Anonymous by default
A visitor opens a link and reads. No account, no sign-up, no tracking. The engine sets no tracking cookies, builds no visitor profiles and calls no third party; the web server keeps its ordinary access log, and that is the whole trace. Installing the site as an app changes none of this.
Do you need a cookie banner? Not for anything loam does. The question only arises for what you add yourself — an analytics script, an embedded map or video, a chat widget.
Privacy by shape
Because the default is zero, most privacy questions never come up: no visitor database to protect, no consent to store, no profile to export. What remains is small and sits in known places.
| About | What the site holds |
|---|---|
| Visitors | Nothing. The one cookie loam can set is for someone previewing a draft, and it expires within the hour. |
| Form submissions | What a visitor sends you, in an inbox the web server never serves, forwarded to you by email. Never in the site's history or its mirror. |
| People with a key | A name you choose and a fingerprint of the key — never the key itself. Remove the key and nothing is left. |
| The journal | Who changed what, in plain language. Your audit trail. |
“What do you hold on me?” means looking in two places — the inbox and the journal — instead of querying a platform.
Who is responsible
Under the GDPR your organisation is the controller: you decide what is collected and why. Whoever hosts the site for you is a processor; on your own server there is none. Loam keeps the data side small, so there is little to hold and little to lose. What the engine cannot decide for you is how long you keep form submissions and history — that decision, written down in your privacy statement, is yours.
Your content is yours
There is no database to export from, no platform account holding the “real” copy, and no format to convert out of. Your content is Schema.org JSON anyone can read, your templates are plain PHP and CSS, your images are image files.
To move a site, copy the folder to any server that runs PHP and point a domain at it. To leave loam altogether, you still hold every piece of content as readable files — no export step, no “contact support to get your data”. If Braaf hosts your site, the folder and its repository are yours: ask, and you get them.
Limits are a guarantee
A plan puts a few numbers around a site — storage, the number of things, the number of keys — to keep it fast and a size a person can oversee. A change that would cross a limit is refused, and your agent is told why. Nothing that exists is ever removed to fit a plan, and a site over its limit keeps running. Whatever a plan does not mention is unlimited.