Poke Privacy Policy

Preamble

Welcome to Poke’s Privacy Policy. We don’t collect personal data about you, we don’t run telemetry, and we don’t track you around the web. The only “analytics” involved is an optional poke-nginx-analytics script for server operators, which runs locally on their own machines, never phones home, and only summarizes their own access logs. Poke is free software you can read, remix, and run yourself.

Not legal advice lol

TL;DR

Ownership

The Poke service and this default instance (poketube.fun) are owned and operated by the Poke Project. Learn more at initiative.poketube.fun.

Initiative Site Privacy

The informational website at initiative.poketube.fun does not collect personal information. For hosting-related processing, the Codeberg privacy policy applies: codeberg.org/Codeberg/org/src/branch/main/PrivacyPolicy.md.

What We Do/Don’t Collect

Cookies & Local Storage

• No cookies :D!
• Local storage only for preferences (e.g., theme, layout). This stays on your device.

To remove data stored in your browser, you can use your browser’s cookie/site-data controls:
· Chrome
· Firefox
· Safari (iOS)
· Safari (macOS)
· Edge
· Brave

OpenStreetMap

Poke Maps uses OpenStreetMap data. That means when you explore maps at /map, we embed OSM via an iframe directly into the Poke site. The tiles and geographic info are delivered from OSM contributors’ servers. While Poke itself doesn’t collect any of your data, OpenStreetMap’s tile servers have their own privacy policy.

Weather Pages & Services

Poke’s weather pages use third-party, privacy-respecting services to resolve places and fetch forecasts:

• Geocoding / place lookup: nominatim.openstreetmap.org. Requests are proxied through Poke’s backend.
• Forecast data: open-meteo.com. Forecast queries are proxied through Poke’s backend so your browser never connects to Open-Meteo directly.

Poke does not add trackers to these requests. However, when third-party services are contacted (directly or via proxy), their respective privacy policies apply to those specific requests.

Translate Page (SimplyTranslate)

Our translate page does not send your data directly to Google or SimplyTranslate.org from your browser. Instead, all requests are proxied through our own backend servers. When you use the page, only the necessary parameters are passed securely on the server side: from (source language), to (target language), and text (the content you entered). Your browser never connects to SimplyTranslate.org directly.

Third-Party Requests & Proxy

Where external services are necessary (maps, weather, translation), Poke uses server-side proxying to avoid exposing your browser directly. We don’t inject trackers into proxied calls. External services have their own privacy terms that apply to those specific requests.

API Logs Policy

When you request any resource from the Poke API (for example: thumbnails, API endpoint) information about the request may be logged.

Information about a request is limited to:

• the time the request was made
• the status code of the response
• the method of the request
• the requested URL
• how long it took to complete the request.

No identifying information is logged, such as the visitor’s cookie, user-agent, or IP address. Here are a couple lines to serve as an example:

2019-01-19 16:37:47 +00:00 200 GET /api/v1/comments/xrlETJYzH-c?format=html&hl=en-US 1345.88ms
2019-01-19 16:37:53 +00:00 200 GET /vi/r5P-f5arPXE/maxres.jpg 1085.41ms
2019-01-19 16:37:54 +00:00 200 GET /watch 7.04ms
        

This website does not store the visitor’s user-agent and does not use fingerprinting, advertisements, or tracking of any form.

Server Admin Tool: poke-nginx-analytics

We ship an optional, admin-side shell script to help operators understand IPv4/IPv6 traffic and status codes from their own servers’ Nginx access logs. It’s free software and lives here: backend-services/scripts/poke-nginx-analytics.sh .

What it reads from your logs

The script parses standard Nginx access logs (including rotated .1 and compressed .gz) using the fields already present in your log format:

• Client IP (first field) — used to tell IPv4 vs IPv6 and to compute counts/uniques; display can be masked via --anonip.
• Timestamp (e.g., [02/Oct/2025:14:03:12 +0000]) — used for --date, --since, --until, and hourly breakdowns.
• Status code (e.g., 200, 404, 502) — used for success/fail tallies and “top fail reasons.”
• User-Agent (last quoted field) — only to optionally filter bots when --ignore-bots (or a custom --bot-regex) is used.

It does not collect any new data, fingerprint users, or correlate logs with other sources.

How it decides “success” vs “fail”

• By default, “success” is the set 200,301,302,304.
• You can override with --success-codes or a regex via --success-regex (e.g., ^(2..|3..)$). If both are provided, regex wins.
• “Fail” is simply “not success.”

What it outputs (to your terminal)

• Counts and percentages of IPv4 vs IPv6 for today (or a specified date/time window).
• Success-only and fail-only views; an overall success rate with totals.
• Hourly breakdown (v4/v6/total) and status-code breakdown for v4 or v6.
• Unique IP counts for v4 and v6; if --anonip is set, displayed IPs are masked (IPv4 → /24; IPv6 → /64).
• Top IPs (v4 or v6) with optional masking and bot filtering.
• Top 5 failure reasons (status codes aggregated across v4+v6). Some common meanings:
  • 404 Not Found — missing path or bad link.
  • 400 Bad Request — malformed client request.
  • 401/403 Unauthorized/Forbidden — blocked/needs auth.
  • 429 Too Many Requests — rate limiting kicked in.
  • 500/502/503/504 — upstream/app issues or timeouts.

How it works (under the hood)

• Expands your --file glob (default /var/log/nginx/access.log*), reads each file with cat/zcat.
• Uses awk to:
  • Detect IPv4 vs IPv6 by regex.
  • Match the requested date and optional time window (--since/--until).
  • Classify success/fail via your codes or regex.
  • Optionally filter bots by User-Agent (--ignore-bots / --bot-regex).
  • Optionally anonymize IPs for display (--anonip).
  • Aggregate counts and print sorted summaries; shows “top fails” by frequency.
• Handles rotated and .gz logs automatically.
• Does not modify logs or your Nginx config.

What it does not do

• No storage by default. Output is ephemeral in your terminal unless you redirect it (e.g., > report.txt).
• No identification or profiling. It does not attempt to identify people; it just counts what’s already in your logs.

Legal Bases for Processing (GDPR)

• Legitimate interests: Running Poke smoothly while collecting exactly zero personal data.
• Consent: If we ever invent an optional feature that needs info, we’ll ask. But right now? There’s nothing to consent to.
• Legal obligation: Even if someone waves a fancy piece of paper at us, we literally have nothing personal to hand over. Empty pockets.

Your Privacy Rights

Since Poke doesn’t collect or store personal data, there’s basically nothing for us to give, sell, or lose about you. You don’t have to worry about “export my data” or “delete my profile” requests because we don’t have anything on you in the first place.

Poke Accounts don’t require an email, name, or any other identifying info — and there’s no way to add that kind of data even if you wanted to.

Data Retention

• Server logs: No personal identifiers on our main instance.
• Telemetry/analytics: Not enabled here.

JavaScript & No-JS

JavaScript is optional on Poke’s websites. Core features—including search—work without JavaScript.

Self-Hosting

Poke is free software under the GNU GPL v3.0 or later. you can self-host it yourself! see here

Changes to this Policy

If we ever change how privacy works here, we’ll update the date at the top and announce major changes. Spoiler: changes would not include adding two bananas. this isnt minions LOL :3

Document History

You can view the full edit history for this policy at: codeberg.org.

Warranty Disclaimer

IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER,
OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM
(E.G., LOSS OF DATA, DATA BEING RENDERED INACCURATE, OR FAILURES OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
        

Contact

Questions or concerns? Open an issue on our project tracker :D

• Project: codeberg.org/Ashley/poke
• Initiative: initiative.poketube.fun

Policy License

© 2021–2025 Poke (Poke Project). This policy is licensed under the Creative Commons Attribution–ShareAlike 4.0 International (CC BY-SA 4.0).