Privacy

Things we never collect

Your name, email address or phone number. There is nowhere to enter them.
A password. Your account is a set of anonymous access codes that we generate.
Tracking, analytics, ads or third-party scripts. Every page loads only from this site, with no fonts, CDNs or tracking pixels from anywhere else.

Things we store

Your account is a set of access codes. Only a one-way hash of each code is kept, so we cannot show a code again after it is issued, and we cannot recover a lost one.
Two-factor authentication, if you turn it on. It is off by default. Setting it up stores one secret that is shared with your authenticator app. Unlike your access codes, this secret is not hashed, because the app and the site must hold the same secret to produce the same six digits. It is never sent anywhere (the QR code is drawn on the page, not fetched from another service), and no phone number, app account or device identifier is stored. Turning two-factor off deletes it.
Passkeys, if you create one: for each, its public key, the name you give it, when it was created and last used, and whether it is synced. We never see your face, fingerprint or screen lock. Your device checks them and tells us only that it did. The passkey itself stays on your device, and if your device syncs passkeys, it is also kept with its name in the account it syncs with, such as your Apple or Google account. So choose a name that says nothing about you. Replacing your codes or deleting your account deletes your passkeys.
Your personas: the nicknames, descriptions, ages, genders, chat-preference tags and pictures you choose to add. Others only see these, never anything that links them to your account.
Pictures: we save every upload again, which removes all camera and location data (EXIF/GPS), and we never keep the original file.
Your conversations: messages and pictures you send, kept as chat history so they are still there when you come back.
Your settings: blocks, reports you file, private notes, who you watch, canned replies, most-used emotes and preferences.
Your daily puzzles: how far you got in each day's puzzle, which is deleted after 7 days, and one result per puzzle per day that's kept longer: your time, your moves or your points. Only you see your results. They're there so you can compare with your own earlier days. The lists of today's best results show no names.

Things your browser stores

A few small things are kept in your browser. All of them are set and read only by this site. None of them follow you to other sites, and none are used to identify you, profile you or show you ads. That is why there is no cookie banner: there is nothing optional to ask you about.

Five cookies. One keeps you signed in. One stops another site from submitting forms on your behalf. One remembers which language you chose, so the site uses it on your next visit. The fourth carries newly generated access codes to the screen that shows them, and is gone when you close the browser. The fifth holds a one-time check for passkeys while the login page or your access codes page is open, stops working five minutes later, and is also gone when you close the browser. The sign-in cookie cannot be read by scripts and is never sent with a request from another site.
Your alert preferences: whether message sounds and notifications are muted on this device, and whether you have already been offered notifications, so you are not asked again. They are stored in the browser rather than on your account, so each device can have its own setting, for example quiet on a work laptop and loud on a phone.
A notification registration, only if you ask for one: an address your browser gives us so a reply can reach you after you close the tab. Nothing is stored until you say yes, and turning it off in the bell removes it. Delivery goes through your browser maker's notification service (Google, Mozilla or Apple), because that is the only way a website can send one. Nothing written in a conversation passes through it. We send a fixed sentence and a link back here, never a name, a message, a picture or a count.
Your layout: the panel sizes you set by dragging the chat dividers, kept per device so a phone does not use the proportions of a wide monitor.
The idle clock: the time you were last active, shared between your open tabs so the automatic sign-out counts one idle period instead of one per tab. If a sign-out cannot reach the server, a note is kept so the next page you load can complete it.
Site files, if you install the site as an app: its stylesheets, scripts, icons and an offline page, so something can be shown when the network is down. Pages are never stored, because each one is made for the person signed in, and a stored page could be shown to the next person on a shared device. Pictures from conversations are not stored either, because a cached copy would remain after the conversation is deleted.

Clearing this site's data in your browser removes all of it. You will be signed out, and the preferences return to their defaults.

IP addresses

Your IP address is never written to the database or to logs. Three checks use your connection: wrong access codes at sign-in, how many accounts were created recently, and whether someone on it has just said they are under 18. All three keep only a scrambled fingerprint of the address, in memory, made with a secret that is replaced every time the site restarts. The fingerprint cannot be turned back into an address, cannot be matched with anything outside this server, and is not linked to your account. It is all gone when the site restarts. If you turn on the optional country flag, one lookup stores a two-letter country code, never the address itself.

Ways to stay private

Invisible mode hides a persona from the online list.
You can opt out of being watchable, so no one is notified when you come online. When someone is notified, it is a one-time alert, and we keep no record of when you were online.
You can turn pictures off per persona. The picture button is then greyed out for everyone that persona talks to, and one sent anyway is refused before it is stored.
There is one exception, which you set yourself: anyone you chose Always show their pictures for can still send them. It applies per person, and you can undo it from the same menu in that conversation. Everyone else stays blocked.
Search engines only see the public pages: the front page, the feature list and the board games. Your personas, the list of who is online and all conversations are behind the login, blocked in robots.txt and also marked noindex. Nothing you write here can be found with a search engine.
Notifications while a tab is open are shown by your device, outside this site's control. They show the sender's nickname, and which of your personas the message is for if it is not the one you are using, but never any of the message. You turn them on or off on the Alerts page. The setting belongs to that browser, not to your account, and nothing about it is stored here.
A notification after you have closed the tab is only sent if you asked for it, and it shows less: a fixed sentence, the same for everybody, with no nickname. It needs the registration described above, which is stored with your account rather than a persona, so it can never link two of your personas. The same switch that turns it off deletes it. The separate also tell me when the site is busy switch next to it is off until you turn it on, and that choice is also stored with your account.

The AI assists

VIP+ members can ask a language model for three things: a translation of a message they received or are about to send, suggestions for what to talk about next, and a draft of the private note they keep about someone. None of it happens on its own. Each starts when somebody presses a button or turns on a switch, and neither the coach nor a note draft is running when they arrive. Translation is the one switch that stays on. It is off until somebody turns it on, it is turned on for one conversation at a time (never for a person or the whole site), and it stays on in that conversation until they turn it off. The switch is shown above the message box. While it is on, the messages in that conversation are sent to the model as they arrive, because translating them is what it was turned on for. If nobody turns it on, translation never sends a message to the model. Nobody uses any of it to read along, and no model sees a message just because it was sent.

The model runs here, on a machine we own. No other company, API or cloud service is involved. Requests travel over the site's own private network to a machine in the same building, and the answer comes back the same way. Nothing goes out to the internet.
It sees that one screen and nothing else: the open conversation, both profiles as they are shown, and the member's own note. It does not see their other conversations, their other personas or the roster. It cannot learn anything about you that the person you are talking to could not already read.
Pictures are never sent. The model is only told how many there are.
Translations are kept. Nothing else is. A translation is stored with the message, so the same sentence is not translated twice: when you read it again, on another device, or when somebody else in the same room reads it in the same language. When you send a translated message, the text you typed is also kept, so you see your own words as you wrote them. All of it is deleted as soon as the message is edited, taken back or deleted. It is stored by message and language, never by person, so nothing records who asked for it or who read it. Everything else is discarded: what is sent to the model is put together for that one request, and what the coach or a note draft returns stays in that browser session and is not stored. No admin and no other member sees any of it.
Read aloud also runs here. A VIP+ member can have a message read out by pressing Read aloud on it, or turn on reading aloud for one conversation or room, where it stays on until they turn it off, like translation. The words go to a speech server in the same building, over the same private network, and come back as sound for that browser to play. Neither the words nor the sound is kept. If that server does not answer, and for everyone without VIP+, the browser reads the message with a voice on the member's own device, and the words never leave it.

This also concerns you when someone else uses an assist. When the person you are talking to uses one of these, your messages are part of what it reads, at their request and without asking you. We do not tell you when this happens, because a notice would reveal the other person's subscription and make it awkward to ask for help with a conversation, which is what the feature is for. So we tell you here instead. Anything you write here may be read by this site's own model, on a machine here and never elsewhere, because the person you wrote to asked it to help them reply. It is not stored afterwards.

Moderation

Anonymity here protects your privacy. It does not excuse abuse or illegal use. The house rules set out what is expected of you and what is prohibited.

Reports you file about a person, a picture or spam are visible only to admins, together with the conversation they concern. The person you report is never told who reported them.
A reported picture is withheld from everyone as soon as it is reported, and only an admin can restore or delete it.
Spam strikes are counted against an account, not a persona, so switching persona does not clear them. Enough strikes from separate accounts disable the account, and expired strikes are deleted.
A nickname or description refused for breaking the rules is kept, word for word, with your account. Admins see it when they look over new members, when too many refusals disable your account, and when someone reports one of your personas. The AI that sorts reports can also read it then.
The words are deleted after 90 days if they were refused for claiming to be staff or for reading as an advert.If they suggested a minor, offered something for sale or threatened people, they are kept for as long as your account, because an admin may need them beside a report that comes later.Once the words are gone, the site keeps only the fact that something was refused, when, and which rule it broke. That is deleted with your account, or when an admin restores a disabled account.
A disabled account can still write one appeal for an admin to read. Nothing beyond what is listed above is collected for this. There is no email address to write to and no IP address on file.

We do not keep your data forever

Messages and pictures are deleted after 60 days, in every conversation, starred or not. Pictures are erased from disk, not just unlinked. Presence logs are deleted in the same way, and an empty conversation is removed entirely, so no record remains of who spoke to whom.
The only exception is reported content. When anyone files a report, the last part of that conversation (or the picture, if a picture was reported) is copied to an area only admins can reach, and the 60-day deletion does not apply to that copy. Without it, an admin could not decide on a report after the conversation was deleted. Nothing is copied there unless somebody files a report. A report filed in a group copies more: the room's recent messages include everyone who was talking, so the copy includes people who are not part of the complaint. It is kept because an admin needs that context to decide on the report.
A picture in a group can be deleted sooner than 60 days. Every room keeps a fixed number of pictures (the number is on the invitation you accepted), and when a new one would exceed it, the oldest is removed. A picture in a busy room may therefore last only days. Nothing is ever kept longer than 60 days.
A room has its own lifetime. Your messages are kept for 60 days everywhere on this site, in rooms as in conversations. Separately, a room with nothing said in it for 240 days is deleted, and everyone in it is warned at 180 days. Any message resets the count.
A game is part of the conversation it is played in and is deleted with it, on the same schedule. There is no record of who won: a score is counted from the games that still exist, so it disappears with them, and no running total is kept.
You do not have to wait. Closing a conversation deletes it at once for both of you, including any games in it. Deleting your account deletes everything.
An account that is not used for 365 days is deleted, with everything in it. We have no email address to warn you, so sign in now and then to keep your account.
An account that has never sent a message is deleted after 60 days, if it has also stopped visiting. Both conditions must apply: if you still visit, nothing happens however long you take to send a first message, and once you have sent one, this rule no longer applies to you. It is for accounts that were created and then abandoned. There is no email address to warn you.
A decided report and its copied evidence are deleted after 180 days, counted from the day it was decided, not the day it was filed. It is kept that long because it is the only record of why an account was disabled or a picture deleted, and the person affected may ask about it after the conversation is gone. A report that has not been decided yet is never deleted.
Your puzzle results are deleted after 365 days. Deleting your account deletes them at once.
Deleting your account (Access codes → Delete account) permanently erases every persona, conversation, picture, note and setting linked to it, including every report by you or about you and every copy taken for review. There is no backup and nothing to recover. This includes what you wrote in groups: your messages are removed from the rooms you were in, as from your conversations, and the other members keep the rest of the conversation. If you run a room, you are asked to hand it over or close it first, so no room is left without someone in charge.
Two of your three codes are needed to delete the account, just as they are needed to replace the codes, so one lost or stolen code is not enough to erase everything. Keep the whole set. With only one code left you can still sign in and use the account, but neither you nor we can delete it or give you a new set.
If you lose all your access codes, the account cannot be recovered.

Back