Rootiest services privacy notice

Last updated 11 November 2026

This notice covers rootiest.com, your RootiestID account and every other service Rootiest hosts under the rootiest.com, rootiest.dev, rootiest.fyi, rootiest.link and rootiest.org domains. The status page, the support desk and the Rootiest Status app have their own notices. The rules for using the services are in the Terms of Service.

In short: we keep your RootiestID account and what you choose to store in each service, so the services work for you. They run on servers we manage ourselves. Where another company has to be involved, such as an AI model provider, email delivery or encrypted backup storage, we name it below.

There are no ads, no analytics and no tracking, and we never sell your data.

Who is responsible

Chris Laprade, who runs Rootiest, is responsible for the services and the personal data described here. To contact us about your data, see Contact.

What we collect and why

rootiest.com

rootiest.com is a static website. It sets no cookies, runs no analytics and loads nothing from other companies. The live status badge on its home page comes from our status page. Like any website, our server sees your IP address and browser details while it answers each request, but it keeps no record of them: our web server keeps no access log for rootiest.com.

Your RootiestID account

RootiestID (auth.rootiest.dev) is the one account you use to sign in to the services. We keep:

your username, display name and email address, and a profile picture if you add one;
the public half of each passkey you register. The private key never leaves your device or password manager;
the groups you belong to, which decide which services you can use;
a security log of sign-ins and account changes, with the IP address, browser and time of each.

When you sign in to a service with RootiestID, that service receives your username, display name, email address and groups, and keeps its own account record for you. Some services sit behind a shared sign-in check that sets a cookie on rootiest.dev, so you aren't asked to sign in again on every page.

Chat

Chat (Mattermost) keeps your messages, files and profile. If you use the mobile app, new-message alerts pass through Mattermost's push service and then Apple or Google. The alert only says that a new message arrived, never what it says. We have turned off Mattermost's usage reporting.

Rootiest AI

Rootiest AI (LibreChat) keeps your conversations, the files you upload and the search index built from them. When you send a message, the conversation and any attached files go to the company behind the model you chose: OpenAI, Anthropic or Google. It handles them under its own API terms and privacy policy. If you use web search, your search goes to Google. Our server log records errors, which can include details of the request that failed, so we can fix problems.

Notes, Joplin and Obsidian LiveSync

These keep your notes and attachments. Joplin and LiveSync both offer end-to-end encryption: if you turn it on, we can't read your notes.

Photos

Photos (Immich) keeps your photos and videos, with the details inside them, such as where a photo was taken. Face and object recognition run on our own server, and nothing goes to an outside AI service. The map view loads its map from Immich's public map service, directly in your browser.

Files, Drive and share links

Files and Drive keep what you upload and the share links you create. Anyone who has a share link can open it. Files logs each transfer, with the IP address, for security.

Pages

Pages on pages.rootiest.fyi are public. Pages under a private path need a RootiestID sign-in.

Git and Gists

Git (Gitea) and Gists keep your repositories, issues, comments, gists, SSH and signing keys, and profile. Anyone can see public repositories and gists, and some public repositories are copied to GitHub. Your email address shows on your Git profile unless you turn on Keep email private in your settings. We log each Git request (IP address, page and browser) to deal with abusive crawlers. The log is limited in size, so older lines are deleted within days. Git sends account emails through Proton.

Short links

rootiest.link (Kutt) keeps the links you create; anyone can also create one without an account. Each visit to a short link is counted with its time, the referring site, the browser and operating system, and the country worked out from the visitor's IP address. The IP address itself isn't kept. Short links sends account emails through Proton.

Coding stats

Coding stats (Wakapi) keeps the activity your editor plugin sends: project and file names, languages, editor, operating system, machine name and times.

Password vault

The password vault (Vaultwarden) is encrypted on your device before it reaches us, so we can't read it. We keep your email address, the encrypted vault, your list of devices and your sign-in events.

Push notifications and MollySocket

Push notifications (ntfy) need an account and keep the messages on your topics for up to 7 days. MollySocket keeps the connection details the Molly app gives it, so it can tell your phone that a Signal message is waiting. It can't read your messages.

Bluesky

Our Bluesky server keeps your Bluesky account (email address and a hashed password) and your public record of posts, likes, follows and profile. That record is public by design: it is shared with the wider AT Protocol network, including Bluesky's own services, which have their own privacy policies.

Cookies

rootiest.com sets none. The other services use only the cookies they need to work: sign-in sessions, security tokens and display settings such as light or dark mode. We use no advertising or analytics cookies.

When you contact us elsewhere

If you email us or message us on Discord, Bluesky, Mastodon, Lemmy or Matrix, we receive what you send and your profile on that platform. Those platforms are run by other organizations under their own privacy policies.

What we don't do

We don't sell or rent your data, use it for advertising or profiling, or use your content to train AI models.

Legal basis

For visitors in the EU, UK and similar jurisdictions: we process your account and content to provide the services you sign up for (GDPR Article 6(1)(b)). We keep security logs, backups and rate limits because of our legitimate interest in keeping the services safe and working (Article 6(1)(f)). Where the law requires us to keep or disclose data, we do so to meet that obligation (Article 6(1)(c)).

Who else receives it

Rootiest staff, who run the services.
RackNerd and Contabo, which provide the hardware for the servers we rent. We run the servers and the services ourselves.
Tailscale, which connects our servers over encrypted links. It can't read the traffic.
Cloudflare, which runs the DNS for our domains, forwards mail for rootiest.org and carries traffic for a few addresses that only redirect.
Backblaze, which stores our backups. They are encrypted on our server first, so Backblaze can't read them.
Proton, which runs our mailboxes and sends account emails from Git, Short links and Joplin.
OpenAI, Anthropic and Google, only when you use Rootiest AI with one of their models, and Google for Rootiest AI's web search.
Mattermost, Apple and Google, only for Chat's mobile alerts, which carry no message text.

We don't share your data with anyone else, except where the law requires it or to protect someone's safety.

Where the data is kept

Everything is stored in the United States:

RootiestID and most services run on a server we rent in Ashburn, Virginia, with a standby copy in Buffalo, New York, in case the first fails.
Git and Chat run on a server we rent in St. Louis, Missouri. Git also has standby copies in Ashburn and Buffalo.
Photos, Rootiest AI, Files and Drive run on a server we own in Massachusetts.
Backups go to Backblaze B2 in the eastern United States.

If you use the services from outside the United States, your data is transferred to and stored there.

How long we keep it

Your account and content: until you delete them or ask us to close your account. We then delete them from the services within 30 days.
RootiestID's security log: about 90 days.
Git request logs: a few days, until the size-limited log overwrites them.
Push notification messages: 7 days.
Coding stats: until you delete them.
Rootiest AI's server log: 14 days.
Backups: taken every 4 to 6 hours and kept for up to 6 months, so deleted data disappears from backups within that time.

How we protect it

Every service uses encrypted connections. Signing in uses passkeys. Only Rootiest staff can manage the servers, over a private network with hardware security keys. Backups are encrypted, and the services are monitored around the clock. No system is perfectly secure: if a breach affects your data, we'll tell you promptly, as the law requires.

Your rights

Depending on where you live, you may have the right to:

ask what personal data we hold about you and get a copy;
have it corrected or deleted, or your account closed;
object to or restrict how we use it;
receive your data in a portable format. Most services also let you export it yourself;
complain to your local data protection authority.

To use any of these, contact us. We may need to check that the account is yours, and we'll answer within 30 days.

Children

The services are not meant for children under 13, and we don't knowingly collect data from them. If you think a child under 13 has given us data, contact us and we'll delete it.

Changes

If what the services collect changes, we'll update this notice and the date at the top. For significant changes, we'll also give notice on the status page or by email before they take effect.

Contact

Open a request on the support desk under Privacy & Data Request: support.rootiest.dev/new?category=privacy (sign in with RootiestID).

No RootiestID? Use the email form at support.rootiest.dev/guest, choose General Questions, and say it's a privacy request.