Privacy Policy

1. Information we collect

Account information. When you register, we collect your email address, username, and a hashed version of your password. We never store your password in plain text.

Guest sessions. If you join without an account, we assign a temporary guest token stored in your browser. This token identifies your participation within a session but is not linked to your identity.

Content you submit. Questions and echoes you add are stored and associated with your account or guest token.

Usage data and IP addresses. We record your IP address when you create a guest session or join a Q&A session. Your IP address is stored in our database linked to your account or guest token and is used to enforce platform bans, detect abuse, and prevent credit farming. We also collect standard server logs (timestamp, HTTP method) for security and debugging. We do not use third-party analytics services.

Notification subscriptions. If you turn on notifications, your browser gives us a subscription: a delivery address at your browser vendor's push service, plus two keys used to encrypt each message so the push service cannot read it. We store one of these per browser or device you enable it on. It contains no name, email, or location. You can turn notifications off at any time in Settings, which removes it; we also delete it automatically once the push service reports it is no longer valid.

2. How we use your information

We use your information solely to provide and improve GuestSpeak. Specifically:

• To authenticate you and maintain your session
• To display your questions and echoes in sessions you participate in
• To enforce session credit limits and regeneration
• To investigate abuse reports or violations of our Terms of Service
• To enforce platform bans across accounts and devices using your IP address

We do not sell your data. We do not share it with advertisers or data brokers.

3. Anonymity

Registered users may post questions anonymously within a session. When you do, your real identity is hidden from other participants and from the session host — you appear only as "Anon1", "Anon2", etc. Your identity remains on file with GuestSpeak and may be revealed to platform administrators in cases of abuse or legal requirement.

4. Data retention and account deletion

Guest tokens expire after the session ends. Session content (questions, echoes) is retained unless removed by the host or by us following a moderation action.

You can delete your account yourself at any time from Settings. We are specific about what that does, because it is not a blanket erasure:

• Your email, username, password, join-code prefix and stored IP address are permanently erased, and your notification subscriptions are deleted
• You can no longer sign in, and your username is released for anyone else to use
• Questions you asked remain in the sessions they were asked in, but are no longer attributed to you — your name is removed from them
• Sessions you hosted remain, so that questions asked by other people are not destroyed along with your account

We keep the empty account record itself so that other people's content stays intact and so that any moderation action against you remains enforceable. It holds no personal information about you.

5. Third-party services

We use Supabase to host our database. Your data is stored on servers in Canada. We use Resend for transactional email (e.g., password resets). These services process data on our behalf under their own privacy policies.

If you enable notifications, messages are delivered through the push service run by your browser vendor — Apple, Google or Mozilla, depending on your browser. They receive the delivery address and the encrypted message, which they relay without being able to read it.

6. Your rights

You can delete your account yourself from Settings, without asking us — see section 4 for exactly what that removes.

For anything else, including access to or correction of your data, email guestspeak@protonmail.com. We will respond within 30 days.

7. Changes to this policy

We may update this policy. If we make material changes, we will update the effective date above. Continued use of GuestSpeak after changes constitutes acceptance of the updated policy.