we don't track you!

Preamble

Welcome to Poke's Privacy Policy. We don't collect personal data and we don't use third-party trackers. Poke is free software you can read, remix, and run yourself.

Some parts of Poke keep anonymous operational counts so we can keep the instance fast, reliable, and less fragile. These counts are designed to answer boring maintenance questions like "which routes are busy?" and "is the server under pressure?" not "who is this person?"

Not legal advice lol

TL;DR

Ownership

The Poke service and this default instance (poketube.fun) are owned and operated by the Poke Project. Learn more at initiative.poketube.fun.

Initiative Site Privacy

The informational website at initiative.poketube.fun does not collect personal information. Since the website is hosted on Codeberg Pages, the Codeberg privacy policy applies: View it here.

What We Do/Don't Collect

How we improve Poke /api/stats

Poke has a small anonymous statistics system built into the server. It helps us understand broad software usage without third-party analytics, ad networks, or anything that needs to know who you are.

When someone watches a video through Poke, we may record one anonymous event. The event stays on this server. It is used for aggregate maintenance questions, not personal tracking.

At a glance

• Enabled by default. Instance operators can disable it entirely in the server config.
• Local-only. The counts are stored on the Poke server and are not sent to a third-party analytics service.
• Aggregate-focused. The public API shows totals, not individual viewer IDs.
• Optional for visitors. You can opt out from this browser at /api/stats/optout.

What one anonymous video stats event may include

• The video ID that was watched, for example ?v=...
• A random anonymous viewer ID stored in your browser's localStorage, not a cookie
• The browser family, for example Firefox, Chromium, or Safari
• The operating system family, for example GNU/Linux, Android, Windows, macOS, or iOS

What we use those counts for

• Finding which browsers need more testing
• Finding which operating systems need more testing
• Seeing which video IDs are popular on this instance
• Keeping a short rolling list of recently viewed video IDs
• Estimating broad usage so we can prioritize bugs and maintenance work

What we do not collect for /api/stats

• No IP addresses
• No cookies for analytics
• No login or account data
• No personal information of any kind
• No full user-agent strings
• No cross-site tracking
• No advertising identifiers
• No third-party analytics services

What the public stats API shows

• /api/stats returns aggregate numbers only, such as browser totals, OS totals, and popular video IDs.
• /api/stats?view=gui displays those anonymous aggregate numbers in a friendlier visual page.
• Individual anonymous viewer IDs are never exposed.

If you'd rather not contribute even these anonymous counts, you can opt out any time at /api/stats/optout. That stores a simple opt-out flag in your browser's localStorage, and Poke will stop sending video stats from that browser entirely.

Poke is free software and fully transparent. The telemetry implementation is in the source:
src/libpoketube/init/telemetry.js

Anyone can audit this code, verify what data is collected, fork the project, or disable the stats system when running their own instance.

Server Health & Traffic Pages /health and /traffic

Poke includes public status pages so people can see how the instance is doing. These pages show aggregate server health and route popularity, not personal activity.

/health

The /health page shows the current state of PokeResourceGuard and aggregate server health information, such as current server pressure, request rate, active visitor counters, and cooldown counts.

This page is for operational transparency. It does not show personal profiles, raw IP addresses, cookies, account identifiers, or browser fingerprints.

/traffic

The /traffic page shows anonymous traffic totals. It includes the total global request count, the date that counting started, and the most popular normalized routes on the instance.

These route counts are aggregate counts, not per-person browsing histories. Dynamic paths are normalized where possible so route totals stay broad and readable.

What gets saved for traffic stats

PokeResourceGuard may save a local file called popularpaths.json. This file is stored on the server and contains:

• trackingStartTime: when route counting began
• totalRequests: total counted requests
• routes: anonymous route names and their total counts

This file does not contain IP addresses, cookies, user accounts, full user-agent strings, headers, browser fingerprints, or personal information. It is just aggregate route popularity.

How this differs from /api/stats

/api/stats is the anonymous video stats system. /health and /traffic are server health and route popularity views. They are separate systems with separate goals.

/api/stats?view=gui shows anonymous video stats in a GUI. /traffic shows anonymous route traffic totals. Both are aggregate-only and both are designed to avoid personal data.

Anti-DDoS Protection PokeResourceGuard

Poke has a built-in resource protection system called PokeResourceGuard. It protects the server from request floods, overloaded routes, noisy clients, and sudden spikes that could make the instance slow for everyone.

Older public endpoint names may still mention PokeStopSkids for compatibility, but the newer system is PokeResourceGuard. It watches server pressure and decides when to gently shed expensive requests so normal browsing and video watching can keep working.

What PokeResourceGuard watches

PokeResourceGuard samples server health about once per second. It checks:

• Node.js event loop delay
• CPU usage
• memory usage
• requests per second
• active request counts
• request kinds, such as status, static, page, background, heavy, or other
• temporary per-client request pressure

The guard uses those signals to classify the server as healthy, warm, stressed, or critical. When the server is healthy, requests pass normally. When it is under pressure, the guard may slow down or reject expensive requests before the whole instance becomes unusable.

Temporary in-memory client counters

To stop abuse, PokeResourceGuard keeps temporary client counters in memory. These counters are used for sliding-window request totals, request cost totals, heavy request totals, soft page passes, rejects, and cooldowns.

This means the server can temporarily tell whether a connection is making too many expensive requests. That is necessary for abuse prevention. The important privacy part is that these client counters are in memory, expire, and are not part of the persistent traffic file.

Client state is cleaned up after inactivity, and cooldown levels decay over time. When the server restarts, the in-memory client counters disappear.

What PokeResourceGuard does not save persistently

• No raw IP addresses are stored in popularpaths.json
• No cookies are stored by the guard for route traffic stats
• No browser fingerprints are created
• No account identifiers are used
• No full user-agent strings are saved in the traffic file
• No per-person browsing profile is created
• No cross-site tracking happens

Logging during abuse or rejection

If the guard rejects a request or applies a cooldown, it may print a server-side operational log entry. These logs are meant for debugging abuse and overload. They use a random boot-time salt to anonymize the client address into a short value like anon-xxxxxxxx. The salt is generated when the server starts, so the anonymized value is not a stable long-term identity.

Rejection logs may include aggregate counters such as recent request totals, heavy request totals, reject counts, cost score, pressure score, current guard state, CPU state, memory state, and event loop state. They are not meant to identify a person.

Known bots and infrastructure

PokeResourceGuard recognizes some well-known bot and infrastructure user agents. This can reduce request cost or avoid punishing useful automated traffic such as search engines, feed readers, fediverse previews, link preview bots, uptime monitors, and CDN infrastructure.

This is not used to build a personal fingerprint. It is a broad operational rule so that a search crawler and a normal browser do not always get treated exactly the same during server pressure.

Cloudflare and proxy awareness

Poke includes trust-proxy auto-configuration so it can work correctly behind common deployment platforms and proxies. It may look at proxy-related headers such as x-forwarded-for, x-forwarded-proto, x-real-ip, cf-ray, and similar headers when deciding whether the instance is behind a trusted proxy.

This is used for correct routing, HTTPS handling, and safe request handling. It is not a third-party analytics system and it is not used to create personal profiles.

Live stats and source code

You can see the current state of the resource guard at /health. The traffic view is at /traffic. Raw JSON is available at /_pokeresource/stats.

Compatibility endpoints may also exist: /_poketraffic/stats, /_pokestopskids/stats, and /_pokeoverload/stats.

The full implementation is in the source code:
codeberg.org/ashleyirispuppy/poke

Anyone can read exactly how it works, verify what data is stored, and run their own instance with their own settings.

Cookies & Local Storage

• Cookies: we use cookies where needed for security and anti-abuse protections. This includes Anubis, our anti-bot system, which may set cookies to verify legitimate traffic and reduce automated abuse.
• Local storage: used to save preferences such as theme and layout, to store a single anonymous random viewer ID used by /api/stats, and to store simple page preferences such as whether you've dismissed this policy update notice.
• /health and /traffic: these pages do not need cookies or localStorage for their live stats. They fetch public aggregate JSON when JavaScript is enabled.

To remove data stored in your browser, use your browser's cookie/site-data controls:
· Chrome
· Firefox
· Safari iOS
· Safari macOS
· Edge
· Brave

OpenStreetMap

Poke Maps uses data from OpenStreetMap, a community-driven, free-licensed world map built by thousands of volunteer contributors.

When you visit /map, Poke displays OpenStreetMap through a simple <iframe> element embedded directly into the site. This means the map interface and tiles are loaded from OpenStreetMap's tile servers rather than from Poke's infrastructure.

Poke does not proxy or modify these map requests. Your browser connects directly to openstreetmap.org and its associated tile servers. While Poke itself does not collect or log identifying information about your visit to the map, OpenStreetMap servers may process standard connection details for delivery. See the OpenStreetMap Foundation Privacy Policy.

Weather Pages & Services

Poke's weather pages use privacy-respecting services to resolve places and fetch forecasts.

Translate Page SimplyTranslate

Our translate page does not send your data directly to Google or SimplyTranslate.org from your browser. Instead, all requests are proxied through our own backend servers. When you use the page, only the necessary parameters are passed securely on the server side: from source language, to target language, and text the content you entered.

We rely on the community-run SimplyTranslate service, a privacy-friendly translation front-end. SimplyTranslate is a free software project: you can see the source code and its legal notice.

API Logs Policy

When you request any resource from the Poke API, for example thumbnails or API endpoints, information about the request may be logged for operational health.

2019-01-19 16:37:47 +00:00 200 GET /api/v1/comments/xrlETJYzH-c?format=html&hl=en-US 1345.88ms
2019-01-19 16:37:53 +00:00 200 GET /vi/r5P-f5arPXE/maxres.jpg 1085.41ms
2019-01-19 16:37:54 +00:00 200 GET /watch 7.04ms

This website does not use fingerprinting, advertisements, or tracking of any form.

Legal Bases for Processing GDPR / EU Law

The Poke Project and its primary instance poketube.fun operate under the jurisdiction of the European Union and comply with the principles of the General Data Protection Regulation GDPR Regulation EU 2016/679.

• Legitimate interest: Operating the Poke service safely and efficiently while collecting no personal data.
• Consent: If one day we add an optional feature that needs personal information, you'll be clearly asked before it's processed.
• Legal obligation: Even if an authority asks for user data, there's no personal data to hand over. We don't store personal identities, account emails, or personal profiles.

This section is here for compliance transparency only. Poke simply doesn't process or retain personal data in the first place.

Your Privacy Rights

Because Poke doesn't collect or store personal info, there's really nothing about you that we can give, sell, or lose. You won't need to ask for "export my data" or "delete my profile" because we just don't have any of it.

Poke accounts don't require your name, email, or any identifying detail. You literally can't add them even if you tried.

But outside Poke, you do have rights and tools to protect your privacy. Here are a few ideas:

• Use a privacy-respecting search engine instead of one built around tracking. Good options include DuckDuckGo and Kagi.
• For private AI chat, try Duck.ai. It can be useful when you want access to LLMs without directly exposing your IP address to the model providers. Still, don't paste passwords, private keys, personal documents, or anything deeply sensitive into any AI tool.
• Use private messengers like Signal for end-to-end encrypted messages, voice calls, video calls, group chats, and file sharing.
• Use email providers that take privacy and encryption seriously, such as Tuta Mail or Proton Mail.
• Use a content blocker like uBlock Origin to block ads, trackers, malicious domains, annoying popups, and other unwanted web junk.
• Try Privacy Badger by the EFF to help stop hidden third-party trackers from following you across websites.
• Use browsers built around user control and privacy, such as Firefox and privacy-focused Firefox forks, Tor Browser for stronger anti-tracking and anti-surveillance browsing, or Firefox Focus for mobile.
• If you want a privacy-focused Chromium-based browser without the usual bloat, try Helium Browser. It blocks ads, trackers, phishing websites, third-party cookies, and other unwanted browser behavior by default.
• Use encrypted DNS and network-level filtering to reduce tracking before it reaches your browser. Hosted options like NextDNS can block trackers and malicious domains across devices.
• If you run your own home network, consider Pi-hole for network-wide blocking on phones, laptops, smart TVs, apps, and other devices connected to your network.
• Use HTTPS whenever possible, avoid sketchy public Wi-Fi, and keep your operating system, browser, and apps updated.
• Check device permissions for camera, microphone, location, contacts, files, and notifications. Revoke anything you don't actively use.
• Use a VPN on public or untrusted networks. We recommend Mullvad VPN because it focuses on minimal data retention and anonymous account numbers.

Data Retention

• Server logs: minimal operational logs no personal data kept for the shortest technically feasible duration.
• Anonymous video usage stats: counts are stored locally on this server; admins may reset or disable at any time.
• Health stats: live server health data is generated from current process state and temporary in-memory counters.
• Traffic route stats: anonymous aggregate route totals may be stored in popularpaths.json. This file contains route counts, total request count, and tracking start time only.
• PokeResourceGuard client counters: temporary request counters exist in server memory (RAM), are cleaned up after inactivity, and disappear on server restart.
• PokeResourceGuard rejection logs: may contain short salted anonymous labels and aggregate pressure information for operational debugging, not raw personal profiles.

JavaScript & No-JS

JavaScript is optional on Poke's websites. Core features, including search, work without JavaScript.

The /health and /traffic pages are also usable without JavaScript. Without JavaScript, they show a static server-rendered snapshot. With JavaScript, they fetch /_pokeresource/stats every second to update public aggregate numbers.

Self-Hosting

Poke is free software under the GNU GPL v3.0 or later. You can self-host it yourself! See here.

Instance operators can inspect the telemetry and resource guard code, change settings, reset route totals, disable anonymous video stats, or run their own instance with different retention choices.

Changes to this Policy

If we ever change how privacy works here, we'll update the date at the top and announce major changes. Spoiler: changes would not include adding two bananas. this isn't minions LOL :3

Document History

You can view the full edit history for this policy at: codeberg.org.

Warranty Disclaimer

IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER,OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM E.G., LOSS OF DATA, DATA BEING RENDERED INACCURATE, OR FAILURES OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS,EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Contact

Questions or concerns? Open an issue on our project tracker :D

• Project: codeberg.org/ashleyirispuppy/poke
• Initiative: initiative.poketube.fun

Policy License

© 2021-2026 Poke Poke Project. This policy is licensed under the Creative Commons Attribution-ShareAlike 4.0 International CC BY-SA 4.0.