Tri-Lakes Town Square is built so that it cannot betray its readers or sources — not by policy, but by architecture. This page explains exactly how that works, and includes a live audit of the platform’s privacy controls.
The Legal Foundation
This platform operates under New York Civil Rights Law §79-h, the Shield Law, which protects journalists and news organizations from being compelled to reveal confidential sources or unpublished information. We have gone further: we have engineered the platform so that even if a court order were served, there would be nothing to produce.
No Visitor Logging
nginx, the web server that serves this site, is configured with access_log off. No visitor IP addresses, request paths, timestamps, or user agents are written to disk at any point. This is re-verified every five minutes by an automated compliance audit.
Cloudflare as an IP Shield
All traffic to this site arrives through Cloudflare’s global network, over a tunnel the origin opens outward. This site is not reachable by connecting to the server directly: no DNS record for it points to the origin, and the origin accepts no inbound connection from the public internet to serve these pages. Because every request is delivered by Cloudflare, the address our web server would see is a Cloudflare datacenter address rather than yours — and no address is written to disk in any case, because access logging is off on the server that serves this site.
The Proxy Layer
Between the web server and the Ghost CMS sits a Node.js proxy. It handles authentication, content delivery, and report submissions. The proxy reads a client address in exactly two places, and writes it nowhere. The first is an in-memory rate limiter, which uses the address only as a counting key and discards it within the hour. The second is a one-way tag: the address is salted with 32 random bytes generated fresh when the process starts, never written to disk, and rotated on every restart, then truncated to twelve characters. That tag tells one noisy client apart from another inside a single uptime window, and cannot be turned back into an address by anyone holding the log file — including us. No IP address is written to disk anywhere in the proxy, and an automated check re-verifies that every time this page is loaded.
Story Upvotes
Vote counts live on the server, and casting a vote requires an account. Each vote is recorded against a salted hash of your account ID — not your name, e-mail, or address — so the stored record shows that an account voted, not who they are. Signed-out readers are never tagged and never recorded: browsing signed out leaves no server-side trace of what you read or what you voted on. When this scheme was tightened in August 2026, 137 legacy browser fingerprints left over from an earlier anonymous-voting design were deleted outright rather than carried forward.
Report Submissions
When a reader submits a community report or grievance, the submission stores only the content of the report, a neighborhood category, and a timestamp. No IP address. No device fingerprint. Name and email are optional fields — if you leave them blank, your submission is fully anonymous.
Image Upload Protection
All images uploaded to this platform pass through Sharp, a Node.js image processing library, before being stored. Sharp strips all EXIF metadata — including GPS coordinates, device model, and capture timestamp — from every image. A photo taken on your phone cannot reveal your location through this platform.
Document Metadata Stripping
Documents uploaded through this site — PDFs, spreadsheets, and office files — pass through mat2, a dedicated metadata removal engine, before they are stored. mat2 removes authorship data, creation and editing timestamps, embedded GPS coordinates, and software fingerprints. If mat2 is unavailable the upload is refused rather than stored unscrubbed, so nothing is ever published on the strength of a strip that did not happen. Documents in the Records archive are public records republished as they were obtained from the issuing agency; their metadata is the agency’s own and is left intact so the file stays verifiable against its source.
Database Logging
Ghost CMS uses MySQL 8 as its database. MySQL’s general query log and slow query log are both disabled. Error logging is directed to stderr only. No SQL queries containing report content are written to disk.
Container Log Caps
Every container that serves this site runs with a 1MB log cap and single-file rotation — the web server, the proxy, Ghost, MySQL, mat2, and the Cloudflare tunnel. Logs older than the most recent 1MB are permanently discarded. The web server has little to cap in any case: access logging is off in every server block, and its error log is directed to /dev/null.
Continuous Compliance Audit
Nine host-level checks run from a scheduled task every five minutes — nginx logging, Ghost log files, MySQL logging, Docker log rotation, and tunnel status — writing their results to a file the proxy reads. Twelve more run inside the proxy itself, on request: the source-code and on-disk checks described above, a live metadata-stripping probe, and a check that the host results are fresher than fifteen minutes. All twenty-one must pass for the platform to report itself compliant.
The results are published here rather than sent to an alerting system. This page is the alert, and it is never more than five minutes stale.
What This Means
If this platform received a subpoena demanding “all data identifying who submitted report X,” the honest and complete response would be: the data does not exist. This is not a legal argument. It is an engineering fact. You cannot produce what was never collected.
Speak without fear.
Live Privacy & Security Audit