Federated social media: Mastodon, Nostr and using X privately
On a centralised social network, one company runs the servers, sets the rules, holds the data and can change its terms at any time. Federated and decentralised networks spread those roles out. Mastodon works like email: many independent servers that talk to each other through an open standard. Nostr goes further: your identity is a cryptographic key, and the servers that carry your posts are interchangeable. This article explains how both work, what they protect and what they do not, and how to use X more privately if you stay.
Why the structure of a network matters
A network's structure decides who can change the rules. Mastodon's documentation sorts networks into three kinds:
| Kind | How it works | Examples |
|---|---|---|
| Centralised | One operator runs everything | X, Facebook, Instagram |
| Federated | Many operators, each running a server, linked by a common protocol | Email, telephone networks, Mastodon |
| Distributed | No servers in charge at all; peers connect directly | BitTorrent, IPFS |
On a federated network, if you dislike how your server is run, you move to another and keep talking to the same people, just as you can change email provider without losing the ability to write to anyone.
Mastodon and the fediverse
Mastodon is free software for running a social network server, licensed under the GNU Affero General Public License version 3. The licence means anyone can run it, read its code and change it, and anyone who offers a modified version as a service must share the changes. Mastodon's development is funded by donations, with no venture capital and no advertising built into the software.
Mastodon servers talk to each other using ActivityPub, a decentralised social networking protocol published as a W3C Recommendation in 2018. Any software that speaks ActivityPub joins the same network, known as the fediverse: PeerTube for video, Pixelfed for photos, and others such as Pleroma and Misskey. A Mastodon user can follow a PeerTube channel without leaving Mastodon.
Choosing a server
Every Mastodon server has its own rules, usually on its about page, and its own sign-up policy: open, by invitation, or with approval. Servers listed on joinmastodon.org agree to a covenant that includes active moderation against hate speech, daily backups and at least three months' notice before closing.
Moderation is local
Each server moderates its own users and decides which other servers to connect with. A server can limit or suspend an account, and it can block a whole server that hosts abuse. No server can delete an account on another. The result is a network where no single operator can remove you from everywhere, and where each community can still keep out the people it does not want.
What Mastodon does not do
- Posts do not move with you. Mastodon can move your followers to a new server automatically, but your posts stay behind. You can download an archive of them.
- Private mentions are not end-to-end encrypted. Mastodon's own documentation says it is not an encrypted messenger like Signal or Matrix, and the administrators of both servers may be able to read a private message. For private conversations, use Signal.
Nostr: your identity is a key
Nostr is a simple open protocol with no central server at all. Every user has a key pair. Every post, called an event, is signed with the private key, and following someone means following their public key. Posts are sent to relays: plain servers that anyone can run, under their own rules, and that clients can swap at will. If one relay refuses your posts, you publish to others.
That design gives Nostr strong resistance to censorship, and it puts more responsibility on the user:
- Guard the private key. It is your account. The protocol includes ways to store it encrypted with a password and to keep it on a separate signing device, so that apps never hold it.
- Deletion is a request. You can ask relays to delete a post, and the specification itself says a deletion request cannot be guaranteed, because a post may already be stored by relays and clients you do not control.
Own your name
Both networks let your identity rest on a domain you control.
- On Mastodon, a server can give its users handles on the organisation's own domain, such as @[email protected], while the server itself runs at a subdomain.
- On Nostr, the NIP-05 standard maps a name such as [email protected] to a public key through one small file on your website. It identifies you; clients keep following the key even if the file later changes.
A name on your own domain is portable in a way a username on a platform is not.
Using X more privately
If you stay on X, read its current terms. As at October 2026, X's privacy policy says it may use the information it collects to help train its machine learning and artificial intelligence models, and that partners it shares data with may, unless you opt out, use it for their own purposes, including training their own models. Its terms of service give X a licence to use your posts for training its models.
Settings worth reviewing, under Settings > Privacy and safety:
- Protect your posts, so only followers you approve see them.
- Data sharing with business partners, which X's privacy policy names as the control for sharing with partners.
- Discoverability, which controls whether people can find you by email address or phone number.
- Any setting on sharing your data for AI training. Check the current wording in the app, because it changes.
Remember that direct messages on X, as on Mastodon, are not a substitute for an end-to-end encrypted messenger.
Federated services with Noiz
Mastodon, PeerTube and a Nostr relay all run on a Noiz Cloud server, a self-managed Ubuntu or Debian server with full root access. Mastodon's own guide installs it from source on Ubuntu 24.04 or Debian 13. A NIP-05 name needs only one small file on any website, so it works on every Noiz shared hosting plan.
If you want to talk through running software like this on a Cloud server, get in touch.
Sources
Checked 19 October 2026.
Standards and protocols
- W3C: ActivityPub
- Nostr protocol and NIPs 01, 05, 09, 46 and 49
Mastodon
- Mastodon documentation and joinmastodon.org
- Licence and release v4.7.3
- Installing from source, configuration and moderation
- Moving accounts and posting
X
- X Privacy Policy, effective 15 January 2026
- X Terms of Service, effective 9 October 2026
Noiz
Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.
