The collection

Every exhibit is a story of security failing miserably — a breach, an outage, a shortcut that aged like milk. Exhibits are organised into wings. There are no names on the plaques, because there are no names in the archive.

The promises

• No accounts. No names. No log. The museum has no idea who you are when you submit — by architecture, not by policy.
• One-time tokens, two doors. The Submit page mints a fresh token in your browser: it is simultaneously an email address and the submission URL. It works exactly once — whichever door arrives first — then burns, and expires within about two months regardless.
• Your From: line is used once, then gone. It is distilled into an unlinkable token that exists to rate-limit spam. It cannot be reversed into an address, and the address itself is never stored anywhere.
• Nothing identifying is stored. No emails, no headers, no IPs, no precise timestamps. The database physically has no column for who you are — web submissions don't even carry the unlinkable From: token, because there is no From: line to distill.
• Curators rewrite everything. A human — with an AI conservator's helping hands — turns every accepted story into fiction: people become roles, companies become placeholders, dates become seasons, amounts become magnitudes. The pattern of the failure is the exhibit; the facts are not.
• The raw version dies at approval. The mangled exhibit text overwrites whatever arrived. Your words exist nowhere after curation.
• The doors open on safety, not on schedule. The museum stays dark until enough exhibits exist, across enough wings, from enough distinct submitters, that no story can be pinned on any single person.
• No cookies, no analytics, no tracking. Email submitters get one automated receipt when their exhibit arrives — sent from the address they wrote to — then silence forever, because we never kept the address. Online submitters get the confirmation on screen and nothing else.

The honest limits

• Email transits Cloudflare's systems; they see the sender and the message. The museum's code never persists either — but "we don't keep it" and "nobody could ever see it" are different sentences, and we only promise the first.
• Your mail server, your employer's mail server, and the network between you all see that you sent an email somewhere. If that bothers you, send from an account that isn't your name.
• The story itself can identify you if you load it with specifics. Curators scrub aggressively, but write like a stranger: turn your own dates into seasons before you send, and you've done half the conservator's work.
• The key that makes submit tokens verifiable ships inside the site's JavaScript. It stops lazy spam and address-spraying, not a determined adversary — the human approval gate is the real wall.
• The online form transits Cloudflare like email does: the network path sees your request, and Cloudflare could see your IP. The museum's code never persists either — but "we don't keep it" and "nobody could ever see it" are different sentences, and we only promise the first.

What we ask of submitters

• Write it yourself, keep it honest, and expect it to be fictionalised.
• Three submissions a month, per person. The museum counts; it just can't name.
• If a story can't be made safely anonymous, it doesn't get exhibited. There is no appeals process, because there is no one to appeal to — that's the deal.