What "No Tracking" Actually Means

"We respect your privacy." Every platform says it. Almost none of them mean it. So when I say Demox doesn't track you, I owe you a specific answer to the obvious follow-up: what does that actually mean?

Let me be concrete.

What we do not collect. We do not store your IP address beyond the few seconds it takes to rate-limit abusive traffic. Once the rate limiter has done its job, the IP is gone — it isn't written to a database, it isn't logged for analytics, it isn't retained "just in case." We don't set tracking cookies. The only cookie on Demox is the session cookie that keeps you logged in, and it does exactly that and nothing else. No third-party cookies. No supercookies. No localStorage identifiers used for fingerprinting.

We don't run analytics beyond basic aggregate counts. No Google Analytics, no Mixpanel, no Amplitude, no Segment. No ad pixels — no Facebook pixel, no TikTok pixel, no Google Ads conversion tracking. No fingerprinting scripts that build a unique identifier from your browser, fonts, canvas rendering, and screen size. We don't know if you came from Twitter or a Google search. We don't know what device you're on beyond what the browser voluntarily tells every website.

What we do store. I'm not going to pretend we store nothing, because that would be a lie. We store your username. We store a hash of your password — not the password itself, a one-way hash so even we can't read it. We store the posts you write, the comments you leave, and the votes you cast. The votes matter because they feed the account tier system and the ranking algorithm. That's the list.

Notice what's missing? Email. Phone number. Real name. Location. Device ID. Browsing history. A persistent identifier that follows you around.

How this compares to Reddit. Reddit's privacy policy, if you read it carefully, describes something like 400 distinct data points and tracking events across their apps and website. They record your scroll depth, your dwell time on individual posts, which posts you hover over, which you expand but don't click, your approximate location derived from IP, your device fingerprint, your inferred interests, your social graph, and dozens of signals you'd never think to ask about. Then they sell that data — or more precisely, they sold the whole archive to AI companies for training.

I'm not saying this to dunk on Reddit. I'm saying it because the contrast is the point. When a company collects 400 signals about you, "we value your privacy" is marketing copy. When a company collects five pieces of information and the only identifier is the username you chose, privacy is the architecture.

Is this approach flawless? No. If someone subpoenas us, we'd have to hand over what we have — which is the username, the hashed password, and the posts. That's a much smaller surface than most platforms expose. And we can't retroactively leak what we never stored.

Does it mean you're anonymous? Not quite. If you post identifying information, that's on you — we can't protect you from yourself. But we're not stacking the deck against you by quietly building a profile you didn't consent to.

That's what "no tracking" means here. Not a slogan. A data model.

— Tom