Ferrum
Sign in Create account
Menu

Privacy

What is recorded, what is not, and how long each of them is kept.

Last updated 7 September 2026

Ferrum is a code editor and a marketplace, run by one person. There is no advertising, no analytics service, no tracking pixel and nothing sold to anybody. This page is written from the code rather than from a template, so where it says something is not collected, that is because there is nowhere in the system that collects it.

Ferrum is in beta and the system is still changing. Where something is uncertain or not yet built, this page says so instead of leaving the impression it is settled.

Using the site and the editor without an account

The editor works without signing in, and most of this site can be read without signing in. Two things happen anyway, and neither of them identifies you.

Checking for updates. The editor asks the release server whether there is a newer build. That request carries three things: your platform, the release channel and the version you are running. It carries no account, no identifier for your machine and no name. Nothing is written down when it arrives — there is no record of update checks, because there is nothing in the request worth keeping.

Downloading a plugin or a theme. Installing something from the marketplace adds one to a counter: a lifetime total for the package and a total for that day. No account, no machine and no address is attached to it, and there is no row anywhere recording that a particular download happened. The counter cannot be taken apart into the downloads that made it up.

What an account holds

Creating an account stores:

  • Your email address, which is how you sign in and how sign-in links reach you.
  • Your password, hashed with PBKDF2. The password itself is never stored and cannot be recovered from what is. An account created through a sign-in link has no password at all.
  • A public profile: a username, and optionally a display name, a short bio and a picture. All four are shown to anybody who visits your profile page or a package you published.
  • The dates the account was created, confirmed and, if it ever is, disabled.

Two consequences of how this is built are worth stating plainly rather than leaving to be discovered.

A profile picture is public once uploaded. It is served from a storage bucket that does not require signing in, at an address containing your account's internal identifier. Anybody who knows or guesses that address can fetch the picture, whether or not they can reach your profile page.

An old email address survives a change. Every sign-in link and address-change confirmation records the address it was sent to. Those records are not deleted when they expire, so changing your address adds a new one rather than replacing the old.

Connecting an editor to an account

Signing the editor in creates a long-lived token in place of a password. Alongside it, two things about your computer are stored.

Its name. The credential is labelled with your computer's hostname — "Ferrum on WORKSHOP", for instance — so that the devices list is legible when you are deciding which one to revoke. If your computer is named after you, that name is stored.

A machine identifier. This is a SHA-256 hash of the identifier your operating system already keeps for itself: the MachineGuid registry value on Windows, /etc/machine-id on Linux, the platform UUID on macOS. It is not a MAC address, not a disk serial and not a fingerprint assembled from your hardware, and it cannot be turned back into the value it was made from. It is stable across reinstalling Ferrum, and it identifies a computer rather than a person.

The identifier exists so that a machine can be blocked after abuse. If that happens, the hash is kept on a blocklist indefinitely, and it stays there whether or not the account it came from is still around — that is the point of it: an account can be made again, and a machine is harder to replace. A machine that has never been blocked appears only against your own credentials and sessions.

Time tracking, and the year-in-code page

A signed-in editor reports what you are working on, which is what the activity page adds up. This is the most detailed thing Ferrum records about anybody, so it is worth being exact.

While you are actively editing, the editor sends a short message roughly every half minute. Each one carries the project name and the file path relative to that project, and nothing else about the file. It does not send the file's contents. It does not send an absolute path — the server rejects one outright, specifically so that home directory names and machine names stay off the wire. The programming language is worked out at the server from the file extension rather than sent. How long you worked is measured by the server from when the messages arrive; a duration claimed by the editor is not accepted.

How long each part of that is kept:

  • The individual messages are deleted after fourteen days, by a job that runs every hour.
  • The daily totals — seconds per project, per file, per day — are kept indefinitely. So is the hourly breakdown that the punchcard is drawn from. These are what make a summary of a year ago still readable a year later, and they are a record of which files you worked on and when, going back to the day you first signed the editor in.

Your timezone is not stored. The activity page reads it from your browser and puts it in a ferrum_tz cookie so the server can convert the hours before drawing them.

The editor also records a rough measure of how far your computer's clock differs from the server's, which is there to catch fabricated totals rather than to say anything about you.

Settings sync

If you turn on sync, your settings, keybindings, editor snippets and interface state are stored as the editor sends them, up to 256 KB each. The server does not inspect or interpret them — what ends up in them is decided entirely by the editor. If a setting holds a file path or the name of a folder you have open, that is stored with the rest.

Shared snippets

Sharing a selection from the editor stores the code itself, along with the file name, the language, the first line number and the theme it was rendered in.

Anybody with the link can read it without signing in. The link is the only thing protecting it: there is no private mode, and there is no expiry. Deleting a snippet from your account removes it and breaks the link at once. Until you do, treat a snippet as published.

Publishing to the marketplace

Publishing is public and meant to be. Your publisher handle, the package name, its description, its keywords, the links you give it and every version you upload are visible to everybody, and remain visible after a package is withdrawn so that people who already installed it can find out why it went. Uploaded archives are served from storage that does not require signing in, and their contents are not scanned — whatever you put in one, you have published.

What is not collected

These are absences in the code, not promises about intent.

  • No IP addresses and no browser user-agent strings are stored. There is no column for either in any table, and nothing in the request handling reads them.
  • No analytics. No Google Analytics, no Plausible, no product analytics of any kind, no tracking pixel, no advertising.
  • No crash or error reporting service. Errors are printed to the server's own console and go nowhere else.
  • No payment processor, because nothing is sold.
  • No sign-in through Google, GitHub or anybody else, so no account is linked to one elsewhere.
  • No marketing email. The only messages sent are sign-in links and address-change confirmations. There is no mailing list and no newsletter to be on.

One honest caveat. Like nearly every web server, the servers write a line for each request to their own console, containing the method and the path. A path can be revealing — the address of a shared snippet appears in one, for instance. These lines are not a database, are not searched, and are not linked to accounts, but they are also not deleted on a schedule.

Other companies involved

Ferrum's database and file storage run on hardware under this operator's control rather than on a hosted service, so the contents of the sections above are not handed to anybody. Two exceptions are worth naming.

Tailscale. This site, the API and the download server are all reached over Tailscale's network, so every connection to any of them passes through Tailscale's infrastructure and their systems see the connection being made.

Google Fonts. Pages on this site load two typefaces from Google's font servers, so opening a page makes a request to Google carrying your IP address and browser user-agent. It is the only request any page here makes to another company, and it sets no cookie. The editor does not do this; it uses fonts already on your machine.

Email is sent for sign-in links and address-change confirmations. Whichever service delivers that mail necessarily handles the address it is going to.

Cookies and browser storage

Nothing here tracks anybody, and nothing is shared with another company. The cookies page lists every item by name and says what it does.

Your data, and getting it back or removed

There is no self-service way to delete an account or to download a copy of what is held. Neither exists in the software yet. Both are done by hand: write to privacy@example.com and say which you want.

Two limits on deletion, stated because they are real rather than because they are convenient. A published package cannot simply vanish with its author — people have it installed, and the registry refuses to remove an account that owns one, so packages have to be transferred or withdrawn first. And a machine blocklist entry is kept deliberately after the account it came from is gone.

Some things you can do yourself, without asking: revoke any connected editor from your devices, delete any shared snippet from your snippets, and change or clear your profile and picture from your account.

Children

Ferrum is not aimed at children and accounts are not knowingly created for anybody under 13. If one has been, write to the address above and it will be removed.

Changes to this page

The date at the top is when the wording last changed. Because this page is written from the code, a change to what is collected is a change to this page, and the intention is that it lands in the same release rather than afterwards.

Getting in touch

privacy@example.com reaches the person who runs Ferrum, which is one person.