Columbia
Your address and request take separate paths.
Columbia sends supported reads through two services: a relay that sees your network address and encrypted bytes, and a gateway that reads the request without receiving your address from the relay. The privacy benefit depends on the request and the operators. Lander currently runs both services.
How the split works
Your device encrypts the request to the gateway, then sends it through the relay. The relay forwards the encrypted request without your network address. The gateway decrypts it and contacts Reddit. Keeping those roles under independent, non-colluding operators provides a stronger privacy boundary than running both under one operator.
The sealing is Oblivious HTTP (RFC 9458) with HPKE encryption (RFC 9180) — the same standardized split-trust design used for private DNS and telemetry elsewhere in the industry, applied to reading Reddit.
What each party can see
This table describes requests that actually use Columbia. Direct requests and direct fallbacks do not receive this separation. Account routing is a distinct opt-in because an account credential identifies you to the gateway.
| Party | Network address | Request content |
|---|---|---|
| The gateway address for routed requests; your address for direct requests | Yes; signed-in requests also identify your account | |
| The relay operator | Your network address | No — sealed envelope |
| The gateway operator | Not forwarded by the relay | The request; also your account credential and content if account routing is enabled |
| Service separation does not establish independent operators. | ||
Lander currently operates both relay and gateway. The services have different roles, but they are not independent operators. Self-hosting a hop under a separate operator can reduce that shared trust; it does not eliminate timing correlation, collusion, or identifying information inside a request.
What the design protects
Oblivious HTTP keeps the request content encrypted while it passes through the relay. It does not hide request timing or traffic volume, prevent operators from colluding, or make a signed-in request anonymous to the gateway. It is a browsing transport, not a VPN for all app traffic.
Columbia’s source is available under the PolyForm Noncommercial license. You can inspect the code and self-host it for permitted uses. Read the self-hosting guidance before choosing operators or changing your routing configuration.
Where it stands today
Columbia is enabled by default for supported public reads. If a read cannot use the relay, Lander may fall back to a direct connection. Signed-in requests normally go direct. On iPhone and iPad, Settings > Advanced > Columbia includes the relay switch and “Route my account too”. That account option is off by default: enabling it sends your account credential and request content, including messages, through the gateway. Lander Vision’s Settings > Privacy > Columbia (Privacy Relay) offers hosted or self-hosted source configuration. See the privacy policy for these tradeoffs.