[questionable.ham] — /privacy
[ back to the board ]

questionable.ham — Privacy Policy

Effective: [DATE] · Version 0.1 · Controller: Breakwall Holdings, Michigan, USA · Contact: [EMAIL]

Draft for owner review; not legal advice. Attorney pass recommended before EU exposure.

The short version

There are no accounts. We don't know who you are and the system is built to keep it that way. What little we process exists to keep the lights on and the abuse out, and most of it is gone within hours or days.

What we process

datawhyretention
Connection ID (random, per-session)routing your messagesdeleted at disconnect
Nickname (self-chosen or assigned)displaydeleted at disconnect (an optional copy lives in your browser's localStorage, under your control)
IP addresstransport (unavoidable); on arrival, converted to a salted one-way hash used for (a) rate limiting, (b) ban enforcement, and (c) counting distinct callers for the public "lurkers" figureraw IP is never stored by the application. The salted hash is stored: for rate limiting, ~1 hour; for a ban, until the ban expires (default 24h); for the lurker count, indefinitely — see below
Message contentoperating a chat service; automated moderation review (including by AI models)~13-hour rolling deletion; possibly longer if required by law or for abuse investigation
Infrastructure logs (CDN and API access logs, standard fields incl. IP)security, debugging, abuse response[30] days, then deleted

We do not collect names, email addresses, phone numbers, or payment data. We do not use analytics trackers, advertising, or third-party cookies. We do not sell or share personal information for advertising. localStorage is used only for your own preferences and never leaves your device.

About the lurker count

The number shown as "lurkers" is a count of distinct callers who have ever loaded the board, not of page loads. To count distinctly rather than repeatedly, we keep a salted one-way hash of each caller's IP address with no expiry.

Being plain about the trade-off, because it is a real one: this is more than we retained previously, when a hash was written only if you were banned. What is stored is a hash and a first-seen timestamp — no raw IP, no nickname, no link to anything you posted, and nothing that can be reversed to identify you or reconstruct where you have been. It exists solely so a public number on the front page is true. We considered showing no number at all; we would rather show a real one than an invented one.

The salt is held separately and never published. If it were rotated, every stored hash would become permanently unmatchable.

Processors

The Service runs on Amazon Web Services (hosting, database, content delivery, and AI moderation via AWS Bedrock). AWS processes data on our behalf under its standard data processing terms. Moderation model inputs are message text; we do not send them your IP or any identifier beyond the ephemeral nickname.

Public by design

Anything you post is public and may be read, copied, or archived by other users or their automated clients before it expires. Our deletion schedule applies to our systems only. Do not post personal information — yours or anyone else's. Posting others' personal information is a bannable violation of the Terms.

Legal bases (where GDPR-type laws apply)

Legitimate interests: operating the service, security, and abuse prevention (connection data, IP hashing, logs, moderation). Legal obligation: retention or disclosure where law requires (e.g., mandatory reporting of unlawful content).

Your rights

Where applicable law grants you rights (access, deletion, objection, etc.), contact [EMAIL]. Practical note: because we hold no identifiers linking content to a person, we will usually be unable to associate any stored data with you — which is the point. Most data self-deletes faster than a request could be processed.

Disclosure

We disclose data only: to processors listed above; when required by law, legal process, or to meet mandatory reporting obligations; or to protect the Service and its users from abuse.

Children

The Service is not directed at children and we knowingly collect no data from anyone, including children. Users must meet the minimum age in the Terms.

Changes

Revisions will be posted here with a new effective date.