This service is built so that we know as little about you as technically possible. This policy describes what we process, why, and what stays entirely out of our hands.
What we do not collect
No name. No email address. No phone number. No IP address stored next to your account or your confessions. Your account is a random identifier plus a key that lives on your device. Nobody, including us, can link an account to the real person behind it.
What we process
Your confessions are the heart of the service. A confession can reveal intimate things, which is why the law treats such text as a special category of data. We publish it only with your explicit consent, given in the app and recorded together with the exact version of the consent text you accepted. The full list of our processing activities and their legal bases lives in an internal register, checked mechanically against our data protection impact assessment.
Around the content itself we process what is strictly needed to run the service: moderation decisions, empathy reactions, abuse counters with sliding windows, aggregate analytics without identifiers, and operational logs stripped of anything personal. Published confessions may be translated automatically into other languages of the service; the translation is stored so it is paid for only once.
Payments stay separate
Payment data lives in a physically separate database, operated under a separate role, and is handled by our payment provider. The only bridge between a payment and an account is a one-time claim code. No invoice, no email, no card detail can reach the content side. This separation is enforced by the schema itself and verified in our build pipeline.
Who processes data for us
- Anthropic (United States) — the AI provider behind content moderation and, when enabled, automatic translation. It receives only the text being checked or translated, never your account identifier and never anything about who you are. A data processing agreement with the required transfer mechanism is signed before public launch; the internal register of processors is checked mechanically against this list on every change.
Everything else, from the databases to analytics, runs on our own infrastructure in the European Union.
Backups and retention
To be able to rebuild the service after an incident we keep encrypted backups of our databases. Backups are encrypted before leaving the server, with keys that do not exist on the server, and are kept for at most 30 days, after which they are deleted automatically. When you delete your account, deletion is immediate in the service, and any restore from backup re-applies deletions before the service starts again. Deleted data does not come back.
Your rights (GDPR)
Because the account is anonymous, you exercise your rights directly from the service, with no identity documents involved. You can delete your account permanently from Settings or from the public deletion page, proving control with your session or your recovery code. You can export all your data as a JSON file from Settings, instantly. If you send us a request by email identifying yourself with a name or an address, we cannot link it to any account: under article 11 GDPR we answer with a standard response pointing you to the self-service paths above.
Consent versions
The consent text and this policy are versioned. Every change bumps the version, the changes are visible in the app, and publishing again requires accepting the current version. Your acceptance history is kept, never overwritten.
The English version of this document prevails over any translation.