Privacy

What we never collect

• No name, email address, or phone number — there is nowhere to enter one.
• No password. Accounts are anonymous access codes generated on our side.
• No tracking, analytics, advertising, or third-party scripts. Every page loads only from this site — no external fonts, CDNs, or beacons.

What is stored

• Your account is a set of access codes. Only a one-way hash of each code is kept — we can't show a code again after it's issued, and we can't recover a lost one.
• Your personas: the nicknames, descriptions, ages, genders, chat-preference tags, and pictures you choose to add. Others only ever see these — never anything that ties back to your account.
• Pictures are re-encoded on upload, which strips all camera and location (EXIF/GPS) metadata; the original file is never kept.
• Your conversations: messages and pictures you send, kept as chat history so they survive navigation.
• Your settings and social state: blocks, reports you file, private notes, who you watch, canned replies, most-used emotes, and preferences.

IP addresses

Your IP address is never written to the database or to logs. Two things count attempts by connection — wrong access codes at sign-in, and how many accounts have been created recently — and both hold nothing but a scrambled fingerprint of the address, in memory, computed with a secret that is thrown away and regenerated every time the site restarts. It cannot be turned back into an address, it cannot be matched against anything outside this server, and it is not attached to your account. Restart the site and all of it is gone. If you turn on the optional country flag, a single lookup stores a two-letter country code — never the address itself.

Staying private

• Invisible mode per persona hides you from the online roster and presence.
• You can opt out of being watchable, so no one is notified when you come online. When someone is notified, it is a passing alert — we keep no record of when you were online.
• The site asks search engines not to index it (noindex + a restrictive robots.txt), and every page requires signing in.

Moderation — the limit of anonymity

Anonymity here protects your privacy; it is not cover for mistreating people or for illegal use. The house rules set out what's expected of you and what is prohibited outright.

• Reports you file — about a person, a picture, or spam — are visible only to admins, together with the conversation they concern. The person you report is never told who reported them.
• A reported picture is withheld from everyone the moment it's reported, and only an admin can restore or destroy it.
• Spam strikes are counted against an account, not a persona, so switching persona sheds nothing. Enough strikes from separate accounts disables the account; expired strikes are deleted outright.
• A disabled account can still write one appeal for an admin to read. Nothing about you beyond what's already listed above is collected in the process — there is no email address to write to, and no IP address on file to trace.

Deleting your data

• Messages and pictures are deleted after 60 days — every conversation, no exceptions, starred or not. The pictures are erased from disk, not just detached. Presence logs go the same way, and a conversation left with nothing in it is removed entirely, so no record survives of who spoke to whom.
• The one exception is something that was reported. When anyone files a report, the tail of that conversation — and the picture, if it was a picture — is copied to an area only admins can reach, and that copy is not touched by the 60-day sweep. Without it, a complaint nobody had got to yet would become impossible to rule on, and a picture would be judged after it had already gone. Nothing reaches that area except by somebody filing a report.
• You don't have to wait for that. Closing a conversation deletes it at once, for both of you, and deleting your account takes everything with it.
• An account unused for 365 days is deleted, along with everything in it. We have no email address to warn you on, so this notice is the warning: sign in occasionally and nothing happens.
• A settled report and its copied evidence are deleted after 180 days, counted from the day it was decided rather than the day it was filed. It is kept that long because it is the only record of why an account was disabled or a picture destroyed, and the person on the receiving end may ask about it after the conversation itself has gone. A report nobody has ruled on yet is never swept — deleting it would decide it, in the wrong direction.
• Deleting your account (Access codes → Delete account) permanently erases every persona, conversation, picture, note, and setting tied to it — including every report either side of it and every copy taken for review. There is no backup and nothing to recover.
• Lose all your access codes and the account is gone for good, by design.