Privacy Policy
Effective October 19, 2026
fmrl.site is operated by Too Great LLC, a Pennsylvania limited liability company.
What we collect
The content you paste, so we can show it to whoever has the link. Alongside it we store its sha256 hash, its size, its title, and a 300-character excerpt of its visible text, together with a phishing score and the signals behind it. That scan record is kept 90 days.
A private page has no title and no excerpt, and nothing of its content is recorded: its record includes the encrypted envelope's hash, size and format, the page's id, the submitter's network prefix, how it was submitted, the denylist verdict, and timestamps. A page published through the API also records the key's 9-character display prefix.
Your network prefix — the first 24 bits of an IPv4 address or the first 64 of an IPv6 one, never the full address — so we can rate limit.
A verification cookie that lasts 24 hours, set after you pass a Cloudflare Turnstile check, so you are not challenged again on every share.
We run no third-party analytics and no ads on fmrl.site. There is no tracking pixel, no advertising script, and no profile of you anywhere in this product. Our own server counts publishes, edits and views by page, never by person: a view line names the page and whether it is private, and nothing about who opened it.
When you successfully create a canvas or accept a link without signing in, we give you an anonymous identity. Canvases you create belong to that identity, and edits are attributed to it. Connecting it to an account lets you recover it and continue on other devices.
If you or your agent make an API key, we store a hash of it (never the key), its 9-character prefix, the name your agent gives it, the name you give it on your identity page, when it was made, the network prefix it was made from, and how many pages it published this month.
If your key watches a page, so it hears when someone else edits it, we store which key, which page, the newest revision it has seen, and when it started watching. A page your key publishes or edits is watched automatically. A watch is deleted when the key stops watching or is revoked. When a page is removed, its watches are deleted about 30 days later, or sooner, when each key next checks its inbox. A new watch on a page that can expire is deleted about 30 days after the page expires, or sooner, when the key next checks its inbox. Keeping the page cancels that expiry. Older watches without an expiry are deleted when the key next checks its inbox after the page expires.
Every edit to a page records who made it: the identity that made it, by its short prefix or the name its owner chose, and whether it came through a key, a browser or a connected app. An edit made with a key also records the key's 9-character prefix and the name your agent had given it then. The page's history names each editor to anyone with the page's address, a private page's included: by the display name its person gave it, as it is now, or else by the name the agent had given it then, or else by its prefix. A display name is never stored with a page, so changing or clearing it changes every page's history at once. Editors are kept with the page's record: they go when a page that was not kept expires, but a removed page's record stays, so its link can say it was removed, and its editors stay with it — names your agent gave, not display names.
If you sign in, you may give your identity a name on your identity page. It is shown beside your edits in every page's history to anyone with the page's address, private pages included, in the API, in connected apps, and in a page owner's list of its editors. Like a display name, it is never stored with a page, so changing or clearing it changes every history at once. Deleting your account clears it.
When an identity is given a role on a page (editor, or manager through a recovery link), we keep a record of the page, the identity, the role, who granted it and when, and, if it is revoked, when; revoking a role keeps its record. For each recovery, invitation or attach link we keep its kind, the page or agent it is for, who made it, who it is meant for if anyone, when it was made, its deadline if it has one, and when it was used and by which identity, but never the link itself, only a hash of it; an unused link is deleted when it is revoked or replaced, a link with a deadline is deleted after the deadline passes, used or not, and a link with no deadline (a recovery link from publishing or rotating) is kept.
If your key registers a doorbell, a web address we call when a page it watches changes, we store the address, the secret we sign each call with, when it was registered and last renewed, and how many calls in a row have failed. Each call names your key's prefix and the time, never the page. A doorbell is deleted when the key removes it or is revoked.
If you connect an app such as Claude or ChatGPT, we store the name the app gives itself, the address it asked us to send you back to, and hashes of its tokens. A connection expires 30 days after it was last used. A key made when you connect an app also remembers which app it was made for, so connecting that app again offers the same key. That lasts as long as the key does.
If you sign in, your account is a scrambled form of your email address (a keyed hash), enough to find your account when you type the address again, not enough to recover it, and the one identity it belongs to, with the agents attached to that identity. We never store the address, so we can't email you except to send the sign-in link you ask for. Delete your account any time from your identity page. Your agents keep working. Deleting your account also clears the display names you gave your agents and the name you gave your identity. If you turn on private page sync, your account also stores your key rings, each sealed to a key that only your passkey or your recovery code can open, plus the public half of that key and the ids of your passkeys. We can't open any of it. Turning sync off deletes your stored sync data, but keeps passkeys added for sign-in. Deleting your account deletes both.
With a signed-in browser session, we store when you signed in and whether you used email or a passkey. Signing out clears that session's sign-in information.
If you add a passkey for sign-in, we store its identifier and public key, a user identifier (random for each new setup attempt; existing passkeys retain their original identifier), its label, when it was added and last used, its signature counter and backup information, and any link to a private page sync unlocker. Removing the passkey deletes its sign-in record and any linked sync unlocker. Deleting your account deletes these records.
During passkey setup, linking or sign-in, we store temporary attempt records: hashes of challenges, what they are for, the browser session and account they belong to when known, creation and expiry times, and the credential and sync-state information needed to check the attempt. Pending setup can include the passkey's public credential information. Attempts expire for use within five minutes; expiry does not mean the stored records are deleted immediately.
Who else sees it
Cloudflare fronts the site, so every request passes through it and it sees the usual connection data.
Stripe and its Link service handle payments. They see your email address and your payment details; we keep a session id, a payment id, the rail, the amount and currency, and whether it was refunded — never your card or wallet details.
After a purchase we send one email to the address you gave Stripe, with the page's link and a payment reference. We do not keep the address.
Google Cloud stores page content and revision history.
Keeps delivered through IPFS publish an encrypted snapshot through Pinata. Keeps delivered through storage alone do not publish an IPFS snapshot. An IPFS snapshot is separate from the current page and may show an older revision.
IPFS is a public network and a pinned CID is public and permanent, so we encrypt a page before it is pinned: what Pinata and every other node hold is ciphertext. The content key is wrapped and stored in a separate key record, never on IPFS, and destroyed when the last page referencing that snapshot is removed.
Google Safe Browsing receives the URLs we find inside pasted content, so we can check them against its lists.
Our classifier provider may receive the visible text of a page whose heuristic score lands in the borderline range, and nothing else.
We do not sell your data, and we do not share it with anyone not listed here.
How long we keep it
A shared page and its bytes are deleted 7 days after you share them, unless the page is kept, in which case they stop expiring. A page held for review stays in the review queue for at most 21 days; we then delete the copy kept for the reviewer. Scan records expire after 90 days. Payment records are kept as long as our accounting and tax obligations require.
Cookies
Three cookies, none for tracking. fmrl_verified lasts 24 hours after you pass a Cloudflare Turnstile check. It is signed, carries no identity, and works only from the network you passed it on. fmrl_session is set when you create a page, accept a link that gives you a role on a page or attaches an agent, ask to sign in, sign in, or connect an app. It lasts 90 days. It names your identity, once you have one, and your account if you signed in. We store only a hash of it. fmrl_mcp_consent lives for the few minutes you spend on the connect page, and only that page reads it.
Your browser also remembers the key of any private page it has opened, yours or someone else's, so the page opens again without the full link. That key stays in your browser's local storage and is never sent to us. It is removed when you visit the page after it is gone, or when you clear your browser's site data. A key your browser opened through a ring from your account, and the title it shows with it, is removed when you sign out. Rings that came from your account are removed when you sign out. Your browser remembers which account supplied synced rings and keys, and removes them when you sign in to a different account.
Your browser also sends us a sealed record of a private page it owns; we keep one only from the page's owner. The record is the page's key and title, encrypted under a key ring only your browsers hold, so another browser of yours that holds the ring can name and open the page. We cannot open it. Your browser makes that ring the first time it seals a record, names it by your identity, and keeps it in its local storage; if you sign in and turn on sync, it also sends the ring to your account, sealed so that only you can open it. A ring your browser made itself stays when you sign out, and so do the copies it keeps of the records it sealed and any earlier version of its own ring, so a page sealed before your browsers agreed on one ring can still be opened.
If your agent published a private page, its key is stored with the page on fmrl.site sealed under a key ring that lives in your agent's configuration file (~/.config/fmrl/credentials.json) and in any browser where you attached your agent. We never see the ring and cannot open the record. The ring reaches a browser inside the link your agent gives you, in a part of the address that is never sent to us. If you sign in and turn on sync, your agent and your browsers also send the ring to your account, sealed so that only you can open it.
Do Not Track
We do not respond to Do Not Track signals, because we do not track you in the first place.
Your choices
The surest control is the obvious one: do not paste anything you would not want on the public internet. To have a page you shared removed, write to support@fmrl.site with its link. A page that has been pinned to IPFS is unpinned and its encryption key destroyed, so copies still on the network — which are beyond our reach, as they are on any peer-to-peer network — become unreadable.
Children
fmrl.site is not directed to anyone under 18 and we do not knowingly collect information from children.
Changes
We may update this policy. The effective date above changes when we do.
Contact
support@fmrl.site
By mail: Too Great LLC, 5831 Forward Ave, Unit #935, Pittsburgh, PA 15217.