privacy, plainly

what we collect

what you give us: email, date of birth (to enforce 18+ — others only ever see your age), your city, photos, and what you write. if you ask for a checkmark, one posed selfie too — that one gets its own section below. your precise location is never stored: coordinates are blurred by roughly 1.3km the moment they're written, and other people only ever see buckets like “nearby” or “12 km away”.

what your connection gives us: when you sign up and when you log in, we record the ip address the request came from and a coarse read of your device — “android · chrome”, that sort of thing. this is security, not analytics. it is how a person reviewing a report or a burst of forty identical signups can tell one roach from a hundred puppets. only the admins can see it, looking up a full ip is itself logged, and we delete the addresses after 90 days — counted from the signup or the login that produced them, so the clock is real. the device line is coarse enough to keep; it describes a browser, not you.

the selfie (if you ask for a checkmark)

one posed selfie. a person compares it with your shell photos and flips the badge — that's the whole check. from the moment you send it, the photo stays out of our off-site backups, so it never leaves this machine. when the review lands it's deleted: the file, not just the link to it, and a delete that fails gets retried until it's gone. what survives is the record — that you asked, when, and what came of it — and that's backed up like everything else. your export hands you the record, never the photo.

what we never do

• sell your data, or share it with advertisers. there are no advertisers.
• show follower counts or engagement leaderboards. anti-clout is the product.
• infer your mood, orientation, or state. vibes are what you declare, nothing more.
• run your face through a model. the checkmark is one person looking at one photo.
• fake urgency. every countdown in the app is a real timer.
• guilt-trip you into staying. see the exit, below.

who sees what

DMs require a mutual connection — architecture, not a setting. a private shell (settings) shows non-connections only your name, age, and city. your saved posts and the trails you follow are visible to you alone; nobody is ever told who follows them, and counts don't exist. reports are reviewed by a person.

leaving (the whole flow)

settings → “crawl out forever”. we offer your data as a json file first. you confirm with your password and by typing your username. deactivation is instant: you become invisible everywhere and your sessions end. for 14 days, logging in cancels the deletion and restores everything. after 14 days your account and content are permanently purged, and your username and email are freed. that's the entire flow — no retention calls. one wait-there's-more, and we'd rather say it than not: our off-site backups age out on their own clock, so a copy can survive there for a few days after the purge.