• Your timelines — the title, description, and for every event its dates, tolerance, color, row, notes, anchors and links.
• Sign-in sessions — a random token per browser you are signed in on, valid for thirty days.

That is the whole list. There is no analytics, no tracking, no advertising, no third-party scripts of any kind. Nothing on this site calls out to anyone else's server. We do not build a profile of you, and there is nothing to sell.

Your password

Stored as a PBKDF2-HMAC-SHA256 hash: 100,000 iterations with a random salt for each account. Passwords are never written down in a form anyone can read, ourselves included. If you lose yours, nobody can look it up — a reset link is the only route back in, which is why confirming your email address is worth doing.

Where it is kept

In a Cloudflare D1 database hosted in Western Europe, reached only by this site's own code. Everything is served over HTTPS. Your sign-in cookie is HttpOnly and Secure, so no script on the page can read it. Your browser also keeps a couple of trivial conveniences locally — whether you appear to be signed in, and the guest timeline described above. Neither is sent anywhere.

Who can see your timelines

Private by default. A new timeline is visible to you alone. Nothing is published unless you open Share and turn it on deliberately.

Making one public means anyone can open it, find it by searching its text or dates, lay it over their own for comparison, or import a copy — with your username credited. Turning it private again stops it appearing in search and closes the link, though anyone who already imported a copy keeps the copy they made. Treat publishing as permanent for anything you would mind being read.

Deleting it

Delete a single timeline from your dashboard: it and all of its events go immediately. Delete the whole account from settings, and every timeline, event, credit and session goes with it in one operation. Neither is recoverable, and neither leaves anything behind.

Email

Only ever about your own account — confirming your address, or resetting your password. No newsletters, no announcements, no marketing, and your address goes to nobody else.