Privacy Policy

Last updated: 2026-07-14

The short version

No accounts, no emails, no passwords, no trackers. Your identity is your Nostr public key, and everything you publish is public by design.

What we store

A mirror of your public Nostr events, pulled from public relays: long-form posts (kind 30023), profiles (kind 0), and deletes (kind 5). If you claim a handle, we also store it along with your blog settings — theme CSS, about text, and relay list.

Sessions

Signing in with your NIP-07 extension sets one first-party cookie, valid for up to 90 days, that maps to your public key. Nothing else.

Operational data

We keep per-IP rate-limit counters (from the CF-Connecting-IP header) used only for abuse throttling; stale counters are purged on a schedule, within two days of their window ending — not a durable access log. No analytics, no ads, no third-party trackers.

Public by design

Your posts live on public Nostr relays. Deleting a post (NIP-09) is honored by our mirror, but other relays and mirrors may retain copies. Treat everything you publish as permanent.

Third parties

Cloudflare hosts the service, so your IP address passes through it. Cloudflare Turnstile runs only on handle claim, where your IP is forwarded for the bot check. Nostr relays — by default relay.damus.io, nos.lol, and relay.nostr.band, plus any you configure — receive what you publish.

Moderation

An admin blocklist can unlist a blog from this service: it 404s and disappears from discover, search, and NIP-05. Your events on the relays are untouched.

Source

Nostrbook is open source under AGPL-3.0: github.com/sovITxyz/nostrbook.

Contact

Questions about this policy: git@sovit.xyz or open an issue on GitHub.