What Knoll keeps

Your account

A name, and the number that comes with it (Mossy#3); the last fifty names the account has gone by, and every name and number it has been given, so that none is ever handed to somebody else; your secret word as a one-way scrypt hash, never the word itself; when the account was made and last seen; and a small picture, if you give it one.

Your email address is not stored. Knoll keeps a sixteen-character fingerprint of it (the start of its SHA-256 hash), which is how the gate finds your account when you log in. The fingerprint is also the account's id: it stands beside your edits, posts and photos, so somebody who already knows your address could work out which account is yours.

When you sign up with an email and a password, or ask to reset a forgotten password, a six-digit code is emailed to the address you typed. The email is sent through Resend, which handles the address to deliver it and keeps its own record of what it sent. Knoll keeps a one-way hash of the code for ten minutes, and the address not at all. A password reset signs the account out everywhere it was signed in.

The one place an address is kept is the waiting list on the coming-soon page. If you leave yours there it is kept, with the date and the interest you chose, for the one email that says the wall has opened, and until you ask for it to be taken off.

As you use the walls, Knoll counts on your account: the days on which an edit of yours went live (your standing); how many of your edits went live, waited, were approved, turned down or reverted; the votes you cast; and any strikes against it.

Your name and number, your picture, the month you joined, your standing, and how many of your edits landed and votes you cast make a card that anybody can read. So do the two stickers on your yard: your number among the first hundred thousand accounts, and the month you first opened TOEM 2 while signed in. The rest of the count, a ban or a watch on the account, and when you were last seen are for Knoll's moderators.

Signing in with Google or Discord

Knoll asks Google for your email address and nothing else (the openid and email scopes). It is used once, to find or make your account the same way, and is not kept — nor is anything else from your Google account.

Knoll asks Discord who you are and for your email address (the identify and email scopes, which are the least Discord offers for it). Only the address, and that Discord has confirmed it, is read; it is used once, the same way, and is not kept — nor is your Discord name, picture or anything else from your Discord account.

Cookies

knoll_s is your session: ninety days, or until the browser closes if you asked not to be remembered, and no script on any page can read it. knoll_in says which account is signed in, so pages can draw your corner. knoll_o lives ten minutes, while Google or Discord signs you in. Knoll sets no advertising or tracking cookies. Visits to a yard are counted, without a cookie: see Counting visits.

What you make

Your yard, your edits to the walls, the notes you pin, the spaces you create (their names, colours and pictures), what you write on a space's board and in its chat, the photos you hang in its album and the hearts you give, your friends, friend requests, invites, and the notifications about them.

Your yard, your spaces, your tag, your edits once they are live, and your posts, chat lines and photos are there for anybody to see, signed in or not — that is what they are for. A chat that only some may write in can still be read by everyone, and who moderates a space with its maker is said on the space. Your friends and your bell are yours alone.

While you have a wall open and are signed in, the page tells Knoll so about every half minute, and the others signed in on that wall can see your name and picture among those who are there now; anybody can see how many are. Knoll keeps that for a minute and a half after it last heard from your browser, and no longer. What is kept is the first time you opened that wall while signed in: it stands, with your name, in the wall's history, which its moderators read on its dashboard beside the edits that went up.

A wall keeps a list of its last five hundred changes — who, what kind and when — and each change in full for a hundred and eighty days. An edit that waits for review lapses after a week; once decided, its record is kept a month, and for that month the moderators can see who voted which way. A yard keeps its last forty saves, which can be opened as the yard can. A board keeps the newest hundred entries of a tab, five hundred of a forum and two hundred lines of chat; an album, its newest two hundred photos. A photo taken down is deleted from the store, but copies may stay in browsers and in the network's caches for up to a year.

The moderators keep a record of what was done as moderation — roles, bans, watches, reverts, strikes, and posts or photos hidden, each with the account it was done to — the last thousand entries.

A change you propose to another gnome's page is kept, with your tag and the line you wrote with it, for them to take or leave: a week while it waits, and a month once it is decided. Your bell keeps the last fifty things it was told — who asked to be your friend, what was proposed to your page, what became of what you sent, and what happened at the spaces you moderate — and when you last opened it.

Your network address

Not stored as it is. A salted one-way hash of it is used to slow floods of posts, and to keep anybody from approving or voting on their own edits: for an hour in the counters, and for up to six weeks beside an edit, a vote or a proposal, until its record lapses. It is shown to nobody.

Vercel, which serves the site, sees your address as any host does, and keeps its own logs for a short while.

Other people's pointers

On a wall you see where other visitors' pointers are, and they see yours. The pointers go from browser to browser, not through Knoll. To find each other, your browser announces itself on five public relays of the Nostr network, and asks Google's and Cloudflare's servers what its own address is, when the page has opened — whether or not you move your pointer.

Those who run the relays and those servers, anyone listening on the relays, and the other visitors of the page can learn your network address and when you came and went; never your name, your account or what you drew. Knoll stores none of it. A browser with WebRTC switched off announces nothing, and shows no pointers.

Counting visits

When you leave a yard, your browser sends one line to a Google Sheet that Knoll keeps: whose yard it was, a random id kept in your browser's storage (so that two visits from one browser count as one visitor), whether you were on a phone, a tablet or a desktop, how long you stayed, and the site you came from, if there was one. Your name, your account and your address are not in it. It goes to Google, which may read cookies of its own if your browser sends them.

The yard's owner sees the sums on their dashboard. The lines name nobody, and they are not secret: the counting script gives a yard's lines to whoever asks it for them.

A like or a note left on a yard's fence is kept in the same sheet: the note, the name given with it, and the same random id. The notes on a fence are there for anybody to read.

Things from elsewhere

Some of what a page shows, your browser fetches from somebody else, who sees your network address as any site does, and is sent neither your name nor your account. A video pinned to a wall shows a still from YouTube as soon as the wall is drawn, and plays from YouTube's no-cookie player only when you press play. A gif pinned to a wall comes from KLIPY. An album's photos come from Vercel's file store. Some pages — the yard and the dashboard among them — fetch the React library from unpkg, and their lettering from Google Fonts.

On your device

Knoll keeps things in your browser's own storage: how you arranged a page, your own copy of a wall or a yard and the tracings you made for it, your settings and your unsent drafts, your account's picture, which yards you liked, when you last looked at a board or an album, and the random id that counts your visits. Clearing the site's data there removes them.

Where it lives

Knoll is hosted by Vercel, which also keeps the yards' files and the albums' photos, and its records are kept by Upstash; both in the United States. The emails that carry a code are sent by Resend, also in the United States. The visit counts, the fences and the waiting list are kept in a Google Sheet in Knoll's own Google account.

Nothing Knoll keeps is sold, or shared for advertising. It is handed over only where the law requires it.

Children

Knoll is not for anyone under 13, and does not knowingly keep anything about a child younger than that. If you think one has made an account, write to contact@knoll.space and it will be taken away.

Taking it away

Write to contact@knoll.space from the address you signed up with, and within 30 days your account will be deleted: its record and its counts, its names, picture, friends, invitations and bell, its yard with its fence and its visit counts, and the spaces it made.

What you put on a wall or a board that others share stays where taking it out would change their work or the wall's history. It carries the account's id, which is not your address, and in a wall's history the name the account went by at the time.

The same way, you can ask for a copy of what Knoll keeps on your account, or for something to be put right; your name, your picture and your yard you can change yourself. Where you live may give you more rights than these — in the European Union, the United Kingdom or California, for instance — and you may complain to your data protection authority.

When this page changes

The date at the top says when this page last changed. A change that matters is said on the site before it takes effect.