What Anansi does with your data.

Anansi is not a hosted product and there is no company behind it. This copy runs as a single container on a home server, owned and administered by one person, next to that person's other self-hosted services. Your data never reaches a cloud provider's database, because there is no cloud provider.

The honest consequence: the person who administers that server has root on it. They can read the database and open your files. Self-hosting removes the vendors, it does not remove the operator. Trusting Anansi means trusting whoever handed you the account.

Everything you write into Anansi: goals, tasks, weekly retrospectives, the people you reflect on, appreciation notes, “my needs” entries, legacy messages, self-reflection prompts, the Self page, bucket-list items, group tags, and any file you attach to a weekly sync.

Nothing reads it except the app rendering your own pages. There is no model training on your content, no recommendation system, no advertising, and no automated scanning of any kind.

Sign-in goes through Pocket ID, an identity provider running on the same server. It is passkey-only. There is no password to type and Anansi never receives one. Pocket ID hands back three things: your name, your email address, and a stable identifier for your account. Those are what Anansi stores about your identity.

Your session is a cookie. It is HttpOnly, encrypted with a key derived from a server-side secret, and it carries your user id. There is no session table and no server-side session store.

One leftover worth naming: the database still has a password column from an earlier email-and-password mode. Where it holds anything it holds a bcrypt hash, never a plaintext password, and it is not used to sign in here. Creating an account inside Anansi is closed; accounts come from Pocket ID.

• Database: one Postgres database on a cluster shared with the other apps on the same server. Your rows are keyed to your user id and every query filters on it.
• Files: your avatar, photos of people, and sync attachments are stored as raw bytes in a database table. There is no uploads directory, no object store, no bucket, public or otherwise.
• Serving those files: one route, /api/files/{id}. It requires a signed-in session and matches the file against your user id in the same lookup, so a file belonging to someone else returns the same not-found response as a file that does not exist. There are no signed URLs and no unguessable public links, because there is nothing public to link to.

Two things, and this is the whole list.

• Cloudflare. Reaching Anansi from outside the house goes through a Cloudflare tunnel. Cloudflare terminates TLS at its edge, which means it can see the requests passing through it. On the local network the browser talks to the server directly and Cloudflare is not in the path.
• jsDelivr. The emoji picker loads its emoji images from a public CDN the first time you open it. That request carries your IP address to a host Anansi does not control. None of your entries go with it.

There is no analytics, no telemetry, no error-reporting service, no tag manager, and no advertising code. Fonts are bundled into the app and served from the same server as the pages, so opening Anansi does not tell a font host that you did.

Anansi speaks Model Context Protocol. You can connect it to a Claude client. If you do, that client reads and writes your Anansi data, and whatever it reads travels to Anthropic as part of the conversation. That is the feature working as designed, and it is also the largest opening in everything above. It stays closed until you connect it.

Anansi issues those tokens itself rather than delegating to anyone. An access token lasts an hour, a refresh token lasts thirty days and is replaced on every use, and both are stored as hashes rather than as the token. Revoking the connection from your Claude client ends the access.

In transit, traffic is TLS, and the session cookie is encrypted on top of that.

At rest, nothing is encrypted. The database is plain Postgres on an unencrypted filesystem, and your uploaded files sit as plain bytes in a table with no encryption applied to them. Anyone holding the disks, or holding root on the server, can read all of it. This page is not going to imply otherwise.

The filesystem takes automatic snapshots of the application state: several within the past hour, one an hour for a day, one a day for a week. Those snapshots are replicated to a second set of disks inside the same machine.

That is the entire backup story. There is no off-site copy. One fire, one theft, or one bad command with root takes the original and the replica together. The snapshots are not encrypted either.

Anansi itself logs a handful of lines at startup and nothing per request. It does not log request bodies or response bodies, so nothing you write appears in a log.

The reverse proxy in front of it writes one line per request: the path, the status code, how long it took, your browser's user agent, your IP address, and the country code Cloudflare attaches. Those lines go to a log store on the same server and are deleted after thirty days. The paths carry page names, record ids and week dates, never the text of an entry.

The session cookie that keeps you signed in, plus small preference cookies remembering your language, your theme, and your sidebar width. Sign-in briefly sets two more, which the login flow discards when it finishes. None of them are used for analytics, advertising, or profiling, so there is no consent banner.

Profile → Backups produces a single JSON file holding every row Anansi has for you, with your uploaded files embedded in it. No request, no queue, no waiting. Importing a file replaces your current data with its contents.

Every field you can read on a screen is editable on that screen.

You can delete any individual entry from the screen it appears on, and that removes the row.

There is no button that deletes your whole account. Everything Anansi stores hangs off your user row and is set to cascade from it, so removing that row does remove all of it, but today that is a manual action by whoever runs the server. Ask them. Then allow about a week for the snapshots described above to age past it.

Nothing expires on its own. Anansi runs no retention timer and no automatic cleanup. What you write stays until you or the administrator delete it.

No one is sent your data for profiling, and none of it is sold or shared with advertisers. The parties who can see something are the ones named above: the server's administrator, Cloudflare for requests arriving from outside the house, jsDelivr for the fact that a browser at your IP opened an emoji picker, and Anthropic if and only if you connect a Claude client.

If a disclosure is ever legally compelled, it will be complied with and, where the law allows, the affected user will be told.

Anansi is not intended for anyone under 16.

When this page changes, the date at the top moves with it. If a change is material you will hear about it inside the product before it takes effect. If you do not like it, export first and then ask for the account to go.

There is no support address. Anansi is run by one person and you got your account from them, so that is the channel for a deletion request, a data request, or a question about anything on this page.