Privacy Policy
Last updated: this is a template. Have it reviewed by counsel before launch.
What we collect
- Account data (if you create one): username, email address, and a PBKDF2-hashed password. We never store your password in plain text and cannot recover it, only reset it.
- Confession/comment content you submit, plus the category and timestamps.
- IP address at time of posting, for abuse prevention and rate limiting. Not shown publicly, not linked to your account profile.
- A locally-stored anonymous browser id (in your browser's local storage, not a tracking cookie shared across sites) so you can manage your own anonymous posts without an account.
What we don't collect
We don't require or collect your real name, phone number, government ID, or physical address. We don't use third-party ad-tracking cookies for retargeting.
How we use it
Account and content data is used to operate the site: displaying confessions, letting you manage your own posts, sending account emails (verification, password reset), and moderating reported content. IP addresses are used only for rate-limiting and abuse detection.
How long we keep it
Account data is kept until you delete your account. Approved confessions/comments stay up until you delete them or a moderator removes them; deleting your account anonymizes your account record but leaves already-approved content up (see our Terms) so ongoing comment threads aren't broken.
Your choices
- Delete individual posts/comments any time from My Account (or, if anonymous, from the post itself in the same browser you posted from).
- Delete your entire account from the Account page, which removes your login credentials and personal info immediately.
- Change your username or email at any time from Account settings.
Who we share data with
We don't sell personal data. We use third-party infrastructure to operate the site (hosting, bot-detection via Cloudflare Turnstile, transactional email delivery), each processing only what it needs to provide that service.
Contact
Questions about this policy or a data request: see Contact.