You've made a website for your project, offering, or organization. This is a guide to keeping it from leaking your community's information.
Every outside request your page makes hands each visitor's IP address, plus the fact that they visited you, to another company. Fonts, embeds, analytics, form builders — all of it. A German court already ruled that the fonts alone cross the line. Audit your page, self-host what you can, swap the rest for tools that don't take attendance. This page shows how, and practices what it preaches: view source — the fonts live in this file.
In January 2022 a German court ruled on the smallest possible version of this problem: a website that loaded its typefaces from Google's servers.
The court held that a visitor's dynamic IP address is personal data; that embedding Google Fonts remotely transmits that address to Google without consent, every visit; that the website operator had no legitimate interest to stand on — because the fonts could have been self-hosted all along — and awarded the visitor €100 in damages for the loss of control over their data.
The money is trivial. The principle isn't: the requests your page makes are your responsibility, and "that's just how the embed code came" is not a defense. If a court can see it, your visitors' adversaries can too — ad networks don't need a subpoena.
One ritual, fifteen minutes, once. Open your site, open the browser's network tab (or just view source), and list every domain that isn't yours. Each one receives, at minimum: the visitor's IP address, the page they were on, and the time. Common findings on community sites:
Now weigh each one against who visits you. A mutual-aid page, a venue, an organizing space — your visitors may have better reasons than most to not be enumerated.
The easiest fix and the biggest symbol, which is why it goes first. About fifteen minutes:
@font-face, with font-display: swap so text never waits on them.fonts.googleapis.com link tag. That's the whole migration.This page embeds its three typefaces inside the file itself — view source. Total cost: about 145 KB, or less than one Instagram photo, for zero outside requests.
Checked October 2026 against each tool’s own site and privacy policy. Tools change; recheck a row before you rely on it.
youtube-nocookie.com “privacy-enhanced” embed only promises the view won’t personalize the visitor’s YouTube or ads; the player still loads from Google when the page opens, so every visitor’s IP still goes there. Fewer cookies, same request.{{ TrackView }} tag removed from your templates (its default template includes a tracking pixel). Your readers' reading habits aren't a metric you need.For the personal-device side of this, see the sibling site S/P/A; for the radio side, ACT.
If you run the site, the server or the group's accounts, you carry keys that other people's data depends on. Four kinds, and for each one: where it lives, how it's backed up, and how it's revoked.
ssh-keygen -t ed25519 and give it a passphrase, or use a hardware key (ssh-keygen -t ed25519-sk, OpenSSH 8.2 or later) so the secret never leaves the token. Don't back the key up; replace it. Instead, keep a second authorized key (another device, or a hardware key in the go-binder) so losing one never locks you out. To revoke, delete its line from ~/.ssh/authorized_keys on every server it reaches, and remove it from your Git host's settings..env in .gitignore before the first commit. Don't back them up; reissue them. Revoke one in the host's token settings the moment it shows up anywhere public. A token that was ever in a public commit is burned, even after you delete the commit.PasswordAuthentication no), no direct root login, and a separate account for each person.When someone steps back, do it the same day, from a written list rather than memory: their SSH keys out of every authorized_keys, their accounts disabled, every shared password they knew rotated, every token they created revoked, and the inventory updated.
This page is about not leaking your visitors to ad networks. If you organize, report, or host people who face targeted threats — a government, a specific person, legal process, a border crossing with sensitive material — that's specialist work, and these are the people who do it:
If someone is a danger to you right now, the people to call are not on this site.
Questions from readers, answered at the depth a community site owes them. Have one of your own? Send it in — unanswered questions are the most useful mail this page gets.
What makes a good password?
Length. Not complexity — length. The US standards body for this, NIST, rewrote its guidance (SP 800-63B, revision 4, finalized August 2025) around evidence instead of folklore, and the folklore lost: sites must not demand the r@nd0m-symbol ritual anymore, must accept passwords up to at least 64 characters including spaces, and must not force you to rotate a password on a schedule — only when there's evidence it leaked. The floors: 15 characters minimum for a password used on its own, 8 only when it's one factor of two-factor login, and new passwords should be screened against lists of already-breached ones.
Why length wins: a password's real strength is how many guesses it survives, and each added character multiplies the guess count; each added rule mostly just makes humans pick "P@ssword1!" in predictable ways. Four or five random words — a passphrase — beats eight line-noise characters and can actually be remembered, which is why it's what we set as the master passphrase in every session. Let the words be chosen by chance, not by you: the EFF's dice method (five dice per word, looked up on their long wordlist) is offline, free, and the most honest randomness you can hold in your hand. Human-picked “random” words are the leak.
The quiet connection to cryptography: your password doesn't unlock anything directly — software runs it through a key-derivation function to produce the actual cryptographic key that decrypts your vault or your disk. A passphrase is a key you can hold in your head, and entropy — honest randomness — is the entire game, there just as here. Guessability is the only thing the mathematics respects.
Source: NIST SP 800-63B-4 (2025); see the sibling site's glossary for passphrase mechanics.
Why security, privacy, and autonomy — says who?
Each corner of the trifecta has a literature behind it. Security as process rather than product is Bruce Schneier's long argument — there is no purchase that ends the problem, only practices that manage it. Privacy got its modern sharpening from Helen Nissenbaum's "contextual integrity": privacy isn't secrecy, it's information flowing according to the norms of the context it was shared in — which is exactly why a health detail told to a pharmacist feels violated when it reaches an advertiser. Shoshana Zuboff's The Age of Surveillance Capitalism names the economic engine that violates it at scale. Autonomy is the oldest thread: Ivan Illich's "convivial tools" — tools that extend the person using them rather than making the person serve the tool — could be this site's mission statement, and Murray Bookchin's municipalism makes the same argument for infrastructure held close to the people who depend on it. Cory Doctorow's "enshittification" is the modern autopsy of what happens without that corner: platforms decay precisely because their users can't leave.
Is there a better trifecta? The engineers' classic is confidentiality–integrity–availability, which is excellent for systems and silent about people. Others propose safety–dignity–agency. We keep ours because the three genuinely pull against each other — the frictions above are the proof — and a values framework you can't feel the cost of isn't one. But the question stays open on purpose; frameworks are tools too, and convivial ones can be put down.
Can I legally use that clip / image / song in my work?
Often yes — and the reason creators believe otherwise is one of the quiet enclosures this site exists to push against. US copyright law includes fair use: using copyrighted material without permission for commentary, criticism, teaching, remix, and transformation. The scholars who did the most to turn that from a lawyer's gamble into a working practice are at American University — Patricia Aufderheide of the School of Communication (founder of the Center for Media & Social Impact), with law colleague Peter Jaszi. Their insight, built out in Reclaiming Fair Use, was that communities of practice can write down their own norms: the resulting Codes of Best Practices in Fair Use — for documentary film, online video, teaching, poetry, libraries — gave creators, insurers, and platforms a shared standard, and they changed what actually gets made.
The working shape of it: fair use favors uses that are transformative — you're saying something about the material, or something new with it, rather than substituting for it — and proportionate: you took what the new purpose needed. It is a right you exercise, not a permission you await, and rights unexercised atrophy. Start with CMSI's codes for your medium; they're free, which is fitting.
This is orientation, not legal advice — the codes themselves are the real reference.
This is all free — what's the catch? (The question nobody asks)
We picked this one ourselves, because it's the question under every other question on this page. English has one word for two kinds of free: free as in cost (someone else is paying, and if you can't see who, it's often an advertiser paying for you) and free as in freedom — you can inspect it, change it, leave with your data, run it yourself. The free-software movement spent forty years learning that the second kind is what matters and the first kind is how you get trapped. Every swap on this page is really a move from gratis-with-strings to libre: the "free" analytics cost your visitors; the free-as-in-freedom counter costs you nothing but honesty.
The frontier of this idea right now is AI. The most capable models are gratis or cheap today the way rides and delivery once were — introductory pricing on a dependency — while the ability to run a model yourself, inspect it, and keep it when the pricing turns is the libre version of the same fight. A model on your own machine answering from an offline copy of Wikipedia is this century's community library. That's not hypothetical for us; it's the roadmap.
And the honest completion of the thought: libre is not costless. Somebody maintains it. That's what Index of /commons is for — the free tools are paid for by someone, and it should sometimes be us.
Things this page owes but hasn't paid yet. Kept visible on purpose; a draft that hides its debts is a worse draft.
You're showing up: a protest, a picket line, a vigil, a town meeting, a food distribution. This is about what your phone says about you and the people around you while you're there.
Your phone is the most complete record of you and of everyone you talk to. Before you leave, decide what comes with you, set it so only a passcode opens it, and turn off what reports where you are. While you're there, don't let your camera become evidence against the people next to you. If police want the phone, you can say no to unlocking it, out loud, without resisting.
Anyone attending something in public where being identified, or having your phone taken, would cost you or someone else. Most people at most events face ordinary risks: a lost phone, a photo of their face posted somewhere, their location in a company's records. The steps below cover those and hold up reasonably well against more.
If you're a likely target yourself (an organizer police already know, someone without secure immigration status, a journalist with sources to protect), the people in the last section do this full time. Talk to them first.
Three choices, each with a cost:
A crowd photo with faces in it is a list of who was there. Taking one is easy; taking it back is impossible.
For the US. This is orientation, not legal advice, and rules vary by state; your local legal support line is the real reference.
The website half of this page applies here too: what you collect is what can be taken.
If someone is a danger to you right now, the people to call are not on this site.