1. Who is responsible

Omicron.blog is an independently run instance. The operator ("we") is the party responsible for your data and can be reached at omicronhq@protonmail.com. If you are in the EU/EEA, the operator of omicron.blog is the data controller for your personal data.

2. Data we collect

Account data you provide: username, display name, email address, bio, avatar, and anything you add to your profile such as links or a custom section.
Content you publish: posts, comments, media uploads, and reading lists.
Operational data: server logs, federation delivery records, and short-lived rate-limit counters, the minimum needed to run, secure, and federate the service. We do not build behavioral profiles of readers.

3. Reader analytics

On-instance view counts are aggregate numbers only. No IP addresses, cookies, identifiers, or per-visit records are stored for them, and Do Not Track / Global Privacy Control signals are honoured.

4. Cookies and local storage

A session cookie that keeps you signed in.
A timezone cookie that renders dates correctly.
Browser local storage for editor drafts and preferences.
No advertising cookies, no third-party trackers, no cross-site analytics.

5. How we use your data

To provide the blogging and federation features, keep the service secure, moderate the community, and meet legal obligations. We do not sell personal data and we show no advertising.

6. Federation: please read this

Public profiles and posts are distributed over ActivityPub to other servers. Once your data reaches another instance, that instance applies its own privacy policy. Deleting content here removes it from omicron.blog and sends deletion notices to the fediverse, but we cannot force independent servers to delete their copies. Do not publish anything public that you could not tolerate being copied.

7. Who else sees your data

Only the infrastructure strictly needed to operate the service (hosting and email delivery), and authorities where the law requires. No data brokers, no advertisers.

8. Retention

Your content stays while your account is active; you can edit or delete it at any time from Settings. A deleted account is hidden immediately, remains restorable for 30 days, then is permanently erased. Uploads detached from any content are cleaned up automatically after about 30 days. Encrypted backups rotate on a short schedule, so residual copies age out automatically.

9. Your rights

Access, correct, or delete your content and account directly from Settings at any time. For anything else, including a copy of your data, write to omicronhq@protonmail.com. If you are in the EU/EEA you also have the rights to restriction, portability, and objection, and the right to complain to your supervisory authority.

10. Security

Traffic is encrypted with TLS. Passwords are stored hashed, sessions are kept server-side, and backups are encrypted. No system is impenetrable; report vulnerabilities to omicronhq@protonmail.com rather than disclosing them publicly.

11. Children

Omicron.blog is not directed at children under 16. Accounts found to belong to younger children will be removed.

12. Changes to this policy

Material changes will be announced on this instance before they take effect. Continued use after that point means you accept the updated policy.

13. Contact

Questions, requests, or complaints: omicronhq@protonmail.com. For abuse reports about specific content, use the Flag action on the post or profile so moderators get full context.

Update on our specification work