Your data

Plainly, in the order it matters: what is kept, where it lives, who can see it, and how to get rid of it.

If you have not made an account

Choosing Try it now gives you a working timeline that never leaves your browser. It is held in that browser's own storage, on your own device. No account is created, no record of it exists on our side, and nobody else can reach it — not even us.

The flip side is that it is only as durable as that browser. Clearing your site data, using private browsing, or switching to another device will lose it. That is what the banner along the top is warning you about. Creating an account copies the timeline to the server, and only then is the local copy cleared.

If you have made an account

Then we store, and only store:

• Your email address — to sign you in and to recover your account. It is never shown publicly, and the only other party to see it is the service that delivers our email (see Email).
• Your username — shown as the author on any timeline you publish. It does not have to be your real name, and we would rather it wasn't.
• Your password, as a hash — see below.
• Your timelines — the title, description, any topics you file one under, and for every event its dates, tolerance, color, row, notes, anchors and links.
• Your ratings — the stars you have given other people's public timelines, one rating each, which you can change or take back. Nobody is ever shown who gave a rating: a timeline shows only its average and how many ratings it has, and your own public timelines' ratings are shown the same way, to you and to everyone. Deleting your account removes the ratings you gave and those your timelines received.
• Sign-in sessions — a random token per browser you are signed in on, good for thirty days after you last use it. Changing your password ends every session but the one you changed it from.
• Recent attempts — how many times each network, and each name typed at sign-in, has failed to sign in, or has tried to sign up or ask for a reset link, in the last hour or so, kept only in scrambled form and deleted within two hours. It is what stops anyone guessing passwords at speed, and it applies whether or not you have an account.
• Today's totals — how much each account has saved today, and how many confirmation and reset emails have gone to its address, against daily limits far above what anyone needs. They stop a runaway script from filling the site's database or burying someone in email. Kept in the same scrambled form, and deleted within an hour of the day ending at midnight UTC.
• A confirmation waiting to be sent — on a day busy enough to use up the site's share of confirmation emails, which account one is waiting for and when it was asked for. It is sent soon after midnight UTC, then removed; one still waiting after a week is dropped, and deleting the account removes it.
• Your choice about news — whether you asked to be emailed about new features, and when (see News), and which note on your dashboard you last dismissed, so it stays dismissed.

That is the whole list of what is kept about you. There is no advertising, nothing here follows you to other sites, and there is nothing to sell. We do count visits, which is described in Counting visits below — it is the one thing on these pages watching anything, and it watches pages rather than people.

Five outside services are involved, and we will name any others here if that ever changes: Cloudflare Web Analytics, on every page, which counts visits; Cloudflare Turnstile, on the sign-up page alone, to tell a person from a program (see the check at sign-up); the service that delivers our email; and Stripe, which takes the payment if you choose to give something towards the running costs; and IndexNow, through which search engines such as Bing are told the address of a public timeline when it appears, changes or goes. All but Stripe are described below. Two of them put a script into these pages: the analytics one on every page, and Turnstile on the sign-up page.

Your password

Stored as a PBKDF2-HMAC-SHA256 hash: 100,000 iterations with a random salt for each account. Passwords are never written down in a form anyone can read, ourselves included. If you lose yours, nobody can look it up — a reset link is the only route back in, which is why confirming your email address is worth doing.

Where it is kept

In a Cloudflare D1 database hosted in Western Europe. The site's own code does the reading and writing; we open it ourselves only to look into a fault, a report made to us, or a request of yours, and look no further than that needs. The site does show its owner running totals — how many accounts, timelines and events there are and have been, how many accounts saved a change lately, how often features such as notes or links are used, which eras timelines cover, how much of the day's limits has been used, and the visit counts described under Counting visits — but those are counts and nothing else: no name, no address, no title, nothing that is anyone's in particular. Acting on a report is the exception: it means looking that one account up by its username, which shows its email address, so that the person can be written to before anything is done about them. That is one named account at a time, never a list, and nothing else on the site hands an address out. Everything is served over HTTPS. Your sign-in cookie is HttpOnly and Secure, so no script on the page can read it. Your browser also keeps a couple of trivial conveniences locally — whether you appear to be signed in, and the guest timeline described above. Neither is sent anywhere.

Who can see your timelines

Private by default. A new timeline is visible to you alone. Nothing is published unless you switch it from Private to Public deliberately.

Making one public means anyone can open it, find it by searching its text, topics or dates, lay it over their own for comparison, or import a copy — with your username credited. Anyone signed in may also rate it, from one to five stars; its average and how many ratings it has are shown wherever it is listed, and the best rated, with their authors' usernames, can appear on the home page. Turning it private again stops it appearing in search and closes the link, though anyone who already imported a copy keeps the copy they made. Treat publishing as permanent for anything you would mind being read.

So that search results keep up, search engines are told through IndexNow when a public timeline is published, changed (at most once a day), made private or deleted — told its address, and nothing else. The last two are what take it out of their results quickly. A timeline you keep private is never mentioned to them at all.

It also means the text is checked automatically for abusive language, and the few that the check picks up are read by us. It is a blunt check on a site about history and the Bible, so it is wrong more often than it is right, and nothing is hidden or removed on its say-so. A timeline you keep private is never checked and never read, which is the same promise as the rest of this page.

Deleting it

Delete a single timeline from your dashboard: it and all of its events go immediately. Delete the whole account from Settings on your dashboard, and every timeline, event, credit, unused link and session goes with it in one operation. Neither can be undone. For a short while the database's own recovery history still holds what went — Cloudflare keeps it so a database can be wound back after a fault, and it lapses within 30 days. If we ever had to wind the database back past your deletion, we would delete it again.

One thing outlives it, and we would rather say so here than let you discover it later. A copy somebody imported while your timeline was public belongs to their document, not ours to reach into, and the credit on that copy still carries the username you had when they made it. Making a timeline private stops new copies; it cannot recall the ones already taken.

Email

Unless you ask for news, only ever about your own account: confirming your address, resetting your password, and, rarely, telling you of something that affects it — a change to the terms or to this page that takes something away, the site closing, or something we have had to do to your account or to what you published.

News, only if you ask for it. You can ask to be emailed occasionally with news and updates, with the box when you sign up or the switch in your dashboard's Settings. It starts off, and nobody is sent news without switching it on. It is only ever news about Timeline Source, a few times a year at most, and every one carries a link that stops them. We keep whether you asked and when, and nothing else; switching it off clears both. We will never pass your details on to anyone else: the only other party that sees your address is the service that delivers our email, as for any other email we send. Nothing in any email reports whether you opened it or what you clicked.

The site sends a limited number of emails a day, and keeps part of each day's for password resets, so a busy day can never stop someone getting back into their account. On such a day a confirmation link waits and goes out soon after midnight UTC.

They are delivered by Resend, an email delivery service in the United States. To send one, Resend receives your address and the message itself, and keeps a record of messages it has delivered, as any mail service does; deleting your account here does not reach into those records. Your address goes to nobody else.

If you write to us from your dashboard (its Contact tab), your message is emailed to us, through Resend, with your username and email address, so that we can reply. It is not kept in the site's database: it lives in our inbox, and nowhere else on the site.

If you support the site

When you give something towards the running costs, a button here asks our server to open a payment page hosted by Stripe and sends you to it. Your card details are typed on Stripe's page and stay with Stripe: no script of theirs runs on these pages, and no card detail ever reaches this site. What comes back to us is that a payment happened, how much it was, and the name you asked to be thanked by, if you gave one. You do not need an account here to give, and a donation is not joined to one. Stripe asks for your email address on its own page so that it can send you a receipt; that address stays with Stripe, and this site never stores it. For a monthly gift, Stripe keeps your email address and card on file, so that it can take each month's gift, send its receipt, and let you sign in to its page to cancel. That record is Stripe's; this site keeps only what it keeps for any donation — the amount, the date and the name you gave — once for each month.

The account of the site's money is public. The amount and date of every donation appear in it, on the Support the site page, on the dashboard of anyone signed in, and — for the largest and the most recent — on the home page. A name you give is shown straight away, so give only a name you are content to see published; leave it blank and the donation is listed as Anonymous. An automatic check holds back a name that looks abusive, and either way we are told what was given and can take any name down. If you would like yours removed, write to and it will be. Giving nothing changes nothing: every part of the site works the same either way.

Counting visits

Every page loads Cloudflare Web Analytics, so that we can see which pages people actually use and whether the site is loading quickly. It records that a page was viewed, the address of that page, how long it took to load, and — worked out from the connection rather than from anything you tell it — the country you are in, your browser and whether you are on a phone or a computer. If you arrived by following a link, it records the site you came from.

It sets no cookie, stores nothing on your device, and keeps no identifier for you. There is nothing that joins one of your visits to another, to your account if you have one, or to you; Cloudflare says it does not use the data for advertising and does not sell it. So the honest description is that we count pages, not people: we can tell that the terms were read forty times this week, and we cannot tell whether that was forty people or one person forty times.

Cloudflare already carries every visit to this site, since it hosts it — this does not hand your visit to anybody who did not already see it. If you would rather not be counted at all, a content blocker that blocks static.cloudflareinsights.com stops it, and nothing on the site works any differently.

The check at sign-up

To keep programs from opening accounts in bulk, the sign-up page uses Cloudflare Turnstile to check that a person, not a program, is filling in the form. Usually it asks nothing of you; now and then it shows a box to select. It is one of the two scripts on this site that come from somewhere else — the other is the one that counts visits, which every page loads — and no other page loads this one.

To tell a person from a program, Turnstile's script looks at your browser and device and at how the check runs, and sends Cloudflare those signals along with your IP address. Our page gives it nothing you type. Cloudflare says it uses the signals only to detect bots and to improve that detection, not to identify, profile or target anyone; its Turnstile privacy addendum has the details. Cloudflare already carries every visit to this site, since it hosts it.