saynothing.io
Legal

Privacy Policy

Last updated 27 July 2026
saynothing.io is built so that posting requires nothing from you — no account, no email address, no name. This policy explains the small amount of data we do handle, why we handle it, and how long we keep it. It is written to be read, not to be survived.

The short version

  • There are no accounts, so nothing you post is tied to an identity.
  • We never ask posters for a name, email address, or phone number.
  • We do not run ads, and we do not sell or share your data with advertisers or data brokers.
  • We use no third-party analytics or tracking pixels. Traffic analytics are first-party and stay on our own servers.
  • IP addresses are used for moderation and abuse prevention only, and are reduced to a salted hash.

What we collect when you post

When you submit a confession we record the following alongside it. None of it is shown on the public feed except where stated.

IP address
Used to prevent spam and abuse, to enforce blocks, and to derive a coarse location. It is hashed with a server-side secret salt (SHA-256) so the value stored for ongoing use is not the address itself. The raw address is retained only for a limited moderation window and is then removed, leaving the hash.
Approximate location
Derived from the IP address — no request leaves our server to look this up. Public posts display only a broad region (state, province, or equivalent) and country. We never publish a city, a neighbourhood, or coordinates.
Browser and device information
Your user-agent string, and the browser, operating system and device type parsed from it. Used for abuse detection and to understand which platforms need support.
Referring page
The page that linked you to us, if any, so we can understand where visitors come from.
The content of your post
The text itself, its category, and whether it is marked NSFW. Please read the section on what not to include below.

What we never collect

  • Account credentials — there are no accounts to create.
  • Real names, usernames, profile photos, or biographies.
  • Email addresses or phone numbers from people who post.
  • Browser fingerprints, advertising identifiers, or third-party tracking pixels.
  • Payment information — the site is free and takes no payments.
  • Precise location, GPS coordinates, or contact lists.

Site analytics

We record page visits to understand how the site is used. Each visit stores a timestamp, the path visited, the salted IP hash, coarse location, browser and device information, the referring page, and a campaign source if one was present in the link.

This is entirely first-party: the data is stored in our own database and processed by our own code. We do not use Google Analytics or any comparable third-party service, and no analytics data is sent to anyone else.

If you contact us

The contact form asks for a name, an email address, a subject and a message. Unlike posting, this information is voluntary and is supplied by you so that we can reply. We keep the message and your reply thread for as long as needed to handle your enquiry and to keep a record of moderation and takedown decisions.

Contact messages are not connected to anything you may have posted, and we do not use the address you give us for anything other than replying to you.

Cookies

We set a small number of strictly functional cookies. None of them are for advertising.

sn_visitor
A random identifier set on first visit, used to prevent automated abuse of features such as likes. It is HTTP-only, contains no personal information, and expires after one year.
sn_locale
Remembers your chosen language so the site opens in it next time. Expires after one year.

Third parties

We keep these to a minimum. The complete list is:

Cloudflare Turnstile
A privacy-focused CAPTCHA used to keep automated posting off the site. It runs when you submit a post or a contact message, and Cloudflare receives your IP address and basic browser information as part of that check.
Google Fonts
The site loads its typefaces from Google's font servers, which means Google receives your IP address when the fonts are fetched. No cookies are set by this.
Email delivery
If you contact us, our email provider handles delivery of our reply to your inbox.
Translation
On-demand translation of posts is performed by a self-hosted translation service under our control.

Error and performance monitoring is self-hosted — diagnostic reports go to our own servers, not to a third-party monitoring cloud.

How long we keep things

  • Posts remain until they are removed by us or on request.
  • Raw IP addresses attached to posts are removed after a limited moderation window; the salted hash remains for abuse prevention.
  • Visit analytics are purged on a rolling basis and are not retained indefinitely.
  • Contact messages are kept while your enquiry is open and afterwards as a record of moderation decisions.

What not to put in a post

Anything you write on a public feed is public. Please do not include your full name, the full names of other people, addresses, workplaces, phone numbers, email addresses, or any other detail that could identify you or someone else. We cannot un-publish something once it has been read, and we cannot remove it from a search engine's cache or from a screenshot someone has already taken.

Search engines

Most posts are excluded from search engines. A limited subset of longer posts may be made available for indexing, and those pages will appear in search results. Posts marked NSFW, posts flagged as involving a crisis, and very short posts are never indexed.

If a post of yours is indexed and you would like it removed, contact us and we will remove the post. Be aware that removal from our site does not immediately remove it from a search engine's cache, which may take some time to refresh.

Your choices and requests

Because posting is anonymous, we usually have no way to connect a post to you — which means we cannot verify ownership of a post from your side, and we cannot produce a list of everything you have posted.

What we can do is remove a specific post. Every card on the site carries a short post ID; send us that ID through the contact form and we will remove it. You can also ask us to delete a contact conversation, or ask what we hold in relation to it.

Depending on where you live, you may have additional rights over personal data — for example under the GDPR or under state privacy laws in the US. We will honour those requests as far as anonymous data allows. Send them through the contact form.

Legal disclosure

We do not share data with advertisers, data brokers, or governments as a matter of course. We may disclose information where we are legally compelled to do so, or where we believe in good faith that disclosure is necessary to prevent imminent harm to someone. Because we hash IP addresses and remove the raw values, the amount we are able to disclose is deliberately small.

Children

This site is not intended for children. See the Terms of Service for the minimum age. We do not knowingly collect information from anyone below it, and we will remove content we learn was posted by someone underage.

Changes to this policy

If we change how we handle data we will update this page and change the date at the top. Material changes will be noted on the site itself rather than made quietly.

Contact

Questions about this policy, removal requests, and data requests all go through the contact form. We aim to respond within 24 hours.