Privacy policy

Last updated October 19, 2026

The short version

• No ads, no analytics, no tracking cookies, and nothing is sold or shared for marketing.
• You can read FediDB without an account. The only cookies are a session cookie and a security token.
• If you sign in, FediDB keeps your public fediverse profile details, never a password or an email address, and never a token that can read your account.
• Edits you make to the wiki and listings are public and credited to your handle.
• The crawler collects information about servers, not people, plus the public profiles of a small set of popular accounts.
• Ask us to see, correct or delete what we hold about you at [email protected].

Who runs FediDB

FediDB is run by Pixelfed Inc. ("Pixelfed", "we", "us"), based in Alberta, Canada. We are responsible for the personal information described here. For anything about privacy, email [email protected].

Visiting the site

Cookies

FediDB sets two cookies, both on .fedidb.com:

• fedidb_accounts keeps you signed in. The site checks for it on every page, so visitors who never sign in get one too; it holds nothing about them. It expires after 14 days without use.
• XSRF-TOKEN protects forms from being submitted by other websites. Same lifetime.

There are no advertising, analytics or third-party cookies.

Stored in your browser

Some conveniences are kept in your browser's local storage and never sent to us: your light or dark theme, a short-lived copy of public data so pages load faster (up to 15 minutes), and in Pub Explorer your last 10 lookups and whether you chose to show explanations or remote images. Clearing your browser's site data removes them.

IP addresses

We use your IP address to limit how often forms and tools can be used, so they can't be abused. These counters last from one minute to 24 hours and aren't linked to an account. Our application doesn't log visitors' IP addresses, though our hosting may keep standard web server logs (IP address, time and page requested) for a short time for security and troubleshooting.

Other services your browser contacts

• The server map loads map tiles from OpenFreeMap.
• Avatars on the popular accounts list may load from the account's own server when we don't have a copy yet.
• Pub Explorer only shows images from other servers after you click Load images.

Fonts and icons are served by FediDB itself.

Signing in

You only need an account to edit the wiki, suggest apps or manage a server's listing. You sign in with an existing fediverse account in one of three ways: through your server's sign-in page (OAuth), with a code we send you by direct message from @[email protected], or with a code you add to your bio.

What we keep

• Your handle, display name, profile link, avatar and when your account was created.
• Which software your server runs, and whether your server reports you as an admin (used to verify server ownership).
• Your follower and following counts and whether you've marked your profile as discoverable, refreshed at most once a day.
• Your role on FediDB, when you last signed in and, if a moderator suspends you, why.

We never receive a password or an email address. With OAuth, your server gives us a one-time key, which we use once to read your profile and then hand straight back; we don't store it. Sign-in codes sent by message are stored only in a form that can't be read back, and expire after 20 minutes.

We keep our own copy of your avatar so that showing it doesn't tell your server who is looking at FediDB.

Your public profile

Everyone who has signed in has a profile page at /u/@[email protected] showing your handle, display name, avatar, role, when you joined, how many edits you've made, which servers you manage and your published edits. Follower counts are hidden if your profile isn't discoverable. Profile pages ask search engines not to index them. Rejected or hidden edits and moderation notes aren't shown.

Edits, uploads and listings

• Published edits are public, with your handle, the date and your summary, on the page's history.
• Edits waiting for review, and the reasons edits are rejected, are seen only by you and the moderators.
• Uploaded images (logos, icons, screenshots) are re-encoded and stripped of metadata such as location, then kept privately until a moderator approves them.
• Moderation actions are recorded in a log only staff can see. The log is never edited or deleted, so it stays accurate.

If you verify that you manage a server, your handle is shown as its manager. Anything you add to the server's details, including a contact email, is public.

Messages and replies to FediDB accounts

FediDB has fediverse accounts: @[email protected], @[email protected], @[email protected] and the stats bots.

• Direct messages to these accounts are stored and read by the FediDB team. Up to five attached files per message are copied and kept privately. Sign-in code conversations nobody replied to are deleted after 14 days. If you delete a message on your server, we delete it too.
• Following one of these accounts stores your handle, name, profile link and avatar. Followers who aren't discoverable aren't listed publicly. Unfollowing removes you.
• Public replies, likes, boosts and quotes of blog posts are stored and can be shown on the post, with your name and avatar. Replies are reviewed before they appear. Deleting your reply, or your account, on your server removes it here.

What the crawler collects

FediDB's crawler (FediDB/0.5.0) visits fediverse servers to build the directory and statistics. It collects information about servers:

• The server's public NodeInfo document: software, version, user and post totals, and anything else it publishes.
• The server's public instance information where available, such as its description, rules, languages and contact account. The contact account's handle may be shown on the server's page.
• The server's IP address, network provider and approximate location, looked up from IP geolocation databases (DB-IP and MaxMind) and RIPE's IPmap service. Locations are rounded to about a kilometre. IP addresses are never published.
• Whether its robots.txt allows FediDB.

For a small, hand-picked set of popular accounts it also reads the public profile: name, bio, avatar, profile fields, follower, following and post counts and when the account was created. It never reads posts, private content or anything behind a login. To have an account removed from that list, email us.

Server operators can block the crawler with robots.txt; see data sources.

Tools

• Pub Explorer fetches what you ask for from our server and keeps the result for up to a minute so repeat lookups are fast. Lookups aren't linked to you or kept afterwards.
• Submitting servers keeps the result of each check for 24 hours so the page can show it. We don't record who submitted a server.

Datasets and the API

The public datasets and API contain information about servers and software. Datasets contain no information about individual people.

Who we share information with

We don't sell or rent personal information, and we don't share it for advertising. We use service providers to run FediDB, such as hosting and file storage, who handle data only on our behalf. We may disclose information if the law requires it, or to protect FediDB, its users or the public from harm. When you sign in or message one of our accounts, your own server naturally knows that too.

Our providers may store data outside your country, including in Canada and the United States.

Why we use it

We process personal information to run FediDB as you'd expect (signing you in, crediting your edits, answering messages), for our legitimate interest in keeping an accurate, safe directory of the fediverse (crawling public server information, moderation, preventing abuse) and, for remote images in Pub Explorer, because you chose to load them.

How long we keep it

Your choices and rights

You can ask us to show you what we hold about you, correct it, delete it or stop using it, and you can object to how we use it. Depending on where you live (for example under Canadian privacy law or the GDPR), these may be legal rights. Email [email protected] from, or mentioning, the fediverse account involved; we may ask you to confirm it's yours by message. We'll answer within 30 days.

If you ask us to delete your account, we remove your profile, avatar and sign-in details. Edits that were published stay part of the page's history, as the licence requires, but are no longer credited to your handle. Moderation log entries are kept.

If you're unhappy with our answer you can complain to a privacy regulator, such as the Office of the Information and Privacy Commissioner of Alberta, the Office of the Privacy Commissioner of Canada, or the authority where you live.

Security

Connections to FediDB are encrypted. Codes sent by message are stored hashed, the app credentials FediDB registers with servers are encrypted, and uploads and message attachments kept privately until there's a reason to show them. Requests FediDB makes to other servers on your behalf can't be pointed at private networks. No system is perfectly secure; if we learn of a breach that affects you, we'll tell you as the law requires.

Children

FediDB isn't meant for children under 16, and we don't knowingly collect information about them. If you believe we have, email us and we'll delete it.

Changes

We'll update this page when what we collect changes, and change the date at the top. Significant changes will be announced on the blog.

See also the terms of use and the moderation policy.