Murmur
Create account Sign in

What we keep

All of it, in plain language, with the timers.

Murmur is built to hold as little about you as it can while still working. This page is the whole list — not a summary of it.

What we keep for as long as you want it

  • What you post. Murmurs, replies, images and the groups you are in. Yours until you delete them — and you can set them to delete themselves after a week, a month or a year in Privacy.
  • Your account. Handle, display name, email address, password hash, date of birth, and the settings you chose. Your address and your date of birth are stored encrypted — see below.
  • Your messages, stored encrypted — see below.

What we keep briefly, and why

  • Your IP address, with sign-ins and with security events. This is what lets you look at your own security page and see a sign-in you do not recognise. Sign-in records are deleted after 7 days; security events after 30 days. The address on your last sign-in is dropped at the same age, so nothing here keeps an address longer than that.
  • Counters that stop spam — how many times an address has tried to register or sign in. Deleted after 24 hours.

What we deliberately do not keep

  • No browser fingerprint. Your user-agent string is not stored anywhere. It used to be, on sessions and security events; it is not any more.
  • No tracking of what you read. No record of which murmurs you looked at, how long for, or what you scrolled past. This is why the “For you” feed is built from what you did — replies, sparks, echoes, the tags you write, the groups you joined — and not from what you saw. There is no reading history here to rank you with.
  • No analytics, and no third-party trackers. The content security policy blocks third-party scripts outright, so this is enforced by the browser rather than promised by us.
  • No activity email. Nothing emails you about follows, mentions, replies or messages — so there is no mail log of who interacted with whom.
  • No advertising profile. Nothing about you is sent to an advertiser.

What a stolen database would contain

The likeliest way personal data leaks from a site like this is not somebody breaking in — it is the database being read without the server. So here is what a copy of it would actually hold.

Not readable: your email address, your date of birth, your private messages and your two-factor secret are all stored as AES-256-GCM ciphertext. Your password is not stored at all — only an Argon2id hash of it, which cannot be turned back into your password by us or by anyone else.

Readable, and meant to be: your handle, your display name, your bio, your murmurs, and who you follow. That is the public site.

Your address is still what you sign in with, which raises a fair question: how can we find you by something we cannot read? Beside the encrypted address we keep a keyed fingerprint of it — enough to match the address you type, not enough to work backwards to the address itself without the key.

Your messages

Direct messages are stored as AES-256-GCM ciphertext rather than as readable text. If this site's database were stolen — the ordinary way private messages leak — the messages in it would not be readable.

It is not end-to-end encryption, and we will not call it that. The same is true of everything above: the key lives on the same server, so anyone who takes the whole server takes both halves. Real end-to-end would mean keys only you and the person you are writing to hold, which would also mean nobody could ever act on a message you reported, and losing your device would mean losing your history. We would rather tell you exactly what you have than let the word "encrypted" do work it has not earned.

Where "no logs" would be a lie

Sites advertise a "no-log policy" and then keep several. Here is what Murmur genuinely keeps, so you can judge it yourself: the IP address on a sign-in and on a security event, and short-lived counters that stop bulk sign-ups. Without the first you could not tell a stranger's sign-in from your own; without the second the site would fill with bots within a day. Everything else on the usual list — page views, read receipts, device fingerprints, analytics, ad profiles — is not collected at all.

Getting it, and getting rid of it

Download everything we hold about you as a JSON file, any time. Deleting your account removes your posts, messages, follows and settings; replies you left in other people's threads are kept but anonymised, so their conversations do not develop holes.