Pagemates has no server, no account and no analytics. The developer receives no data.

What leaves your browser, and to whom:
- Public Nostr relays (relay.damus.io, nos.lol, relay.primal.net, nostr.mom): a SHA-256 hash of the page address and of the site, your channel number and a random peer ID, signed with a throwaway key per room. Never the address itself. Relays see your IP address, as any server you connect to. A hash of a public address can be recomputed by anyone who knows that address.
- The public PeerJS server (0.peerjs.com): your IP address and a random connection ID, to introduce browsers to each other. Never the page or the messages.
- The people in your rooms, directly (WebRTC, encrypted): your nickname, color, identity code, cursor position (relative to page elements, never page text), clicks, the text you highlight (can be turned off), your drawings, chat and private messages. They can see your IP address, as with any peer-to-peer connection.

By default every site is joined automatically; this can be turned off in the settings (sites are then joined on demand), and any single site can be left. Never in private browsing, never automatically on local addresses. Form fields are never read.

Stored locally only (browser storage): settings, your identity key and its proof of work, the people you blocked, your drawings. No message history is kept. Uninstalling the extension deletes all of it.