Columbia
Not “we don’t look.” We can’t.
Every privacy policy on the internet asks you to trust a promise. Columbia is built so the promise is unnecessary: it splits each proxied request into two halves — who is asking, and what they are reading — and hands each half to a different operator. Neither ever sees the other’s. That is not a policy. It is a property of the system.
How the split works
Your device seals the request with keys only the far end holds, then sends it through a relay. The relay can see your network address — it has to deliver the reply — but the content is a sealed, unreadable envelope. The gateway on the other side opens the envelope and talks to Reddit, but by then your address is gone; all it sees is an anonymous request arriving from the relay. Run the two on different operators and no one can rebuild your reading history, because no one ever saw the whole of it.
The sealing is Oblivious HTTP (RFC 9458) with HPKE encryption (RFC 9180) — the same standardized split-trust design used for private DNS and telemetry elsewhere in the industry, applied to reading Reddit.
What each party can see
The claim is falsifiable, so here it is as a table — stated for the design’s target arrangement: relay and gateway run by different operators, which is what self-hosting one half gives you today.
| Party | Knows who you are | Knows what you read |
|---|---|---|
| Only if you sign in — and sign-in traffic goes direct, not through Columbia | Yes, it serves the content | |
| The relay operator | Your network address | No — sealed envelope |
| The gateway operator | No — address stripped by the relay | The anonymous request, with no one attached to it |
| Apple | Your App Store account, like any app | No |
| Us | No — with an independent relay; see the note below for today’s deployment | No — content is sealed until the gateway, where requests are anonymous |
| No single service ever holds both halves. | ||
Full disclosure, because this page’s whole argument is that you shouldn’t take anyone’s word: today we operate both halves on our own infrastructure. The split still holds between the two services — the relay service never sees readable content, the gateway service never sees your address — but operator independence, the property that removes us from the trust equation entirely, arrives only when the relay runs under someone who isn’t us. The design supports that, self-hosting either half gives it to you now, and moving the relay to an independent operator is the roadmap’s next step.
Why a promise isn’t enough
“We don’t log” is a statement about behavior, and behavior changes: companies get acquired, subpoenaed, breached, or simply curious. A structural guarantee is different. When the relay physically never receives a readable byte of content, there is nothing for a new owner, a court order, or an attacker to extract. The strongest privacy policy is the one the system makes impossible to violate.
That is also why Columbia is open source under a noncommercial license. You can read the code, compare it to what is deployed, or run the entire path yourself — your own relay, your own gateway — and owe us no trust at all.
Where it stands today
Columbia ships in the app now as an opt-in for anonymous reading, and it fails open: if the path is unavailable, the app falls back to reading directly. The default path is unchanged — your device talks straight to Reddit with nothing of ours in between. Signed-in actions (voting, posting, your inbox) always go direct, because they are yours by definition. This page describes what Columbia does when you turn it on — the same description you can check against the source.