← Arbiter

Privacy

The CLI

Arbiter runs in your repo and writes plain files there. It makes no network requests on its own. Only publish and pull talk to a server, and only when you run them.

The hosted board

When a project is published to a hosted board, the service stores the published board (the names of screens and pieces of work, their states, decisions, screenshots) and the comments people leave on it. To comment, a visitor signs in with an email link; the service stores that email address, the name they gave (or one taken from the address), and sets a session cookie. Page views are counted with Vercel Analytics, which sets no cookies and identifies no one. There is no advertising tracking.

Boards are visible to anyone with the link and are kept out of search engines. The owner can also give a board a password with arbiter publish --password. The service keeps only a salted hash of it, and a browser that enters it gets a cookie for that board, kept for 30 days. Screenshots are stored at unlisted addresses that only the board links to, so someone who already has one of those addresses can open that image without the password.

When a board is created, or a wrong password is entered on one, the service keeps a keyed, one-way hash of the network address it came from, for one hour, to limit how many boards one address can create and how many passwords it can try. Nothing else about the creator is kept.

arbiter unpublish deletes a board from the service: the board, its screenshots and every comment on it. The repo it came from is unaffected. If you can’t run it (the project folder is gone, say), or a board shouldn’t be up at all, use Report or remove this board at the bottom of the board, and it’s taken down by hand.

Where it lives

The hosted board runs on Vercel with a Supabase database; sign-in emails are sent through Resend. Data stays in those services and is not shared with anyone else.

Questions

Open an issue on GitHub or use the contact link in the footer.