What I keep

Privacy is the short version and the one that counts. This is the same thing with the reasoning left in, for anyone who wants to check that the reasons are any good.

The one number I care about

Whether people come back a month later. That's it - it's the only measure I know of that can't be gamed by making the site more annoying. Watch time goes up if I make things harder to find. Clicks go up if I write worse, more baiting titles. Coming back a month later only goes up if the site was actually worth it.

Everything I collect exists to answer that question, and I've tried to collect the least that can answer it.

Signed out

Your browser keeps four things: what you've opened, roughly how far in you got, what you've kept, and what you've taken off your list. That's the copy the site reads to sink watched entries down the page and fill your shelf, and clearing your site data ends it, because there's no other copy of it.

But I should be exact about a thing that's easy to blur, because two of those four have a shadow on my side. When you open an entry the counting records that a page was opened, and when a video plays it records roughly how far it ran - both against the random identifier, not against the browser's copy. So while the browser's own memory never gets uploaded, I could work out roughly the same two facts from the counting. Saying otherwise would be a distinction that only makes sense if you've read the code.

The other two have no shadow. What you've kept and what you've taken off your list are never sent anywhere while you're signed out - no event fires when you press the heart or cross something off, and there's nothing on my side that could reconstruct them. Those are the two you chose on purpose, which is probably why they'd be the ones you'd mind.

Signed in

That browser memory moves onto your account so it follows you between devices. That's the only thing an account does - there's no profile, no feed, nothing to fill in.

Once you're signed in the account is the real copy and the browser's is left alone. That sounds like a detail and isn't: it's what stops two people sharing a laptop from sharing a history. The first time you sign in, whatever that browser already had gets carried up so you don't lose the week you spent browsing before making an account. After that, only your account is read.

Sign out and you're back to whatever that browser had before. Your account keeps its copy; sign in again and it's there.

Which topics get opened

I might look at which topics get opened most, added up across everybody, to decide what to add more of. If half the opens are maths and I've got four maths entries, that tells me where to spend next month.

It's not per person - the question is "how much does this topic pull", and no version of that needs to know who. And what it counts is cards opened on this site: a page I wrote, on a domain I own, which is a different thing from how popular somebody's video is.

To be straight about the part that's easy to fudge: the player does tell me a video started and roughly whether it ran a quarter, half, most of the way, or to the end. So I'm not going to claim I have no idea. What I don't do is turn that into a number against any video or any person - it exists so I can tell whether a topic's notes lead anywhere at all, and it's read as a rate across a whole topic, never as a count.

Nothing from any of this is ever shown on the site. No view counts, no "popular this week", no trending. Those are the things that turn a catalogue into a leaderboard, and a leaderboard is what I'm trying not to build.

What connects to what

Your browser gets a random identifier. The analytics rows hang off that, not off your name or email. If you make an account, there's one table linking the two - and it exists for exactly one job: when you ask me to delete your data from your phone, it's how your laptop's rows go too. Without it, deleting from one browser would quietly leave the others behind.

Nothing else joins those two sides. The topic counts don't know your email; the return-rate maths groups by week and by where people arrived from, never by person.

What I don't do

No ads, ever - not "no ads for now". Ads are what rots recommendations in the first place. No third-party trackers, no advertising cookies, nothing sold or shared with anyone. No profile of your taste, no model of you, nothing that decides what you should see next.

The order is mine, by hand, newest first. Your own history moves things around inside that order and does nothing else: watched entries sink to the bottom, and the ones you started but didn't finish get collected in the rail down the side until you cross them off. Nobody else's history affects what you see, and what you've kept changes nothing about the ordering at all.

The player

Videos play in YouTube's embedded player, which means YouTube sees you when a page with one loads - that part is out of my hands and Privacy spells out what they get.

If this changes

I rewrite these pages before it does, not after. If the site ever hosts video itself it'll collect more than this, and that'll be written down here first.

Anything I've not covered: privacy@cabin.watch.