Privacy Policy

The short version

• No accounts, no names, no emails, no phone numbers.
• People in your room can't see who wrote what.
• We do keep an encrypted network record for every note: the IP address, an approximate location looked up from it, and device details. It's deleted along with the note (30 days for text, 30 seconds for photos), unless the note is reported.
• Reported notes and their records are kept for up to 365 days, and may be shared with the authorities.
• No ads, no analytics trackers, and we never sell data.

1. What we keep, and why

• Rooms: the name, the PIN (stored scrambled with bcrypt, so it can't be read back), a scrambled copy of the creator's key, and a count of recent wrong PINs (to block guessing).
• Notes: the text or photo/GIF, when it was sent, what it replies to, and how many of each reaction it has. Who reacted is stored only as a one-way code per room, never as you. Photos are re-encoded on your device before upload, which removes hidden metadata like GPS location. GIFs are sent as they are.
• A network record for each note: the sender's IP address; an approximate location our host looks up from that IP (city, region, country, postal code and coordinates, usually accurate only to a city or area, never a street address); device and browser details your browser sends (such as device model, operating system, browser and language); and the exact time. It's encrypted before it's stored, and no one in any room can see it. We keep it so that abuse can be investigated when a note is reported, and so that we can respond to lawful requests from the authorities.
• Reports: a copy of the reported note (including a reported photo, which is then kept even after it disappears from the room), the reporter's description, the time, the sender's network record, and the reporter's network record (so false or abusive reports can be dealt with too).
• Who's online: random codes kept in your browser, used only to count people: one per room (“3 people here”), and one for the whole site (the “online” count on the home page). For the site count we store only a scrambled copy of the code and when it last checked in, while the site is on your screen; it's removed when you leave and deleted within minutes.

We rely on our legitimate interests in keeping people safe, preventing abuse, and meeting our legal duties.

2. What stays on your device

• Cookies: a signed pass for each room you've entered, the creator key for rooms you made, your sidebar setting, and a 2-minute cookie right after you join a room.
• Browser storage: which notes and reactions are yours (used only on your device, for example to highlight your reaction), your sound setting, the random online-counter codes, and the PIN of rooms you entered (to show it under the invite QR code). These never leave your device.

3. How long we keep it

• Text notes: 30 days, then deleted together with their network record.
• Photos and GIFs: 30 seconds, then deleted together with their network record, unless reported while visible.
• Reports: up to 365 days, then deleted automatically.
• Room names and scrambled PINs: until the room is removed.
• Our hosting provider briefly keeps its own request logs, which include IP addresses, under its own policy.

4. Who can see it

• People in your room see notes, photos, times, reaction counts and how many people are online. Never network records, and never who reported what.
• The site's owner sees reported notes and their network records, on a private page protected by a secret key, only to handle reports.
• The authorities: we share reports and network records when the law requires it (for example, a valid court order or subpoena), when we believe in good faith it's necessary to prevent death or serious harm, or to report the sexual exploitation of children.
• Our service providers, who handle data only to run the service: Vercel (hosting and the IP location lookup), Neon (database) and Pusher (live message delivery; it sees your IP address while you're connected).

We never sell data or use it for advertising.

5. Security

Everything travels over HTTPS. Network records are encrypted with AES-256-GCM, PINs are scrambled with bcrypt, and the reports page is locked with a secret key. No system is perfectly secure, but we work to keep this one tight.

6. Your choices and rights

You can leave a room at any time, which removes its pass and saved PIN from your device, and you can clear your browser's data. There are no accounts, so we usually can't tell which notes are yours. Depending on where you live (for example, under the Philippines' Data Privacy Act of 2012 or the EU's GDPR), you may have the right to access, correct or delete your personal data. Contact us and we'll help where we can match the data to you. We may keep reported content where the law allows, for example during an investigation.

7. Children

The service isn't for children under 13, and we don't knowingly collect their data. If we learn that we have, we delete it.

8. Changes

If this policy changes, the date at the top changes too. Please also read the Terms of Use.

9. Contact

Privacy questions and requests: support@whosaid.space.