Privacy differs by Oernoe hostname

Oernoe is not one website with seven logos. It is a distributed set of hostnames with different jobs, cookie scopes, and data stores. Collapsing them into a single privacy slogan is how we once shipped “zero tracking” language that could not survive an AdSense application on www. This essay is the hostname map for privacy readers: what each live host is for, what it must not do, and which policy pages govern the seams.

Anoepal operates the network. The architectural guide Which Oernoe hostname does what is the dense reference. Here is the privacy reading of the same topology.

## www.oernoe.com — publisher and documentation

Primary job: public portal, journal, guides, How-To, company pages, legal library. Selected finished educational pages may load Google AdSense with non-personalized requests by default. Ads stay off Home, About, Team, Contact, legal, indexes, auth shells, and errors. The cookie bar is a notice, not a CMP. www does not process private Chat streams, Drive files, or Health notes as product storage. It can still see ordinary web request data and, on eligible pages, advertising processing by Google under Google’s terms.

Privacy risk on www is mostly publisher risk: thin content, dishonest slogans, misplaced ads. Recovery lives in What we publish and Corrections. Search queries typed on Search are not ad input here.

## search.oernoe.com — private web search

Primary job: return links from a web index without building an advertising profile from queries. No AdSense units as organic results. No selling queries to advertisers for their own marketing. Ordinary logs for abuse and uptime may exist. OernoeBot crawls public pages under robots.txt. Outbound clicks can strip referrers so destinations do not harvest the query string. Listings people submit are public after approval — not Health notes.

Privacy reading: Search is where “queries are not an advertising file” has to be true in code. It is not where we pretend www never shows ads.

## account.oernoe.com — identity and SSO

Primary job: registration, login, credentials, TOTP, session auditing, data export, and account lifecycle. Session cookies are scoped for cross-service auth. No advertising scripts on auth surfaces. This host is where password and 2FA controls live. Privacy requests often start with “write from the account email” because this identity is the verification key.

Privacy reading: Account cookies are essential authentication cookies, not ad identifiers. Blocking them can break SSO even if you never opened an eligible guide.

## chat.oernoe.com — messaging

Primary job: direct messages and rooms with TLS in transit and retention controls the product exposes. Attachments can be scrubbed of sensitive image metadata. Message content is not an advertising feed. Privacy reading: sharing a Chat link is not the same as publishing a journal essay. Deletion of an account removes account-held threads as described in privacy-request handling; it does not invent a court order against someone else’s device copies.

## ai.oernoe.com — conversational assistant

Primary job: research and drafting help with a zero training-retention covenant described in the AI privacy guide. No ads on AI surfaces. Prompt topics are not ad-profile inputs. Edge filtering can mask some PII patterns and block some injection attempts. Privacy reading: ephemeral inference is strong infrastructure language; your hygiene still matters. Do not paste production secrets.

## docs.oernoe.com and drive.oernoe.com — documents and files

Docs: collaborative documents with visible permissions, Markdown, math, export. Drive: encrypted storage for personal and team files. Both emphasize encryption in transit and at rest in the cloud security guide. Share links can expire and carry roles or passphrases. Privacy reading: the permission dialog is the control. Collaborative sharing is intentional disclosure to people you choose — not a silent brokerage.

Docs and Drive use the labels Document, Spreadsheet, and Presentation. Use those Oernoe labels. Do not rewrite them as Google Sheets or Google Slides, and do not invent separate Sheets/Slides hosts. Spreadsheet and Presentation files still live in the Docs/Drive privacy boundary, not on www ads inventory.

## health.oernoe.com — wellness notes

Primary job: private personal wellness organization. Not a medical device. Not clinical diagnosis. Exports may exist for personal archiving. Privacy reading: treat Health as sensitive personal notes. It is not Search. It is not www ad inventory. A privacy request should name Health explicitly if that store is in scope.

## tracker.oernoe.com — personal life tracker

The live UI is a personal tracker: Today, Habits, Homework, School, Relationships, Check-ins, Focus, Insights, and Reminders, with daily mood check-ins and a focus timer. Older homepage or guide blurbs that called Tracker “operational status and telemetry” conflict with that UI. Prefer the live product. Privacy reading: habits and check-ins are personal records under your account — not an ops dashboard for the public internet, not journal content, and not ad inventory. Name Tracker explicitly in a privacy request if those notes are in scope.

## Upcoming hosts are not live privacy stores

Mail is upcoming. The status page exists so we stop collecting addresses for unreleased software. Maps, Music, Studio, News, and OerAlerts are not live How-To products. Old URLs may be noindexed for link stability. Privacy policies should not invent mailboxes, maps history, or music profiles that strangers cannot open today. If the homepage does not list a service as live, do not assume the account unlocks it.

## Cookies and ads differ by host on purpose

Essential auth cookies belong to Account and product hosts. Advertising technologies belong only to eligible www pages. Preferences flags that hide the cookie bar are first-party notice state, not ad IDs. Privacy Policy’s advertising section applies to selected publisher pages and explicitly does not mean ads are enabled on Chat, Drive, Docs, Health, Tracker, Account, or login screens. Cookie Policy repeats the exclusion list.

When someone says “Oernoe tracks me,” ask which hostname. The accurate answer is almost always longer than the accusation.

## How privacy requests should name hosts

Write privacy@oernoe.com from the account email. Say export, correction, deletion, or restriction. Name Search, Health, Chat, AI, Docs, Drive, Tracker, Account, or www when you can. Different stores sit behind different hosts. Vague mail slows everyone. Deletion confirms once and cannot be undone. Exports omit other people’s data. Search result takedowns for third-party pages are not the same as account deletion.

## Funding boundaries follow hosts too

Free core tools live on product hosts without AdSense. Labeled premium, when offered, is commerce — not query selling. Contextual ads live on selected www documents. Shared operator, separate files. That sentence is the privacy topology in one line.

## What this essay refuses

It refuses network-wide zero-tracking slogans. It refuses network-wide no-ads claims. It refuses treating upcoming services as live. It refuses collapsing all cookies into advertising cookies. It refuses fake scale claims. It refuses promising one privacy request can rewrite Google’s systems or the public web.

Privacy differs by hostname because the products differ by hostname. Learn the map. Then the policies stop looking like contradictions and start looking like boundaries.

## CORS, cookies, and why “logged in everywhere” is not “shared data lake”

SSO convenience is easy to misread as a single database of everything you ever typed. Architecturally, specialized hosts keep isolated security and CORS boundaries and enforce data segregation rules. A Chat message does not become a Search ranking feature. A Health note does not become a Docs template for strangers. An AI prompt does not become an AdSense keyword on www. Account issues tokens so you can open the doors you are allowed to open. It should not flatten the rooms behind those doors into one marketing table.

When a bug makes navigation feel shared in the wrong way — for example, an ad script appearing where it should not after a client transition — that is a hostname boundary failure. Report it with URLs. Do not generalize it into “they track everything.”

## How www privacy text should cite other hosts

Publisher essays may name product hosts. They should not pretend www stores Drive bytes. They should not pretend Search needs an account for ordinary queries. They should not pretend Tracker is an ops status page that replaces Privacy Policy. Cross-links to guides are good. Conflated claims are how corrections entries are born.

Eligible ads on www are a property of selected finished publisher pages. They are not a property of search.oernoe.com. Repeating that across essays is intentional redundancy for reviewers who land on one URL only.

## Incident thinking by hostname

If Search results look wrong, that may be index quality, not a privacy breach. If Chat will not send, check your session and support channels before assuming interception. If AI refuses a prompt, that may be safety filtering described in AI policies, not silent training theft. If Docs will not share, check permissions before assuming a backdoor. If www shows an ad on About, that is an ads exclusion bug. If www shows an ad on a long finished guide, that may be expected. Hostname-first debugging prevents privacy panic theater and also prevents ignoring real bugs.

## International processing without hand-waving

Privacy Policy notes information may be processed in countries other than your own, subject to safeguards required by applicable law. That sentence applies across hosts that link to the policy. It is not a special exemption for ads. It is not a claim that every subprocessors’ country list belongs in a journal essay. Rights requests still go to privacy@. Jurisdiction does not erase the hostname map; it sits on top of it.

## Editorial voice across hosts

Guides and How-To explain behavior. Journal essays interpret for a reader job. Legal pages govern. Product UIs win ties about what the screen shows. When those layers disagree, we fix the layer that is wrong and record public mistakes on Corrections when we were publicly wrong. Hostname privacy fails when marketing language on www overclaims what a product host does. It also fails when a product host’s empty shell gets indexed as if it were a guide. noindex on shells exists to stop that second failure.

## A compact hostname privacy card

- www: publisher; selected ads possible; notice cookie bar
- search: queries not ad file; no AdSense results chrome
- account: auth; export/delete entry points; no ad scripts
- chat: messages; retention controls; not ad inventory
- ai: ephemeral training policy; no ad scripts on surfaces
- docs/drive: shares and encryption; permissions UI
- health: personal wellness notes; not clinical care
- tracker: personal life tracker (habits, check-ins, focus) per live UI
- mail and other unreleased names: not live How-To stores

Pin that card next to any slogan you are tempted to ship. If the slogan cannot survive the card, delete the slogan.

## Contact paths mapped to hosts

Product broken on a host: support@oernoe.com with the hostname. Rights request about account-held data: privacy@oernoe.com. Legal process: legal@oernoe.com. Editorial error on www: hello@oernoe.com. Corporate: info@oernoe.com. Partnerships: partnerships@oernoe.com. The map prevents a Chat bug from sitting in a partnerships queue while someone assumes silence means denial of a privacy right.

## Why this topology is worth the friction

A monolithic app with one cookie jar is easier to market. It is harder to tell the truth about. Distributed hosts make sentences longer and claims narrower. Narrow claims are what survive AdSense review, privacy questions, and your own Corrections page. Friction in the topology is a feature when it stops a single slogan from laundering every product into one promise.