Privacy
mkfifo.com keeps as little as it can. This page lists what it keeps, and what it does not.
What mkfifo.com keeps
- The envelopes of each FIFO, as text. Sealed fields are encrypted.
-
A log of each request that fails (a status of 400 or higher), with only its method, path and status, for example
POST /my-movies 404. The path includes the name of the FIFO. - Your account, after you sign in: your email address, when you first and last signed in, and your home: the FIFOs in it, with their envelopes and notes, and the names of the public FIFOs they link to. Only you can see them, in your home. If you are a subscriber, your one-word FIFOs belong to your home too, with who else may use them. If you make a token for programs, we keep only a fingerprint of it (SHA-256), never the token. "Delete my account" there deletes all of it.
- The groups: the subscribers of mkfifo.com, and the groups that a subscriber makes for their own FIFOs. A group keeps email addresses, with the first and the last day of each one, also after the last day. A group does not show if an address has an account. "Delete my account" deletes your groups, and removes your address from all the groups. A group keeps no list of codes: only the numbers of the codes that people used, until the last day of each code, with no address.
- For the rate limits, a count of the recent actions of each network address, in memory, for at most one hour. Each count is keyed by a hash of the address made with a secret key, not by the address itself. A restart of mkfifo.com clears the counts.
What mkfifo.com does not keep
- No copy of a Request: not its body, not its header fields, and not its email. mkfifo.com reads it, sends the egress, and forgets it. An open editor of the FIFO shows the Request without keeping a copy: when you close the page, it is gone.
- No list of the people who made a FIFO. You need no account to make a FIFO, and a FIFO outside a home does not know who made it. An account knows only its home and the FIFOs in it.
- No Cloudflare Workers request logs, because they could keep the URL and header fields of a request.
- mkfifo.com sends email from noreply@mkfifo.com only for its own FIFOs, such as the contact form, through an email service.
- A FIFO in your home can email you, at the address that you sign in with: at most 10 emails an hour. To email anyone else, your FIFO uses the API of your own email provider, with your key in a sealed field.
Sign in
- Sign in sends a sign-in link to your email address, from noreply@mkfifo.com. When you sign in, mkfifo.com keeps the address in your account, and your browser keeps it in a cookie.
- The link works once, for at most 15 minutes. To count codes and emails, mkfifo.com keeps a hash of the address in memory for at most one hour, never in the database.
-
Your sign-in is the cookie
__Host-auth, with your address and a signature, for 60 days. The "Sign out" button in your home removes it.
Pages of a FIFO
The answer of a FIFO can be a Markdown page on mkfifo.com, and the page can show an image from another https site. Your browser then loads the image from that site: the site sees your network address, your browser, and that the image is on a page of mkfifo.com, but not which page.
Your storage
The storage FIFOs, such as /s3
and /crypt, send each request to rfetch, a separate service on Cloudflare that reads and writes your storage the way rclone does. The request goes with the keys and options you gave, and the file goes through it. Only the query of the URL and the header fields whose names start with
RFETCH_
or RCLONE_
go to rfetch; your other header fields, such as your cookies, do not. mkfifo.com keeps no file and no key, and rfetch keeps none between requests. Put your keys in header fields, not in the URL: a URL can end up in a browser history or a log.
Cloudflare
mkfifo.com runs on Cloudflare Workers. Cloudflare handles every request and email of mkfifo.com.
Questions
Ask us with the contact form.