Privacy

Last updated October 20, 2026.

This page lists what Spes Publica collects, where it goes, and how long it's kept. If it isn't on this page, we don't collect it.

The short version

  • We don't keep anything that ties a search to the person who made it.
  • We don't sell or share data, and we don't show you targeted ads.
  • The site doesn't use any outside tools or services except the search engines that answer your searches, an uptime service that hears only whether we're up, and an exchange's public price feed for crypto payments. Every page loads only from spesp.com, or pay.spespub.com when you pay, which we also run: no outside scripts, fonts or images.
  • We count visits only as daily totals, and don't use trackers or anything else that could match a search with the person who made it.
  • You don't need an account to search. If you make one, it asks for a username and nothing else; a recovery email is optional. You sign in with a passkey, a password, or both: a passkey uses your device's Face ID, Touch ID or lock, so there's nothing to remember or steal; a password works on any device; and with both, losing one doesn't lock you out.

When you search

Your browser encrypts each search before it leaves your device. It then goes through two separate parts of Spes Publica:

  • The relay receives your connection, so it sees your IP address, but it can't read your search. It holds the encrypted results for up to 15 minutes after the search finishes so your browser can collect them, then deletes them.
  • The search service reads your search so it can run it, but never sees your IP address, cookies or account.

To find results, the search service sends your search to outside search engines. Today those are Google, Bing, Yahoo, Mojeek, Brave, DuckDuckGo, Wikipedia and Wikidata. For weather questions, Open-Meteo gets the place name, and translation questions go to Lingva, MyMemory and Dictzone. A search that uses a stamp may also go to the Brave Search API. These services see your search coming from our server, not from you. To show preview images, our server also fetches images and page details from the sites in your results.

The search service also looks your search up in Spes Publica's own index of web pages, which runs on the same server and keeps no record of what it's asked. We build that index with our own crawler, SpesPublicaBot, which never works from searches.

What we keep about searches

For each search we store the search term, the date, your browser's language setting, and how the search went: how many results, which engines answered, how long it took, and whether it used a stamp.

  • Before it's stored, we replace email addresses, phone numbers and long numbers (like card or account numbers) in the search term.
  • We store the date but not the time, and searches from the same day are kept in random order.
  • Nothing about who searched is stored: no IP address, cookie, account or device.
  • Individual searches are deleted after three days. After that we keep only daily totals, with no search terms.

We use this to see what people search for, which searches fail, and how the service is doing. The daily report we email ourselves has counts only, never search terms.

Your IP address

The relay uses your IP address to limit how many searches and requests can come from one place, to stop abuse. It turns the address into a scrambled key that's held only in memory and forgotten within minutes. It also uses the address to count visits, as described below, and never stores it for that. We don't keep a log of visits. When something on the server breaks, its error log can record the IP address of the request involved; those logs are used only to fix problems and roll over automatically.

Counting visits

The relay counts page views each day, so we can see how the site is used and which sites send people to it. For each day it keeps only totals: how many times each page was viewed, which sites linked to them (just the site's name), which kinds of browser, system and device (like Safari, iOS, phone, never the full browser details), and which countries. It also counts roughly how many different visitors there were: it tells them apart by a scrambled form of their IP address, held in memory for that day only and then forgotten, along with the key that scrambled it. Visits that look like they come from programs rather than people are counted separately.

It never records a visit on its own: no address, no time, nothing that says one visitor looked at one page. The totals aren't combined with each other or with searches, which the relay can't read anyway. Groups of fewer than 3 views are shown together as "other".

The country comes from a database of address ranges kept on our server (IP to Country Lite by DB-IP, used under CC BY 4.0), so no outside service is asked. Your address is looked up in memory and not kept.

Accounts

An account is optional. It holds stamps, which let a search skip the line when it's busy. For each account we store:

  • Your username, scrambled on your device and again on our server, so we can't read it.
  • The month the account was made.
  • Your sign-in methods: a password check that never reveals the password (we never receive it), passkey public keys, and the public half of your recovery phrase.
  • Your account details (username and recovery emails), encrypted on your device. We can't decrypt them.
  • How many stamps you have, and whether the account has admin access.
  • Your sign-in sessions, stored only as scrambled tokens, for up to 30 days.

Stamps are made so we can't tell which account a spent stamp came from. We only record that a stamp has been used, so it can't be used twice.

Deleting your account deletes all of this, including any stamps left in it. It can't be undone.

Stamp codes

A code is worth a number of stamps. You can add it to an account, or use it without one: then your browser keeps the code and makes stamps from it, the way a signed-in device makes them from an account's balance.

For each code we store only a scrambled form of it and how many stamps are left on it. Nothing about who has it. When it's used up or added to an account, it's deleted.

While Spes Publica is in preview, free stamps come as a code too: a new one, or more stamps on the code your browser already has. We keep nothing else about who asked for them.

Recovery emails

An account can have up to two recovery emails. They're optional, and their only use is getting back into your account if you lose your password, passkeys and recovery phrase.

  • We store each address only as a scrambled value tied to your account. We can't read the addresses, list them, or email them on our own; we can only check an address someone types against them. The same address on two accounts looks unrelated.
  • A readable copy is kept in your encrypted account details, so you can see your addresses. We can't decrypt it.
  • Removing an address deletes it.

We only ever send two kinds of email to a recovery address:

  • A link to confirm the address, when you add it. It expires after 24 hours.
  • A recovery link, when someone asks to recover the account using your username and that address. It expires after 7 days.

No newsletters, receipts or marketing. Email comes from noreply@spesp.com, sent by our own mail server. Our mail server's logs record the addresses it sends to and are kept for about a month. Like any email, the message is also seen by your email provider.

Opening a recovery link starts a 48-hour wait. Signing in to the account any other way during that time cancels the recovery, so if it wasn't you, signing in stops it. After the wait, the link lets you set up a new password or passkey and a new recovery phrase. Because we can't open your encrypted account details, they start fresh, and your old passkeys are removed. Stamps in your balance are kept. Admin access, if the account had it, is removed.

Other email

If you ask for an invite, the address and note you give are emailed to us. We use them only to reply to you, and they stay in our inbox until we delete them.

Feedback

The feedback button keeps what you write, the page you were on (just the page, never a search), and a name or email if you choose to add one. It doesn't keep your account, your IP address or the time you sent it: the web service sends it on without your account cookie or address.

It waits on our server until the daily report email, goes out in it, and is then deleted from the server. So it arrives with everything else sent that day, not on its own. The email stays in our inbox until we delete it.

Cookies and storage on your device

We use a few cookies, all needed for the site to work:

  • One that lets your browser collect its own search results. It ends when you close your browser.
  • One that remembers your preview link, while Spes Publica is invite only. It lasts a year.
  • One that keeps you signed in, if you have an account. It lasts up to 30 days, and is only sent to the parts of the site that handle accounts.
  • On our own devices only, one that stops our visits being counted.

Your browser also stores a few things for Spes Publica on your device: the key that encrypts your searches, your stamps and stamp settings, how you've chosen to see answers (units, clock, moon), a stamp code if you use one without an account, and, while you're signed in, the key to your account details, itself encrypted with a key your browser keeps on the device. None of these are sent anywhere except as needed to search or use your account.

Signing out sends this device's unused stamps back to your account's balance, then removes from the device its stamps, its copy of your balance, and the key to your account details. If sending the stamps back fails, they're removed anyway (about 20 at most). The key that encrypts your searches, your stamp settings and your answer choices stay.

Backups

Every night we make an encrypted backup of account data (as described above), our mailboxes and the server's settings. Backups are kept for 14 days, then deleted. So after an account is deleted, or we delete an email, a copy can remain in a backup for up to 14 days. The key that opens the backups isn't kept on the server.

Searches aren't backed up, so the three-day limit above holds, and neither are the mail server's logs.

Who can see what

Spes Publica runs on a server we rent from DigitalOcean, in New York. The only people with access are the people who run Spes Publica. On the admin page we can see recent search terms (as stored above, for three days) and counts. We can't see who searched for anything.

To know when something breaks, our server checks in with Healthchecks.io every few minutes, and after each backup. The check-ins say only whether our services are up and whether the backup worked; nothing about visitors or searches.

If we're ever legally required to hand over data, the most we could hand over is what this page describes.

Payments

You can buy stamps with Bitcoin or Monero. Payments go through pay.spespub.com, a BTCPay Server we run ourselves on its own server, not a payment company. We don't take card payments.

A purchase isn't connected to an account. You pay for a code, and the code is worth the pack's stamps. Redeeming it adds the stamps to the account it's redeemed on, and the code is then deleted. We don't record which account redeemed a code, so we can't tell which purchase paid for which account's stamps.

For each purchase we store:

  • On the payment server: the invoice, with the pack's price, the amount paid, when, and the payment's transaction details. It doesn't ask for your name, email or address.
  • On our main server, for 30 days: the invoice number, the pack and its code, under a scrambled key. The unscrambled key stays in your browser, so only that browser can look the purchase up and show you the code.

The payment server doesn't keep a log of visits. To turn a price in dollars into Bitcoin or Monero, it checks the current rate with Kraken's public price feed; that request says nothing about you or the purchase.

Bitcoin payments are public: anyone can see a payment on the Bitcoin blockchain, though not who made it or what it was for, unless the address is tied to you elsewhere (for example, an exchange account you paid from). Monero payments are private by design. Either way, your wallet or exchange keeps its own record of the payment.

Changes and questions

When what we do changes, we'll update this page and the date at the top. Questions go to dan@spesp.com.