what is not published

everything in your folder is on the web, with these exceptions. they are not listed anywhere and they cannot be fetched by url.

dotfiles and dotfolders#

anything whose name starts with a dot, at any depth:

• .obsidian/ — Obsidian config, themes, plugin settings
• .trash/ — notes Obsidian moved to trash
• .git/, .claude/, .vscode/, .DS_Store

tools keep their working state next to your files, and none of it belongs to the website.

the one exception is .well-known/, which is a public namespace by design — it carries SSL renewal challenges and machine-readable files for agents.

drafts#

a file with draft: true in its frontmatter is hidden from the site, RSS, search and sitemap until you remove it. see drafts.

system files#

files tinydot uses to build the site rather than show it:

• logo.png, favicon.ico and similar — used as your logo and favicon
• index.md — supplies its folder's page instead of appearing as an entry in it
• settings.json, theme.json, style.css — customization

private sites#

access control restricts a whole site to people you allow — by email, by domain, or with a password. that is a different thing from the list above: the pages exist, they are just not public.

what this does not do#

hiding a file is not encryption. a file inside a published folder is served to anyone with the address unless it is on this list or the site itself is restricted. if something must not leave your machine, keep it out of the folder.