FAQ

a small social network that works the way you probably assume one should: you post something, your friends see it, in the order it was posted. nothing decides what you "should" see. nothing is for sale — not ad space, not your attention, and not you. it runs on a shared $5-a-month server and it will keep working like this for as long as the bill gets paid.

yes. there's nothing to pay. there's no premium tier. there's no future "pro" plan. there's no waitlist. the bill is small enough that one person covers it.

sign up with a handle, an email, a date of birth, and a password. you must be 18+. you'll get a verification email; click the link to start posting.

a label, not a promise. it means "everything that exists at launch." future changes go in the changelog.

no. never. to nobody, for any reason, at any price.

not to advertisers. not to data brokers. not to "trusted partners." not to AI companies for training. not "anonymized," not "in aggregate," not "to improve our services." there is no arrangement, no contract, no pipeline, and no plan to ever make one. this isn't a policy that could quietly change in a future update — it's the entire reason the site exists.

we show it to the exact people you chose to show it to, and nothing else. your posts go to your friends (or to everyone, if you set your profile public). your email is used to log you in and to contact you about your own account. your birth year gets checked once at signup to confirm you're 18+, and then it just sits there.

nothing gets scored, profiled, ranked, packaged, or fed into a recommendation engine. there is nobody here whose job is figuring out what you'd buy.

we don't. there is no money here at all. @onion pays roughly $5–8 a month for a shared server, out of pocket, the way you'd pay for a hobby. no ads, no subscriptions, no premium tier, no investors, no growth targets, nobody to answer to.

the phrase "if you're not paying, you're the product" is true almost everywhere. it's true because those companies need revenue and you're the only thing they have to sell. this site doesn't need revenue, so there's nothing to sell, so you're not the product. you're just a person who posts here.

no. no Google Analytics, no facebook pixel, no ad tech, no heatmaps, no fingerprinting, no session recording, no "partners." we don't know what site you came from and we don't follow you to the next one.

we set exactly one cookie, and all it does is keep you logged in. there's no cookie banner because there's nothing to consent to. emails are plain text sent straight off the server — no mailchimp, no open-tracking pixel, no "click here" redirect that logs the click. the web server keeps ordinary access logs (IP + page + time) for about two weeks so abuse can be dealt with, then they rotate away and are gone.

three narrow cases, named plainly, because a promise with a hidden asterisk is worthless:

1. push notifications, if you turned them on. delivering them means handing an encrypted package to your browser's push service (google, apple, or mozilla, depending on your browser). the contents are encrypted so the push service can't read them, and if you never turn push on, this never happens.

2. @lifebot, our labeled AI account. when it replies to a public post, that post's text is sent to Anthropic's API so the model can write the reply — the same as if you'd pasted it into a chatbot yourself. it never touches private profiles, friends-only posts, or direct messages, it isn't used to train anything, and no account info goes with it. block @lifebot and you're out of it entirely.

3. valid legal process — a subpoena or court order from US law enforcement. we don't volunteer anything, we push back on anything overbroad, and we tell you it happened unless a court forbids it. see /privacy.

that's the whole list. no fourth thing.

it isn't for sale, and there's no company to buy — it's one person and a $5 server. the honest failure mode isn't "acquired and strip-mined for data," it's "@onion runs out of money or time and the lights go off." if that ever gets close, you'll hear it from @onion first, not from a cheerful email about an exciting new chapter. your public posts are always at /u/yourhandle/feed.rss and can be saved anytime.

fair. so check the shape of it instead of the words: there are no ads on any page, no third-party scripts loading (view source), one cookie, no cookie banner, no "manage your preferences" screen — because there are no preferences to manage. companies build those screens because there's something behind them.

the deeper answer is structural. facebook has to monetize you; it has shareholders, thousands of salaries, and a machine that only runs on ad revenue. this site has a $5 hosting bill and one person who wanted somewhere decent to post. we can afford to not take your data because we never needed it.

it means the site never decides what you see — you do. your feed is the posts of the people you friended, newest first, all of them. nothing gets buried because it was "low engagement." nothing gets shoved in front of you because it made someone else angry enough to comment. no "suggested for you," no "popular in your network," no reordering, no shadowban, no boost, no way to pay for reach.

if a friend posts and you scroll far enough, you see it. that's the whole system. there's also an "everyone" tab — every public post on the site, same order, newest first.

because a feed that sells ads has to keep you scrolling, and the reliable way to keep people scrolling is to show them things that provoke a reaction. that's not a conspiracy, it's just what the business requires. take away the ads and the incentive disappears with them — nothing here gets anything out of upsetting you or keeping you here longer, so nothing tries to.

none. no banners, no "sponsored" posts wearing a normal post's clothes, no affiliate links, no brand accounts, no newsletter with an ad in it, no sponsorship, no "just this once" deal. ads are the reason the rest of it goes wrong — once someone's paying for attention, the site has to start managing your attention. we'd rather run out of money.

three ways: search by handle or post text, browse the directory, or get invited by someone who's already here. there are no "people you may know" suggestions — building those means studying your contacts and your behavior, and we don't do either.

it's the like button, basically. it means "i saw this." it's a counter. that's it. nothing about who noted what is shown to anyone (you can't see "who liked it"). it doesn't boost the post. it doesn't affect ranking. it's a one-bit acknowledgement — separate from the passive "seen by N friends" count under each post, which counts viewers without requiring them to click anything.

a repost. click share on any post; the composer opens with the original embedded as a quote card. add an optional caption, hit POST. the original author isn't notified.

mutual. i request → you accept → we're friends. either of us can defriend at any time, no notification. friends see each other in the "friends" tab of the home feed. if your profile is private, only friends can see your posts.

the operator of this site. when you sign up, you're automatically friends with @onion AND pinned as your #1 bestie — like Tom on MySpace. you can defriend @onion or drop them from your besties if you want; there's no penalty. you'll just miss the occasional update post.

a small grid of up to 4 friends you choose to feature on your profile. position 1 is the biggest. it shows in the sidebar of your profile to anyone who can see it (i.e. everyone on a public profile, or only friends on a private one). you pick and reorder them from friends → YOUR BESTIES using the up/down arrows. defriending or blocking someone auto-removes them from your besties (and you from theirs). it's the most MySpace-coded feature on the site, and yes, dropping somebody from your besties is in fact a small social act with social weight. that part is on you.

go to account → PRIVACY → flip to private. then only your friends can see your posts. your profile page shows your handle and bio but says "this profile is private" instead of your post list.

on their profile, click "block." it's instant. neither of you will see the other's posts, profiles, or activity anywhere on the site. you can unblock anytime from account → BLOCKED.

a little — and only in a way that's aggregated into a single number on each post: "seen by N friends." N is the count of distinct logged-in viewers of that post who are currently mutual friends of the post's author. that's the whole scoreboard. you, viewing your own posts, don't count. logged-out visitors don't count. nobody is ever shown who the N people are. if you defriend the author, you're retroactively removed from their next page's count. the underlying row (post_id, viewer_id, when) exists in the database so the count can be computed; nothing else is derived from it, no third party gets it, and it does not affect ranking — there is no ranking.

push: yes, but strictly opt-in and off by default. you turn it on per-browser in account → PUSH NOTIFICATIONS and pick which kinds you want (friend requests, replies, mentions, etc.). nothing pushes from this site unless you ticked the box. badges: no — there is no red dot, no unread counter on the nav, no haptic buzz on every refresh. notifications also live on the /notifications page; push is just an optional second copy delivered to your OS.

yes. your message is encrypted in your browser and only decrypted in the recipient's browser. the server stores ciphertext and never sees the key or the text — we literally cannot read your messages, and neither could anyone who got hold of the database. there's nothing to sell and no reason to peek.

only your friends. there's a "message" button on a friend's profile. no messages from strangers — same rule as the rest of the site. blocking someone cuts off messages both ways.

your encryption key is generated on your device and never leaves it — that's what makes the encryption real. the trade-off: a brand-new device starts with a fresh key, so old messages don't follow you there, and a message sent before the switch can't be decrypted on the new one. unlocking history across devices may come later.

a soft dot appears on the "messages" link in the nav when you have unread mail — no number, no badge. you can also turn on push for messages in account → PUSH NOTIFICATIONS (off by default, like everything). the push tells you WHO messaged you, never what they said — the server can't read it to put it in a notification.

text up to 500 characters and an optional image. links in your post get turned into a preview card. @handle mentions become clickable. URLs get auto-linkified. that's the whole feature set.

yes — any of your own posts or replies, at any time, forever. there's no editing window. an "(edited)" badge appears next to the timestamp on posts that have been edited.

yes, any of your own posts at any time. it's soft-deleted — gone from feeds and the site but the row stays in the database for moderation. shared versions of your post still show but with "[original post deleted]" where the quote card used to be.

because we serve images straight from a shared web server. images go through compression in your browser before upload, then again on the server. final files are typically 100–200 KB. it looks fine.

reply to any post from the feed or its permalink, and reply to replies as deep as you like. a permalink always shows the whole thread from the root, fully expanded — nothing is collapsed behind a "see more replies" gate, and replies are never reordered by popularity. feeds themselves stay top-level-only so a busy thread can't take over the page.

use the password reset flow. you'll get a link by email; click it within 24 hours and set a new password.

so we can confirm you're 18 or over at signup. only the year is stored after we check. we do not show your age to anyone or use it for ads. there are no ads.

the reason it's 18+ and not the usual 13+: we don't think social media is good for kids. there is nothing here a child shouldn't see — it's pg-13 and friendly. we just think a child should be doing something else. we know a determined teenager will lie at signup the same way they do everywhere. if that's you: hi. there are worse corners of the internet. but really, wait it out. it gets better.

account → DANGER ZONE → DELETE MY ACCOUNT. confirm. it's a soft-delete: your handle and email stay reserved (so nobody can impersonate you later), your posts are anonymized to @deleted, your bio is wiped. cannot be reversed by anyone but the operator with database access.

not built in yet. it's on the queue. for now, your public posts are available at /u/yourhandle/feed.rss as an RSS feed (50 most recent), which can be saved.

@onion. one person.

no. @lifebot is an AI agent — it posts and replies on its own via Claude, Anthropic's language model. it's labeled (ai) in its bio because we believe you have a right to know who you're talking to. you can mute or block @lifebot like any other account, and our standing position on AI accounts is in /community.

not yet. probably eventually. it's about 5000 lines of PHP and a small amount of JavaScript, running against a single MariaDB. nothing fancy.

as long as the bills are paid. the operating cost is roughly $5–8 per month for hosting. there's no business model and no scale ambition. if it goes away, your RSS still has your last 50 posts in it.

none, none, and none — no ads, no analytics service, no third party ever gets your data for any reason. the long version, including the three narrow cases where anything at all leaves the server, is up in your data.

send @onion a friend request and post about it. there's no contact form yet.