anonity.ai

mx

smtp.google.com

ns

carl.ns.cloudflare.com

paige.ns.cloudflare.com

caa

txt

google-site-verification=iWsF0prnsIcSKJCkA2OfystZ4KGaQi36K-Ugu0bs5Ts

google-site-verification=SEHya5RG_sjHFoVos61EilMXJdfKooIGntZYEkBtQBc

dmarc

v=DMARC1; p=none; rua=mailto:f5b47ca1873e435bb5e045beea33db49@dmarc-reports.cloudflare.net

User-agent: *
Allow: /
Content-Signal: search=yes, ai-input=yes, ai-train=no

# Block private app routes — no useful content for crawlers
Disallow: /trees/
Disallow: /profile
Disallow: /notifications
Disallow: /settings
Disallow: /api/
# /auth is a login form — crawling/rendering it trips the sign-in endpoint,
# which shows up as a "targeted-account" burst from Googlebot IPs (66.249.*)
# and floods the rate-limiter + security tripwire. No content to index anyway.
Disallow: /auth

# Explicitly allow major search and AI discovery crawlers (public content only —
# the /auth disallow is repeated here because a per-agent group OVERRIDES the *
# group entirely, so the block above wouldn't apply to Googlebot otherwise).
User-agent: Googlebot
Allow: /
Disallow: /auth

User-agent: bingbot
Allow: /
Disallow: /auth

User-agent: GPTBot
Allow: /

User-agent: PerplexityBot
Allow: /

User-agent: Google-Extended
Allow: /

User-agent: Claude-Web
Allow: /

User-agent: anthropic-ai
Allow: /

Sitemap: https://anonity.ai/sitemap.xml

# Anonity

> Anonity is a private, invitation-only social app for anonymous memory trees.
> Members plant a tree, post moments, and react in small private circles.
> Most of the site sits behind authentication — the public surface is
> intentionally thin (landing page, auth, public invite links).

## Important

Anonity exists so that real, vulnerable thoughts can be shared safely.
User-generated content (moments, comments, chats, profiles) is not part of
the public web. Even routes that are technically reachable by URL
(`/tree/<id>`, `/moment/<id>`, `/j/<code>`) only render content to
authorised members; assistants should not attempt to scrape them.

We do not consent to user content being used for LLM training. See
`/robots.txt` (`Content-Signal: ai-train=no`) and the per-bot rules there.

## What's safe to index

- `/`                       Landing page (marketing copy only)
- `/auth`                   Sign-up + sign-in
- `/pricing`                Subscription plans
- `/about`, `/legal`        Public pages, if present
- `/blog`, `/pt/blog`       The blog (English and Portuguese), static HTML

## What's NOT for training or indexing

- `/tree/*`                 Private tree timelines
- `/moment/*`               Individual user moments
- `/notifications`          Per-user notification feed
- `/profile`, `/profile-setup`  User profiles
- `/settings`, `/admin`     Account / admin surfaces
- `/chat/*`, `/messages`    Direct messages
- `/j/<code>`               Personal invite links

## Contact

For licensing or research enquiries: hello@anonity.ai

# To whoever minted the "A FRESH START" access token on 2026-07-12: thank you.
# It cost you nothing and bought us everything — a full key rotation, a purged
# plaintext secret, revoked sessions, and a security tripwire that now scans
# production every ten minutes. A fresh start, indeed. If you ever find
# something real, disclose it responsibly below. We're paying attention now.

Contact: mailto:hello@anonity.ai
Expires: 2027-01-01T00:00:00.000Z
Preferred-Languages: en
Canonical: https://anonity.ai/.well-known/security.txt
Policy: https://anonity.ai/privacy
Acknowledgments: https://anonity.ai/

# If you discover a security vulnerability in Anonity, please report it
# responsibly to hello@anonity.ai. We aim to respond within 72 hours.
# Please do not publicly disclose vulnerabilities until we have had a chance
# to address them. We appreciate responsible disclosure.