# Privacy Policy

Last updated November 9, 2026.

This policy explains what personal data Lexicon Garden handles, why, and what rights you have. It's written in plain language. Where the law forces a technical term on us, we explain what it means in practice.

## 1. Who is responsible for your data

Nick Gerakines, an individual in the State of Ohio, USA, privately owns and operates Lexicon Garden, through the identity @lexicon.garden. He is the "controller" of the personal data described here, meaning the one who decides how and why it's used.

Contact: @ngerakines.me or @lexicon.garden on Bluesky.

> [!SUMMARY] Lexicon schemas are public network data, and Lexicon Garden indexes them whether or not their publishers ever visit. If you sign in, we hold your DID and handle, your sandboxes, and your acceptance of these policies, and we use them to run Lexicon Garden and for nothing else. Your sign-in tokens live in an encrypted cookie in your browser, not in our database. Our servers are in Germany. Request logs last no more than 30 days. We don't ask for your email address, show ads, track you across sites, use your data to train AI models, or sell anything.

## 2. Public by design

Most of what Lexicon Garden handles is public, on purpose. Lexicon Garden reads it from the network's relays and from the PDSes that host it, and anyone can read it on Lexicon Garden without signing in:

- **lexicon schemas**: every `com.atproto.lexicon.schema` record we find, with the DID that published it, when we saw it, and each version, including versions later deleted, so history and comparisons stay accurate;
- **identities**: the DID documents and handles of publishers, so we can show who published what and check who controls a namespace;
- **usage counts**: how many records on the network use each lexicon, and which of its fields they fill in, counted per lexicon and per day, never per account;
- **DNS**: the `_lexicon` records that say which DID controls a namespace; and
- **your policy acceptance and your sandboxes**, once you have them: the acceptance is a public record in your repository, and your identity page on Lexicon Garden shows your sandboxes and how long they resolve.

**Kept by us, and not published:**

- your sign-in session, which lives in your own browser;
- the details your account settings show for your sandboxes, such as when you claimed them and the state of each DNS record;
- our server logs; and
- records of moderation decisions.

## 3. What we hold, why, and our legal basis

Under the GDPR we have to tell you our "legal basis" for each use of your data. Here it is, in a table you can actually read.

| What we hold | Why | Legal basis (GDPR) |
| --- | --- | --- |
| **Public lexicon schemas, identities, usage counts, and DNS records** | To run a searchable index of the network's lexicons | Our legitimate interests, Article 6(1)(f) |
| **Your sign-in session**: your DID, handle, PDS address, authorization server, the permissions you granted, and the tokens that go with them, in an encrypted cookie | To keep you signed in and act with the permissions you granted | Performance of our contract with you, Article 6(1)(b) |
| **Your policy acceptance**, indexed from your repository | To know you've accepted the current policies before you publish or use sandboxes | Contract, Article 6(1)(b) |
| **Your sandboxes**: their names, that they're yours, when you claimed, published, and renewed them, and the DNS records they hold | To run your sandboxes and never give their names to anyone else | Contract, Article 6(1)(b) |
| **Your legacy subdomain**, if you used Lexicon Garden's earlier lexicon management, with the IDs of the DNS records it created | To remove those records on the announced date | Our legitimate interests, Article 6(1)(f) |
| **Server logs**: the requested address, time, and response status | Security, abuse prevention, and fixing problems | Our legitimate interests, Article 6(1)(f). Keeping security logs is a recognized legitimate interest (GDPR Recital 49) |
| **Rate-limit counters**, kept per IP address, or per DID when you're signed in | To share the service fairly and stop abuse | Our legitimate interests, Article 6(1)(f) |
| **Messages you send us, reports, and records of moderation decisions** | To answer you, handle reports, and keep a record of decisions affecting accounts | Our legitimate interests, Article 6(1)(f), and legal obligation, Article 6(1)(c), where the law requires a record |

We don't ask for your email address, and Lexicon Garden never sees your password. We don't use analytics, advertising trackers, or fingerprinting. The [Cookie Policy](/cookies/) covers the few cookies we use.

**Your tokens live in your browser.** They're kept in an encrypted session cookie for up to 28 days, not in our database. While you're accepting these policies, a pending sign-in, including its tokens, is held on our servers for up to 30 minutes, and the state of an unfinished sign-in for up to 10 minutes. When you sign out, we revoke your tokens with your authorization server.

## 4. Sign-in suggestions

Before you sign in, what you type in the sign-in field is sent to typeahead.waow.tech, a community-run account search, to suggest matching accounts. It isn't sent once you pick an account or enter a DID or server address.

Your browser sends it directly, after you've typed two characters and paused, and the request names Lexicon Garden as the client. That service's own policies apply to what it receives.

## 5. Who receives your data

**The network.** When you publish through Lexicon Garden or accept these policies, your PDS publishes the record to the network, as it does every public record, and relays, apps, search services, and archives can copy it.

**Your provider.** Your PDS and authorization server receive Lexicon Garden's requests when you sign in, publish, accept these policies, renew a sandbox, or sign out, under their own policies.

**Our service providers**, which process data only to run Lexicon Garden:

- **Hetzner** runs our servers and holds everything above on our behalf; and
- **DNSimple** hosts the `lexicon.garden` DNS zone, including the `_lexicon` records for sandboxes, which read `did=<your DID>` and are public by design.

**typeahead.waow.tech** receives sign-in suggestion input from your browser ([section 4](#s4)).

**Highport.** [Highport](https://highport.space/) is run by the same person but is a separate service with [its own privacy policy](https://policies.highport.space/privacy/). It serves this policies site. Signing in to Lexicon Garden doesn't share anything with Highport beyond what any service can read publicly.

**Legal requests.** We disclose data only when the law requires it. We review every request, push back on ones that are overbroad, and tell you before we disclose anything unless the law forbids it or someone's safety is at immediate risk.

**Never.** We don't sell, rent, or trade your data. We don't share it for advertising. We don't use your data to train AI models.

## 6. Where your data is

Lexicon Garden's servers are dedicated servers rented from Hetzner, in Germany. Lexicon Garden is run from Ohio, USA. When we access the servers to operate and maintain the service, we do it over encrypted connections.

Search uses a language model that runs on our own servers to turn lexicon text and search queries into numbers for search by meaning. Neither leaves our servers.

Your public data is copied by services all over the world. That's part of how the network works, and it's outside our control.

## 7. Requests and logs

Our servers log each request's address, time, and response status, to keep the service secure, stop abuse, and fix problems. Addresses can include what you searched for and the NSIDs, handles, and DIDs you looked up. **Server logs are kept for no more than 30 days, then deleted automatically.**

Rate-limit counters expire after about 15 minutes. Search pages are cached for 5 minutes. We record service metrics, such as how many requests each endpoint served, without IP addresses or accounts.

## 8. How long we keep data

| Data | How long |
|---|---|
| Lexicon schemas and their history | For as long as Lexicon Garden runs |
| Identity cache | Refreshed from the network; removed if the account is taken down |
| Your session cookie | Up to 28 days, or until you sign out |
| A pending sign-in | Up to 30 minutes |
| Your policy acceptance | While it's in your repository |
| Sandbox names | Permanently, so a name is never given to anyone else |
| Sandbox DNS records | Until the sandbox expires or is taken down |
| Legacy subdomain records | Until they're removed on the announced date |
| Server logs | No more than 30 days |
| Rate-limit counters | About 15 minutes |
| Messages, reports, and moderation records | For as long as the decision stands, so a takedown stays in place |

## 9. Your rights

These rights apply to everyone, wherever you live. You can ask us to:

- **access** the data we hold about you;
- **correct** it if it's wrong;
- **delete** it (see [section 10](#s10) for the limits);
- **restrict** how we use it;
- **port** it to another service; and
- **object** to any use we base on legitimate interests.

You can do several of these yourself at any time: sign out from your account settings, revoke Lexicon Garden's access from your provider's settings, delete your policy acceptance from your repository (you stay signed in, but publishing and sandboxes stop until you accept again), or delete schemas from your PDS. For anything else, message @ngerakines.me or @lexicon.garden on Bluesky.

You also have the right to **complain to your local data protection authority**, if there is one where you live. We'd rather you came to us first so we can fix it, but you don't have to.

If you live in a US state with a consumer privacy law: we don't sell your personal data or share it for targeted advertising, so there's nothing to opt out of.

## 10. The honest limits of deletion

The public data Lexicon Garden indexes reflects your own repository, so the lasting fix is to change or delete the record in your PDS. When you delete a schema, Lexicon Garden stops listing it, but keeps the versions it indexed in that lexicon's history. Copies other services have made are outside our control.

We keep a sandbox's name, and that it's yours, even after it expires, so the name is never given to anyone else and code generated against it can never resolve to someone else's schemas.

## 11. Security

We protect data with encryption in transit, encrypted session cookies, narrow permissions, and limited administrative access. The [Security Policy](/security/) explains how in more detail, how to report a vulnerability, and what you can do to protect your own account.

## 12. Children

Lexicon Garden is for adults. We don't knowingly hold data about anyone under 18. If you believe a child has signed in, contact us and we'll remove what we hold.

## 13. Data breaches

If we have a data breach, we'll announce it from @lexicon.garden on Bluesky within **72 hours** of becoming aware of it, saying what happened, what data it touched, and what you should do. We'll also tell the people affected directly when the risk to them is high, and notify any authority the law requires us to.

## 14. Changes to this policy

We may update this policy. A change is a new version of this site, and you'll be asked to accept it the next time you sign in. When we make a major change, we'll announce it from @lexicon.garden on Bluesky at least 30 days before it takes effect, unless the law or an urgent safety or security problem requires a faster change.