Privacy notice

The operator named in the Impressum is the controller for the personal data described here. Their contact details are on that page.

This notice describes what the software actually does. Where it names a retention window in days, that window is enforced by a job that runs nightly and records that it ran.

To have an account: an email address and a password, held by our authentication provider. The password is never stored in a form anybody can read.

Because you chose to add it: a display name, a sentence about yourself, a city and region, the languages you speak, the areas you care about and the ways you would like to contribute. All of it is optional except the name, and none of it is required to be your legal identity.

Because you wrote it: your stories, your requests, your offers of help, your messages inside a request, and your recognitions of other people.

Because the software has to work: which notifications you have been sent, whether an email was accepted by the mail provider, and a short-lived record of how often you have posted, which is what stops one account flooding the platform.

There is no analytics service, no advertising identifier, no tracking pixel, no session recorder and no third-party script of any kind. Nothing counts who looked at what. The numbers the operators see are counted from rows that already exist for another reason.

Location is never finer than a city. There is no field for a street address anywhere in this product, which is a decision about the database and not only about the forms.

To give you the account and the service you asked for — Article 6(1)(b) GDPR, performance of a contract. This covers your profile, your content, the visibility settings that decide who sees it, and the notifications about things that happen to you.

Because you agreed — Article 6(1)(a) GDPR. Being named in somebody else's story or recognition happens only with your explicit agreement, and you can withdraw it at any time without leaving.

Because we have a legitimate interest in the platform being safe — Article 6(1)(f) GDPR. This covers moderation, the automated check on public content, blocking and muting, and the rate limits. The interest is keeping a mutual-aid platform from being used against the people who come here for help; the balance is that these apply to content already headed for strangers, and that no automated check can do anything but ask a person to look.

To meet a legal obligation — Article 6(1)(c) GDPR — where one applies, such as responding to a lawful request.

Impact stories and requests on this platform frequently touch health, immigration status, financial difficulty, religion and family circumstances. That is what mutual aid is about, and pretending otherwise would be the wrong way to build this.

Where you publish such a thing publicly, we process it on the basis of Article 9(2)(e) GDPR — information you have manifestly made public yourself. Where somebody else names you, the basis is your explicit consent under Article 9(2)(a), which is why nothing appears until you agree.

This is also the reason for the visibility settings and for the anonymity option on a request. A request marked anonymous carries no author identity at all in the data the interface reads — not hidden, absent.

It is also why private and community-only content is never sent to the automated moderation check. Sending a private story about somebody's immigration status to an external service would be a disclosure, not a safety measure.

Every piece of content carries a visibility setting, and the database enforces it rather than the interface. Public means anyone including people who are not signed in. Community means the members of the group it belongs to. Private means you.

Public content is indexed by search engines: stories, communities and city pages. Requests for help are not, and neither are profiles.

Other members of the platform see what your settings allow and nothing more. The people running the platform can see aggregate counts, and can read the specific content of a moderation case while it is open — every such look is recorded with their name against it.

Supabase — hosting, the database, file storage and authentication. It holds essentially everything described above. Hosted in the region named in the Impressum.

Resend — sending email. It receives your email address and the message, which is deliberately a sentence saying what kind of thing happened and a link. It never receives the content of a story, a request or a message.

OpenAI — the automated check on public content, and the optional writing assistant. It receives the title and body of content that is already public, or that somebody has reported, and nothing else: no name, no identifier, no location, no community. It is not used to train models on this content.

The hosting provider for the application itself, which processes requests and therefore sees IP addresses in transit.

Each of these acts only on our instructions under a data processing agreement. Where processing happens outside the EEA it is covered by the European Commission's standard contractual clauses.

Your content stays until you remove it or close your account. Nothing expires on its own and nothing is archived somewhere you cannot reach.

Operational records do expire, and these are the actual windows: rate-limit history after 7 days, moderation screening jobs after 30 days, the record of an email we sent after 90 days, records of third-party service failures after 90 days, and the record that a notification was delivered after one year.

A recognition naming somebody who never joined expires after its window and is deleted together with the address it held. Holding a stranger's email indefinitely on a third party's say-so is not something this platform does.

A nightly job enforces every one of those and writes down that it ran, which is the difference between a retention policy and a retention claim.

There are no advertising or analytics cookies, because there is no advertising and no analytics.

One cookie holds your session so you stay signed in. It is strictly necessary — without it there is no signed-in state — and it is removed when you sign out.

Your browser's local storage holds your language and light-or-dark preference. These never leave your device and are not readable by us.

If you install the app, a service worker caches static files and an offline page. It never caches a page of content: every screen here is personal, and a cached one survives sign-out and sits in a shared browser profile.

You can download everything this product holds about you, as one file, from your privacy settings. It is assembled in your browser and does not pass through our logs.

You can correct anything on your profile at any time, and you can delete your account and its content yourself.

You can withdraw your consent to being named in other people's content without leaving, and you can object to processing based on legitimate interests.

You have the right to complain to a data protection supervisory authority in the country where you live or work. Doing so does not require telling us first.

If personal data is exposed in a way likely to put somebody at risk, the supervisory authority is notified within 72 hours of us becoming aware, and the people affected are told directly where the risk to them is high.

Given what people write here, that assessment starts from the assumption that exposure is serious. A leaked story about an immigration case is not the same kind of incident as a leaked shopping list.

If this notice changes in a way that matters, you will be told before the change takes effect rather than finding a new date at the top of a page you have already agreed to.