The Canary · Updated on a schedule

What we have not
been forced to do.

Some legal orders come with a gag clause — you are forbidden from saying you received one. So instead we say, regularly, that we have not. If this statement ever stops being renewed, read that silence as the message.

Reading…

Loading the current statement…

Three ways your data leaves a company. Most people only think about one.

When someone says “my data got out”, they usually picture a hacker. That is one route of three, and it is not the one that gets the least attention by accident.

A breach

Criminals get in and take what is there. This is the one everyone imagines, the one that makes the news, and the one every company promises they are protecting you from.

You usually find out. Eventually. Often years later.

A sale

The company simply sells it, or is bought by somebody who will. Entirely legal, disclosed in a privacy policy nobody reads, and the actual business model of most free services.

You are told, in a sense. In paragraph forty-one.

A demand you are never told about

A subpoena, a warrant, a court order, or a National Security Letter. The company hands over what it holds because it is legally required to — and is often legally forbidden from telling you it happened.

You are not told. That is the design, not a failure.

Why the third one matters most here A breach is a security failure, so a company can promise to try harder. A sale is a choice, so a company can promise not to. Legal compulsion is neither. No amount of care prevents it, no promise survives it, and a gag order means the company cannot even warn you.

Encryption does not help if the company holds the key. Good intentions do not help. A privacy policy definitely does not help — a court order overrides it entirely.

There are only two real defences. Do not hold the data, so there is nothing to compel. And publish a statement you would have to stop making if it ever happened.

That is what this page is. The first defence is the Charter. This is the second.

It is worth being precise about what a canary can and cannot cover. It says nothing has been demanded of us. It cannot speak for your phone, your email provider, your bank, or anyone else holding something about you — all of whom face the same three routes and most of whom publish nothing at all.

If this ever lapses, here is what to do

A red state is not proof that something happened. It is a reason to stop assuming nothing did. Treat it as a prompt to act, not a panic.

Assume anything held here could be reachableIn practice that is very little — an email address, and a block of ciphertext we cannot open. But act as though the parts we can read are readable by someone else.

Delete your account if you have oneOne click, no confirmation step, the row goes. You do not need to ask us and you do not need a reason. Do it here.

Keep using the tools — they never touched us anywayThe Photo Check, the Audit, the Map, the Guide and the Passphrase generator all run entirely in your browser. Nothing about them changes if our servers are compromised, seized, or shut down, because they never involved our servers.

Wait for an explanation, but do not require oneIf we are able to say what happened, we will. If we are not, the lapse itself was the message and no further signal is coming.

Tell peopleA canary only works if someone is watching. If you notice this before we announce anything, saying so publicly is the most useful thing you can do with it.

Where else this is recorded Every signature is also written into the project's public commit history, timestamped by a service we do not control. If this page were ever quietly altered, that record would not match — and anyone can compare them.

How to read this page

The statement above is re-signed on a fixed schedule. Your browser compares the last signing date against that schedule — we do not compute the status on our end. There is no alarm on a server that could be quietly switched off. If nobody signs, the page goes overdue on your device, not ours.

Green · Signed and currentThe statement was renewed inside the expected window. Nothing has happened that we are legally forbidden from telling you about.

Amber · Overdue, within graceA signing was missed. This is more likely to be illness, travel, or ordinary human failure than anything sinister — but note it, and check back.

Red · LapsedThe grace period has passed with no signature. Treat any assurance on this site as unverified until it is renewed, and act accordingly.

What makes this work is simple: an order can force silence, but it is far harder to compel someone to keep actively repeating something untrue. So we say it out loud, on a schedule, and you watch whether we keep saying it.

Two honest limits, because you should know them rather than discover them. Its legal standing has never been fully tested in court — canaries are widely used and broadly considered sound, but no ruling has settled the question. And it can lapse through ordinary human failure as easily as through a warrant, which is exactly why several people hold a key and why the schedule has a week of slack built into it.

Neither of those makes it worthless. A signal that is hard to fake and easy to check is worth having even when it is not a guarantee — and there is no version of this that is stronger. What we can do is keep it current, name the limits plainly, and let you judge.

How you know the date is real A timestamp proves nothing on its own. It is a number our own server wrote, and anyone controlling that server could set it to whatever they liked. So each signature carries two things instead, and they prove different things.

A dated news link — from an outlet that puts the publication date in the address, so it can be checked rather than trusted. We parse that date and compare it to the clock; a story from last week is refused at the moment of signing rather than sitting here afterwards looking like proof. You can click it and confirm the date for yourself.

Recorded automatically — the most recent Bitcoin block at the moment of signing, fetched by us, not chosen by the signer. That value could not have existed before that block was mined, so it proves this entry was written after a specific, publicly checkable moment. Look up the block number on any explorer and read its timestamp.

Together: one that a human verifies and a machine cannot, and one that a machine records and a human can look up. Neither is sufficient alone. Both are visible above.

More than one person can signSeveral people hold a signing key, so illness, travel, or anything worse cannot cause a false alarm on its own, and no single person can be pressured into keeping it alive.

We do not publish who they are. Not their names, and not which one signed on any given day. A pattern of who signs and when is itself information, and the people doing this favour should not become a target list because of it.