Privacy

What we never collect

No name, email address, or phone number — there is nowhere to enter one.
No password. Accounts are anonymous access codes generated on our side.
No tracking, analytics, advertising, or third-party scripts. Every page loads only from this site — no external fonts, CDNs, or beacons.

What is stored

Your account is a set of access codes. Only a one-way hash of each code is kept — we can't show a code again after it's issued, and we can't recover a lost one.
Two-factor authentication, if you turn it on — it is off unless you do. Setting it up stores one secret shared with your authenticator app. Unlike your access codes this one is not a hash: the app and the site have to hold the same secret to arrive at the same six digits, so it is kept in a form we can read. It is never sent anywhere — the square you scan is drawn on this page rather than fetched — and there is no phone number, no app account and nothing that identifies the device. Turning two-factor off deletes it.
Your personas: the nicknames, descriptions, ages, genders, chat-preference tags, and pictures you choose to add. Others only ever see these — never anything that ties back to your account.
Pictures are re-encoded on upload, which strips all camera and location (EXIF/GPS) metadata; the original file is never kept.
Your conversations: messages and pictures you send, kept as chat history so they survive navigation.
Your settings and social state: blocks, reports you file, private notes, who you watch, canned replies, most-used emotes, and preferences.

What is stored on your device

A few small things are kept by your own browser. Every one of them is set by this site and read only by this site; none of them follow you anywhere else, and none of them are used to identify, profile, or advertise to you. That is why you were never shown a cookie banner — there is nothing optional here to ask you about.

Four cookies. One keeps you signed in. One protects forms from being submitted on your behalf by another site. One remembers which language you chose, so you are not handed English again on your next visit. The fourth carries newly generated access codes from the moment you ask for them to the screen that shows them, and is gone when you close the browser. The sign-in cookie can't be read by scripts and is never sent along with a request from another site.
Your alert preferences — whether message sounds and notifications are silenced here, and whether you've already been offered notifications once, so you aren't asked again. These sit in the browser rather than on your account on purpose: it's the setting people actually want per device, quiet on a work laptop and loud on a phone.
A notification registration, only if you ask for one — an address your own browser gives us so a reply can reach you after you close the tab. Nothing is stored until you say yes, and turning it off in the bell removes it. Delivery goes through your browser maker's own notification service (Google, Mozilla, or Apple) because that is the only way any website can send one — but nothing written in a conversation passes through it: what we send is a fixed sentence and a link back here, never a name, a message, a picture, or a count.
Your layout — the panel sizes you drag the chat splitters to, kept per device so a phone doesn't inherit the proportions of a wide monitor.
The idle clock — the time you were last active, shared between your open tabs so the automatic sign-out measures one idle period instead of one per tab. If a sign-out can't reach the server, a note is left here so the next page you load can finish it.
Site files, if you install the site as an app — its stylesheets, scripts, icons, and the page that says you're offline, so there's something to show when the network drops. Pages are never stored: each one is rendered for whoever is signed in, and a stored page could be shown to the next person on a shared device. Pictures sent in conversations are explicitly excluded too — closing a conversation deletes them, and a copy sitting in a cache here would outlive that.

Clearing this site's data in your browser removes all of it. You'll be signed out, and the preferences return to their defaults.

IP addresses

Your IP address is never written to the database or to logs. Two things count attempts by connection — wrong access codes at sign-in, and how many accounts have been created recently — and both hold nothing but a scrambled fingerprint of the address, in memory, computed with a secret that is thrown away and regenerated every time the site restarts. It cannot be turned back into an address, it cannot be matched against anything outside this server, and it is not attached to your account. Restart the site and all of it is gone. If you turn on the optional country flag, a single lookup stores a two-letter country code — never the address itself.

Staying private

Invisible mode per persona hides you from the online roster and presence.
You can opt out of being watchable, so no one is notified when you come online. When someone is notified, it is a passing alert — we keep no record of when you were online.
You can turn pictures off per persona. The picture button is then greyed out for everyone that persona talks to, and one sent anyway is refused before it is stored.
That has one exception, and you granted it yourself: anyone you chose Always show their pictures for can still send them. It is per person, and you can take it back from the same menu in that conversation — everyone else stays blocked either way.
Search engines see the site's own pages and nothing else — the front page, what it does, the board games and the guide. Nothing that identifies you is among them: your personas, who is online and every word of every conversation sit behind the login, blocked in robots.txt and marked noindex on top of it. Nothing you write here can be found by searching for it.
Notifications while a tab is open are drawn by your device, outside anything this site controls, so they carry the sender's nickname — and which of your personas it was meant for, when that isn't the one you are wearing — and never a word of what was said. That switch is on the Alerts page and belongs to that browser, not to your account: nothing about it is stored here.
A notification after you have closed the tab exists only if you asked for one, and it says less rather than more: a fixed sentence, identical for everybody, with no nickname and nothing in it that varies. That one does need something kept — the registration described above, held against your account rather than a persona so it can never join two of your faces together, and the same switch that turns it off deletes it. The separate also tell me when the site is busy switch beside it is off until you turn it on, and that choice is kept with your account too.

The AI assists

VIP+ members can ask a language model for three things: a translation — of a message that arrived, or of one they are about to send — suggestions about what to talk about next, and a draft of the private note they keep about someone. None of it happens on its own. Each is a control somebody deliberately presses, or a switch they turn on, and neither the coach nor a note draft is ever running when they arrive. The translation switch is the one that stays where it was put. It is off everywhere until somebody turns it on, it is turned on for one conversation at a time and never for a person or for the site, and it stays on in that conversation — visible above the message box, one tap to turn off — until they turn it off. While it is on, the messages in that conversation do go to the model as they arrive: that is the thing it was switched on to do, and it is the member's own screen it is translating. A conversation nobody has switched it on in has never had a message read by the model at all. Nothing here scans conversations, nothing reads ahead of being asked, and no model sees a message because it was sent.

The model runs here, on a machine we own. Not a company, not an API, not a cloud service, and no third party at any point. What is sent crosses the same private network the site already runs on, to a box in the same building, and the answer comes back the same way — nothing goes out to the internet. That is the whole reason a feature which reads what people wrote is defensible at all.
It sees that one screen and nothing else — the open conversation, both profiles as they are already displayed, and the member's own note. Not their other conversations, not their other personas, not the roster, nothing that would take a lookup. It can never learn anything about you that the person you are talking to could not already read.
Pictures are never sent. The model is given a count and told it cannot look.
Translations are kept. Nothing else is. A translation is stored beside the message it renders, so the same sentence is not translated twice — when you read it again, when you read it on another device, or when somebody else in the same room reads in the same language. When you send a message translated, the sentence you typed is kept there too, so your own line reads back as you wrote it rather than as a translation of your own translation. All of it is deleted the moment that message is edited, taken back or deleted, so none of it outlives the words it came from. It is filed under the message and the language and never under a person: nothing records who asked for it, or what anybody read. Everything else is discarded — what goes to the model is assembled for that one request, what comes back from the coach or a note draft stays in that one browser session and is written nowhere, and no admin and no other member ever sees any of it.
Read aloud uses a voice made here as well. A VIP+ member can have a message read out by pressing Read aloud on it, or by turning reading aloud on for one conversation or room — where, like the translation switch, it stays on until they turn it off. The words go to a speech server in the same building, over the same private network, and come back as sound for that one browser to play. Neither the words nor the sound is kept. When that server cannot answer, and for everyone without VIP+, the browser reads the message in a voice that runs on the member's own device, and the words never leave it.

The half worth saying plainly, because you are on the receiving end of it as often as the asking end: when someone you are talking to uses one of these, your words are part of what it reads — at their request, and without asking you. You are not told when it happens, and that is a decision rather than an oversight: a notice would announce the other person's subscription, and it would put a social cost on having wanted help with a conversation, which is the one thing the feature exists to remove. This paragraph is what stands in its place. Anything you write here may be read by this site's own model, on a machine here and never off it, because the person you wrote it to asked it to help them answer you — and it is stored nowhere afterwards.

Moderation — the limit of anonymity

Anonymity here protects your privacy; it is not cover for mistreating people or for illegal use. The house rules set out what's expected of you and what is prohibited outright.

Reports you file — about a person, a picture, or spam — are visible only to admins, together with the conversation they concern. The person you report is never told who reported them.
A reported picture is withheld from everyone the moment it's reported, and only an admin can restore or destroy it.
Spam strikes are counted against an account, not a persona, so switching persona sheds nothing. Enough strikes from separate accounts disables the account; expired strikes are deleted outright.
A disabled account can still write one appeal for an admin to read. Nothing about you beyond what's already listed above is collected in the process — there is no email address to write to, and no IP address on file to trace.

Deleting your data

Messages and pictures are deleted after 60 days — every conversation, no exceptions, starred or not. The pictures are erased from disk, not just detached. Presence logs go the same way, and a conversation left with nothing in it is removed entirely, so no record survives of who spoke to whom.
The one exception is something that was reported. When anyone files a report, the tail of that conversation — and the picture, if it was a picture — is copied to an area only admins can reach, and that copy is not touched by the 60-day sweep. Without it, a complaint nobody had got to yet would become impossible to rule on, and a picture would be judged after it had already gone. Nothing reaches that area except by somebody filing a report. A report filed inside a group copies more: a room's recent messages are whoever was talking, so the copy will include people who are not part of the complaint and are not accused of anything. That is a wider capture than a conversation's, and it is kept because a complaint stripped to one person's lines is one nobody can rule on.
A picture in a group can go sooner than 60 days. Every room keeps a fixed number of pictures — the number is on the invitation you accepted — and when a new one would go over it, the oldest is removed. So a picture in a busy room may last days. Nothing here is ever kept longer than the window; this is stricter, never looser.
A group is a different object from a message, and it has its own lifetime. Your messages are kept for 60 days everywhere on this site, in rooms exactly as in conversations — that answer has not changed and there is no exception to it. What is separate is the room: one with nothing said in it for 240 days is deleted, with everyone in it warned at 180 days, and any one message resets the clock. Two answers about two things, not two answers about one.
A game is part of the conversation it is played in, and goes when the conversation goes — on the same clock, with no separate window and nothing kept afterwards. There is no record of who beat whom: a score is counted from the games that still exist, so when they go it goes with them, and nothing anywhere keeps a running total.
You don't have to wait for that. Closing a conversation deletes it at once, for both of you, and that takes any games in it with them. Deleting your account takes everything with it.
An account unused for 365 days is deleted, along with everything in it. We have no email address to warn you on, so this notice is the warning: sign in occasionally and nothing happens.
An account that never speaks to anyone is deleted after 60 days, if it has also stopped visiting. Both halves are required: if you are here and reading, nothing happens to you however long it takes to send a first message, and once you have sent one this never applies to you again. It is for accounts that were made and then abandoned, and as above there is no email address to warn you on.
A settled report and its copied evidence are deleted after 180 days, counted from the day it was decided rather than the day it was filed. It is kept that long because it is the only record of why an account was disabled or a picture destroyed, and the person on the receiving end may ask about it after the conversation itself has gone. A report nobody has ruled on yet is never swept — deleting it would decide it, in the wrong direction.
Deleting your account (Access codes → Delete account) permanently erases every persona, conversation, picture, note, and setting tied to it — including every report either side of it and every copy taken for review. There is no backup and nothing to recover. That includes what you said in groups: your messages go from the rooms you were in, exactly as they go from your conversations, and the people still in those rooms are left with the rest of the exchange. A room you ran cannot simply be abandoned — you are asked to hand it to somebody or close it first, so nobody is left in a room with no one answering for it.
Two of your three codes are needed to delete the account, for the same reason they are needed to replace them: one code that has gone astray must not be enough to erase everything. Keep the whole set — with only one left you can still sign in and use the account, but neither you nor we can delete it or issue you a new set.
Lose all your access codes and the account is gone for good, by design.

Back