What we store, and what we don't.

Storage

• The app runs on Vercel. Published files and metadata live in a private Vercel Blob store and are served through our app.
• Files are stored content-addressed (by SHA-256), so identical files are stored once and a version can never be partially written.
• Each publish stores an immutable file map. A retained version's URL stays stable while that version is kept and the site is available. Free keeps the last 10 versions, Hobby 50, and Pro has no cap, including the live version, applied when a new version is saved. Pruning, deleting that version, or deleting the site removes it. A cache can briefly still serve a removed URL, and publishing the same slug again can reuse the v1 URL. It is not a permanent archive. A daily sweep reports stored files that no retained version and no current site reference. It does not delete them unless deletion is explicitly enabled, and it skips anything uploaded inside the grace period.
• Sites are permanent unless you set an expiry or delete them. We do not delete inactive sites.

Tokens

• Tokens are random 192-bit values. We store only a SHA-256 hash; we cannot show you a token again.
• You can rotate a token (POST /v1/tokens/rotate) or revoke it (POST /v1/tokens/revoke). Rotation can keep the old token alive for up to 300 seconds if you set overlap_seconds; the default is immediate. A revoked token returns 401 token_revoked. That is not 403 suspended, which is an operator disable.
• A recovery email is optional and never required to publish. We look it up by the SHA-256 of the trimmed, lowercased address; once you confirm it, the address is also kept as your optional owner email (see privacy). A token with no recovery email has no self-serve recovery path. An operator who already knows the principal id can mint a replacement; that revokes every previous token, and the new token is shown once. Recovery links are single-use and last 15 minutes. The recovery request returns the same JSON whether or not the address is on file.

What we don't collect

• No email address, name, or phone number is required to publish. We never log a recovery address or a token.
• No analytics scripts on deed.page and none injected into your sites. Counts are aggregated on the server from the request itself. A daily visitor is a salted hash of the IP address and the user agent. The salt changes each UTC day. The raw IP address is not stored.
• We never send your files, or excerpts of them, to an AI model. A publish stores the bytes and serves them back.
• No cookie on the apex for publishing. The theme switch keeps a preference in local storage on deed.page. A password-protected site sets a host-only cookie only after the password is entered on that host.

Origins

• Files are served only at https://{slug}.deed.page/. A request to https://deed.page/s/{slug}/… returns 308 to that URL, with the path and query kept, and an empty body. Uploaded HTML and JavaScript never run on the deed.page origin that serves this API, these docs, and the dashboard.
• Each slug is its own origin, so a page on one slug cannot read another slug's storage.
• A retained version is also served at https://v{n}--{slug}.deed.page/, its own origin. That name is one label, so the *.deed.page wildcard certificate covers it.
• Tokens come back in JSON, not in cookies. Local storage on deed.page is not visible to {slug}.deed.page. We do not set a cookie Domain. The password cookie is host-only too, so a sibling host does not receive it.
• Subdomain responses send X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, and Origin-Agent-Cluster: ?1. They do not send a Content-Security-Policy sandbox, because that would block ordinary scripts, styles, and forms on the sites you publish.

Uploads

• Archives are unpacked in pure Node. Symlinks, hard links, absolute paths, and .. are rejected; decompressed size is capped.
• Uploads are screened on the server before they are stored. We reject these extensions by type: .exe, .dll, .scr, .com, .msi, .msp, .bat, .cmd, .ps1, .vbs, .vbe, .jse, .wsf, .hta, .apk, .dmg, .pkg, .deb, .rpm, .jar, .elf, .so, .bin, .iso, .img, .vhd, .vmdk, .rar, .7z. .bin is blocked by file type, not because its bytes were recognized as a program. A .bin file often has no MZ or ELF header, so the magic-byte check would miss raw executables, firmware droppers, and disk images that use that suffix. Zip and gzip are not on this list. We also reject the EICAR test string, including a raw octet-stream body, known phishing-kit markers, password forms that post to another site, and password forms that impersonate a brand. Zip and gzip downloads are allowed. A rejection is HTTP 422 and nothing is stored. Google Web Risk: off right now. No key is configured, so only the local checks above run. web_risk in /api/v1/health is true only after a lookup of Google's documented test URL reports a threat. web_risk_status is unconfigured, unchecked, ready, or unavailable. safe_browsing mirrors web_risk. A Google error or timeout does not block the publish.
• A site is public unless its owner set a password on Hobby or Pro. Do not publish secrets on a public site.

Payments

Stripe handles card data. We store only the Stripe customer and subscription IDs attached to your token.

Honest limits

• No SOC 2 report and no contractual SLA.
• Rate limits are hourly and shared across instances. Each server also keeps an in-memory count so it can refuse immediately. The shared counters live in the private blob store, one file per process. A cold start does not reset the hour. Under concurrency the total is approximate: two processes can both pass the check before either write is visible, so the count can sit slightly over or under the cap. A 429 includes a Retry-After header.
• Sites are hostnames under deed.page ({slug}.deed.page), a different origin from the apex. We do not give each customer a separate registrable domain.

Abuse and security reports

Use the form at /abuse or POST /v1/report. You can also email ops@avatar33.com. Reports are stored. Our target is to review every report within one business day, and to disable a site as soon as phishing or malware on it is confirmed. The form does not send email. We may disable a slug: the subdomain then shows a short unavailable page (HTTP 451), the record is kept, and we can turn the slug back on. That action is not an MCP tool. Health: /api/v1/health.

deed.page is operated by Avatar 8 LLC.