‹ Back to the list

Today's Five

Version 1.12

A short list you keep open on screen all day. Here's exactly what leaves your device, who can see it, and what never gets collected.

How it works

Start a list and your browser makes a random secret and puts it in the link, after the #. Everything else is derived from that secret on your device: the key that encrypts the list, the id the server files it under, and the token that proves you're allowed to change it. Browsers never send the part of a link after # to a server, and this app never sends it anywhere else.

Before anything gets saved or synced, the whole list is encrypted on your device with AES-256-GCM. Your other devices with the same link derive the same key and decrypt it. The Private link can produce the View link; the View link can't produce the Private link.

What's stored on the server

• The encrypted list: one sealed blob per list. Lines, notes, sections, repeat rules, templates, history, and saved themes are all inside it.
• A revision number and two timestamps (last change, and last opened, to the day), so your devices can tell what changed and idle lists can be cleared out.
• A hash of the write token, so the server can turn away changes from a View link.
• A salted hash of your network address, kept for at most 24 hours, and only when a new list is created. It's there to stop one address from creating lists without limit. The address itself isn't stored.

What the operator can see

Nothing readable. I can see that a list exists, how big its encrypted blob is, when it last changed, and when it was last opened. Not a word of what's in it, not who opened it, and not the link. There's no way for me to recover a list for you—lose the link, lose the list. The only backup is the one you make yourself: ⋯ → Settings → This list → Export & import.

Third parties

The encrypted lists sit with Supabase (a hosted Postgres database and realtime service) in a data centre in the United States run by Amazon Web Services. Supabase sees what I see, plus the ordinary connection metadata any server sees (your network address, request times). GitHub Pages serves the app itself. Fonts and every other file load from this site—nothing gets fetched from Google, a CDN, or anyone else.

Retention

A list nobody has opened or changed for 12 months gets deleted from the server. Your device keeps its own copy for as long as the browser keeps site data. New keys deletes the old encrypted row at once. ⋯ → Delete this list everywhere removes it from the server and from this device on the spot, with ten seconds to change your mind; "Remove from this device" only hides a list here, and the server and your other devices keep it.

What there's none of

• No accounts, no sign-up, no email, no passwords.
• No analytics, no trackers, no cookies. The browser's own storage holds your theme and your links, on your device only.
• No names: the list doesn't record who changed what. "Who's here" shows a dot per device that has the list open right now—a random session id on the live channel, gone the moment the page closes, never stored. Turn it off in Settings → Other devices and this device neither shows nor counts.

Sharing

Two links, named for what they do. The Private link is your list's only key: anyone holding it can open the list, change anything, and make new keys, and there is no spare. The View link shows the list and can't change it—put it on a second screen and cross things off from your phone, or hand it to someone who should watch; it keeps working until you make new keys. Treat the Private link like a password.

Limits

This is a small free service. Each list is capped at 96 KB encrypted (a year of daily history fits many times over), the service holds a few thousand lists in total, and a single network address can only create a handful of lists per hour. Hit a limit and the app says so and keeps working on your device.

Typefaces

The themes set text in 22 families from Google Fonts: Archivo, Baloo 2, Cormorant Garamond, DM Sans, DM Serif Display, Fraunces, Fredoka, IBM Plex Mono, IBM Plex Sans, JetBrains Mono, Josefin Sans, Karla, Lato, Lora, Manrope, Nunito Sans, Outfit, Playfair Display, PT Sans, Quicksand, Source Serif 4 and Space Grotesk. Every one is licensed under the SIL Open Font License 1.1, which is what allows them to be bundled with an app rather than fetched from someone else's server.

Each family's copyright line, its reserved font name where it declares one, and the full licence text are in fonts/OFL.txt. The Apple app carries the same notice beside the same faces inside its own bundle.

What's new

• The changelog lives in whatsnew.json.

The code is on GitHub for anyone who wants to check these claims against what actually runs.