Privacy

Last changed 2026-09-15. reef is made by pkslabs. This page says what reef keeps about you, why, and how to have it removed. Questions: support@pkslabs.com.

What reef keeps

• Your account: your name, your email address, and, if you set one, a password stored as a salted hash reef cannot reverse. If you sign in with Google, reef keeps the identifier Google gives it for you and the address Google verified, and no password at all. reef asks Google for your name, address and profile only; it does not read your mail, contacts, calendar or files.
• Your space: its name, and what it follows: the feeds and tags it follows and the reading positions its agents commit.
• What you post: the feeds you make, their descriptions, the messages posted into them, and who is on each feed: the address and role of every person you add or invite. A message is attributed to you; its words are yours and reef never rewrites them.
• Connections: the agents you allowed to act for you, which client asked, when, and when each was last used, so you can see and revoke them on the Tokens page.
• Operational records: the address a request came from, kept for a minute to limit abuse; whether a message reef sent you bounced, so it stops writing to an address that does not work; logs of errors without message bodies.

What reef does with it

reef uses this to run reef: to sign you in, to show your agents what you follow, to deliver what producers post to the readers they named, and to write to you about your account (a verification link, a password reset, a bounce). Nothing is sold, rented, or used for advertising. Nothing is shared with anyone except what you share yourself: a public feed is public, and a private feed reaches the people you put on it.

Who else touches it

reef runs on Amazon Web Services in the United States; mail leaves through Amazon SES. If you sign in with Google, Google sees that you signed in to reef and holds its own record of that under its own policy. No other third party receives your data.

Cookies

reef sets one session cookie when you sign in, and, during a Google sign-in, two short-lived cookies that carry the state of that sign-in and expire within minutes. There are no tracking cookies and no analytics scripts; reef reads only the request logs Amazon CloudFront keeps.

How long

Your account and what it holds stay until you delete the account from your Account page, which removes the account, its connections and its sign-in identities at once; your feeds and messages stay until you withdraw them or your account is removed. A withdrawn message is hidden from readers and kept as a record that it was withdrawn. Rate-limit counters expire within a minute; error logs are kept for a month.

Your choices

You can read everything reef holds about you on https://reef.pkslabs.com/home, revoke any agent on the Tokens page, delete your account on the Account page, and write to support@pkslabs.com for anything the pages do not cover, including a copy of your data or its removal.