Ninety requests. Ten productions. Seven years.
The numbers are small because the account is small in the way that counts: very little is attached to one, so there is very little for anybody to ask for. All of it is below.
What this report counts
Nothing here is rounded. There is not enough of it to need rounding.
A request means a formal demand for customer data served on us by an authority, a court, or a party claiming standing to serve one. Copyright notices are not in these figures and are counted separately at the bottom of the page, because there are thousands of them and they ask for a takedown rather than for data.
Everything is counted on arrival rather than on resolution, and a single request covering four accounts counts once with four accounts noted beside it. Demands that turned out to be a private party on convincing letterhead are counted too. Roughly one in four is exactly that.
The report is republished in full on the first day of January, April, July and October. Figures for the current year are partial by definition, and the 2026 row runs to the date printed at the top of this page.
The categories, and how each one goes
Production order from the site’s own jurisdiction
The only category we answer with data. Checked for court, scope and signature, then answered with whatever exists. You are notified before anything leaves.
Foreign order served directly
Refused, with a note explaining the route through the courts of the country the site actually sits in. Two have come back that way and both were then answered.
Emergency disclosure request
A claimed threat to life with no order attached. Answered when the request is coherent and the body making it can be verified, and disclosed publicly afterwards. Three since 2019, one of which was a hoax.
Civil discovery
A litigant hoping to identify a customer. We hold no identity, so the reply is a letter saying so. Four escalated to a court order and received the same answer in a more expensive format.
Private party on headed paper
An investigator or a law firm demanding data with no legal basis whatsoever. Refused, and counted here anyway, because pretending it never arrived would flatter the numbers.
National security demand
None, ever. The canary is the more reliable place to check that, since this page could in principle be edited under duress and the canary could only be abandoned.
The numbers, by year
Request volume tracks the number of running instances, which is what you would expect and is not otherwise interesting.
| Year | Requests | Answered with data | Accounts affected | Customer notified |
|---|---|---|---|---|
| 2019 | 1 | 0 | 0 | Not applicable |
| 2020 | 3 | 0 | 0 | Not applicable |
| 2021 | 6 | 1 | 1 | Yes |
| 2022 | 9 | 1 | 1 | Yes |
| 2023 | 14 | 2 | 2 | Yes |
| 2024 | 18 | 3 | 3 | Yes |
| 2025 | 23 | 2 | 2 | Yes, one bounced |
| 2026, to 23 August | 16 | 1 | 1 | Yes |
| Total since 2019 | 90 | 10 | 10 | Every case |
The bounced notification in 2025 went to a mailbox abandoned four months earlier. Records were produced after fourteen days, which is the notice period we allow ourselves when a customer cannot be reached.
What was actually disclosable
Ten productions in seven years, every one of them thinner than the requesting party had assumed.
In eight of the ten, what left the building was an email address plus invoice records showing what was bought, where it ran, and for how long. Invoice records carry no name, because there is no name to carry, so their evidential weight is the address and the timing and nothing beyond that.
Two of the ten also included a panel access log, since those requests happened to land inside the seven days in which one exists. Such a log holds timestamps and a truncated network prefix. It does not hold a full address, and it says nothing at all about traffic through the instance.
Every production came with a written statement of which parts of the request could not be answered. Flow records were asked for six times and do not exist. Traffic content, four times, with the same answer. Encryption keys came up twice and are not ours to hand over. Identity documents were requested on nine occasions, which tells you how thoroughly the rest of the industry assumes everyone collects them.
Copyright notices, which are a different thing
A little over eleven thousand copyright notices have reached the abuse address since 2019, the overwhelming majority machine-generated and sent in bulk. They demand a takedown rather than customer data, so none of them appear in the table above.
Handling is mechanical. The notice is forwarded to the customer with the complainant’s contact details intact, a response window is set according to the law of the site, and the matter closes when the customer resolves it. Content is removed by us only where the law of that site obliges us to act, and repeated uncontested notices against one instance are the single route to suspension.
About one notice in nine is withdrawn or abandoned once the customer replies to the complainant directly. That is a reasonable argument for replying.
Numbers age. This one carries a date.
The date at the top is the last day covered rather than the day somebody touched the file. Full republication is quarterly, and the canary covers the gap between editions.