What we keep, and what we don't.

The submission form has no field for a name, email address, phone number, username, social account or wallet. There is no account system. There is no login for readers or submitters.

This isn’t only a policy — the database has no column to store any of it. Identifying information can’t leak from a place it was never put.

Your identity isn’t the story.

• The story text, exactly as you wrote it, after markup and invisible characters are stripped.
• An optional title, if you gave one.
• The category you chose.
• An optional amount range — a bracket like “$10K – $100K”, never an exact figure.
• An optional broad region, such as “Europe”. Never a country, city or coordinate.
• Any content warnings you ticked.
• The date and time it arrived.
• A one-way hash of your story text, used only to recognise an exact duplicate.
• A random submission ID, which is the only reference to your story that exists.

That is the complete list. Nothing on that record connects to a person, a device or a network address.

To stop one person flooding the queue, the application needs to tell submissions apart. It does that without keeping your IP address:

• Your address is combined with a secret key and the current date, and hashed.
• Only that hash is stored, in a rate-limiting table, with a hard expiry — typically an hour or a day.
• The hash rotates daily, so the same visitor cannot be tracked across days.
• The rate-limit record has no link to your story. There is no column joining the two.
• Expired rows are deleted.

The raw address exists for the duration of the request and is never written to our database.

We can be exact about our own database. We cannot make promises about the rest of the internet, and we won’t pretend otherwise:

• Our hosting provider and any CDN in front of the site keep their own request logs, which typically include IP addresses, timestamps and user agents, under their own retention policies.
• Your internet provider can see that you visited this site.
• If you reached this site from a link, the site you came from knows you clicked it.
• If you share a device, someone else using it may see your browser history.

If your situation calls for stronger anonymity than that, use a network you trust and a private browsing session.

• This site sets no cookies for readers or submitters. There is no consent banner because there is nothing to consent to.
• The confession form saves your draft in your own browser's local storage so a refresh doesn't lose a long story. It never leaves your device, and it is deleted the moment you submit. You can clear it yourself with “Start over”.
• Moderators signing in receive one session cookie, scoped to the /admin path, which is never sent on any public page.
• No CAPTCHA is currently enabled, so no challenge provider sees your visit. If we ever turn one on, this page will say so.

We count events, not people.

• A record is a date, an event name such as “file_view”, an optional category, and a number.
• There is no visitor ID, no session, no cookie, no fingerprint, no referrer and no page URL.
• Two visits from the same person are indistinguishable from two visits by different people.
• No third-party analytics script runs on this site.

It genuinely is a counter. There is nothing in it that could be traced back to anyone.

When a story is published it becomes public and permanent by design. Search engines may index it. Other people may screenshot, quote or archive it. Once something is public on the internet we cannot un-publish it everywhere, only from here.

That is exactly why the guidelines ask you not to include anything identifying before you send it.

Use the take-down form on the status page to ask for a file to be removed, including if it’s yours. Because we hold nothing that proves a story is yours, we can’t verify authorship — we treat removal requests on the merits of the content rather than on proof of ownership.

If you have your submission ID, include it. It makes the request unambiguous.

• Everything is served over HTTPS in production, with a strict Content-Security-Policy that blocks injected scripts.
• Story text is treated as untrusted data everywhere. It is never rendered as HTML.
• Moderator passwords are stored as scrypt hashes. Session cookies are stored as hashes, so a database copy cannot be replayed as a login.
• Access to the moderation dashboard requires authentication and is never indexed.

If what we store changes, this page changes in the same release. We won’t quietly start collecting something and describe it later.