Legal
How gno.sh handles account data, published content, billing metadata, email delivery, logs, and reader analytics.
gno.sh is operated by Gordon Mickel, Switzerland. Contact: legal@gno.sh.
Pilot cohort keys never contain client or project names. Public pilot reports omit the internal cohort key and use a one-way opaque report identifier bound to the approved aggregate.
gno.sh currently relies on the following infrastructure providers:
If you publish a page as public, the published route, note content, metadata preview, and any included assets are intended to be publicly accessible. Do not publish personal, confidential, or regulated information unless you are entitled to disclose it.
A public snapshot may include a read-only agent projection containing deterministic Markdown, a manifest, and exact evidence locators. This projection contains only the material intentionally included in that public snapshot. Secret-link, invite-only, and encrypted spaces do not expose this projection. gno.sh does not currently offer a token-authenticated private agent API.
Current GNO artifacts include content-free collection egress lineage so you can verify which local boundary governed an export. gno.sh processes only the artifact you explicitly upload; it cannot inspect or synchronize the source collection. Tightening a local GNO policy does not recall an artifact already uploaded. Owners can unpublish or delete public, secret-link, invite-only, and encrypted publications in Studio. Local deletion and hosted deletion are separate operations: neither deletes the other copy.
Unpublishing denies hosted access while retaining the source and its publication history for later use. Delete permanently denies access first, then removes the selected hosted source, associated publications and snapshots, and unreferenced assets through durable background cleanup. Deleting and Cleanup failed are incomplete cleanup states; failed cleanup remains inaccessible and can be retried after refresh or restart. A completed job retains only a minimal content-free operation receipt for safe retries, not its title, body, assets, or secret tokens.
Deleting an imported collection does not remove separately published notes or copies. Assets still referenced by another item remain. Hosted removal cannot recall downloads, third-party caches, or copies published independently. Personal invite-only shares allow their owner by default; organization shares follow the membership and access settings shown in Studio.
Encrypted artifacts are encrypted locally before upload. gno.sh stores and serves ciphertext; the passphrase and plaintext are not server inputs, and readers decrypt in their browser. I cannot recover a lost passphrase or server-decrypt an encrypted share. No subscription, support request, administrator action, or future private agent route changes that boundary.
Reports go by email to abuse@gno.sh. I receive the reported public URL, explanation, any evidence you include, and email sender details. You do not need a gno.sh account to report. Include only information needed to explain the concern; email is not an anonymous reporting channel.
ImprovMX forwards inbound reports to a Google Gmail mailbox. I am the only person who reads that mailbox. I keep report emails, attachments, and correspondence until I manually delete them; there is no automatic mailbox deletion schedule. I use reports to assess abuse, decide restrictions, and handle follow-up and owner review requests manually. I do not automatically forward reports or disclose reporter identities to publishers. Email providers process these messages, and disclosure may be required by applicable law; I cannot promise absolute confidentiality.
The application stores a separate restriction record with owner and publication/source identifiers, an owner-scoped content digest, operator identity, time, status, policy code, and a short explanation visible to the affected owner and operator. It does not copy report emails, reporter identities, attachments, raw content, or secret URLs into moderation records. The digest detects exact content copies within the same owner scope; it is not used to match different owners.
Active restriction records and their digests remain while the block is enforced, including after owner deletion. Deletion still removes the hosted content through the cleanup process described above. Reinstatement removes the active digest restriction. Content-free audit receipts record the operation, operator, target, reason code, time, and resulting state. Audit receipts older than 90 days and inactive restriction records last updated more than 90 days ago are removed by automated maintenance. They are available only through restricted operational access. See Report Abuse, the Acceptable Use Policy, and the Terms for the reporting and review process.
The reader counts page opens, not unique people, attention, or completed reads. Each note has one aggregate counter scoped to its publication. This counter uses no visitor identifiers, IP or user-agent records, fingerprints, referrer breakdowns, analytics cookies, or browser storage. Existing authentication credentials authorize private requests only; they are not retained or repurposed for counting. No third-party analytics service receives these view signals.
Current encrypted exports expose a roster of random note IDs alongside routing and encryption parameters. This reveals the number of notes and identity continuity across exports. It does not contain titles, source paths, plaintext, content hashes, or passphrases. After local unlock the reader verifies the roster and sends only the current opaque note ID with its authorized route. The locked envelope and failed decryptions send no view signal. Older encrypted exports without a roster remain readable and do not contribute views until re-exported.
Small aggregate deltas wait in bounded server memory and normally reach the database every five seconds. The reader requests the first total about five seconds after displaying a note; leaving sooner cancels that request. Refreshes and automated visits can increase totals; blocked signals, crashes, or outages can lose increments. Uncertain writes are discarded rather than retried blindly. New counters start at zero with the September 6, 2026 reader-utilities rollout. Historical reader analytics is not relabeled as these totals or deleted by this change; it remains subject to the existing retention process. Deleting a publication removes its counter. Withdrawal, expiry, and moderation deny access to counts alongside the content.
Reading time and Copy Markdown use the currently authorized note. For encrypted notes, these operations stay in your browser after unlock; neither plaintext nor derived word counts are sent to the server. Copying is an explicit clipboard action and does not send content to an agent. Protected image bytes and access credentials are excluded. These features do not remove essential authentication or unrelated operational and security logging.
The private design-partner pilot is opt-in. Its milestone receipts do not accept document content, query text, raw URLs, evidence spans, or free-form notes. A participant can opt out at any time; later milestone collection stops and their results are excluded from public reporting. Publication approval binds the exact current aggregate fingerprint; a later outcome invalidates that approval until the current aggregate is approved again. Event receipts are retained for at most 30 days. Consent records and de-identified cohort aggregates are retained for at most 365 days, unless earlier deletion is required.
Public pilot results require approval from every active participant, contain aggregate counts only, and suppress non-zero groups smaller than three. Individual participant keys and consent identifiers are never published.
gno.sh uses essential cookies and similar storage for authentication, session continuity, and security. It does not use advertising cookies.
Account and publish records are retained for as long as needed to operate the service, comply with legal obligations, resolve disputes, and enforce the Terms. Hosted content deletion is available in Studio; account deletion remains a request to the privacy contact. Background cleanup is distinct from backup erasure, and deletion does not promise immediate removal from backup copies. Any content retained for a specifically applicable legal obligation remains restricted; it is not made available through reader routes. Retention exceptions do not permit restoring deleted content to public access.
Depending on where you are located, you may have rights to access, correct, delete, restrict, or object to processing of your personal data. To make a request, contact privacy@gno.sh.
I may update this Privacy Policy when the product, providers, or legal obligations change. Material changes will be reflected on this page.