privacy policy

last updated april 23, 2026

this is a small, independently operated forum and microblog. this page explains what information the site collects, how it's used, and how to contact the operator with questions or concerns.

encryption

all traffic to and from this site is protected by standard SSL/TLS encryption (HTTPS), issued by let's encrypt. your password, session cookie, and any content you post are encrypted in transit between your browser and the server.

your data is never sold

the operator of this site does not sell, rent, trade, or share your personal data with advertisers, data brokers, or marketing companies. there are no third-party trackers, analytics scripts, or advertising networks running on the site.

what information the site collects

account information: your username, email address, and a cryptographically hashed version of your password. the raw password itself is never stored; even the site operator cannot retrieve it.
content you post: forum threads, replies, profile bio, and website URL, along with timestamps. this content is public by design.
server logs: the web server keeps standard access logs that include IP addresses, request times, and user-agent strings. these logs are used for operational and security purposes (debugging, rate limiting, blocking abuse) and are rotated periodically.
cookies: a single session cookie is set when you log in, used only to keep you signed in. no tracking cookies, no cross-site cookies, no third-party cookies.

third-party services

a small number of third parties are involved in running the site:

resend — sends transactional emails (account verification, password reset). resend receives your email address and the email content. see resend's privacy policy.
let's encrypt — issues the TLS certificate that encrypts your traffic. no user data is shared with them.
search engines — google, bing, and others may crawl and index the public parts of the site (the forum and blog) so pages can appear in search results. pages that require login (your account area, admin console, etc.) are excluded from crawling.

your control over your data

you can edit your bio, website, and email address at any time in your account settings.
you can edit or delete any post you've made.
you can permanently purge your deleted posts from the database via my posts.
you can delete your account entirely. when you do, your posts are either reattributed to a "[deleted]" placeholder or removed, depending on the option you choose.

data retention

account data and posts are kept as long as your account exists. server access logs are retained for a limited period for debugging and abuse prevention, then discarded. deleted accounts and purged posts are removed from the active database but may persist in routine backups for a short window before those backups are rotated out.

legal requests

if compelled by a valid legal process (subpoena, court order) in a jurisdiction that applies to the site operator, data may be disclosed. this site does not make voluntary disclosures to law enforcement absent such legal process, except in cases involving imminent harm, child sexual abuse material (CSAM) as required by US federal law, or similarly serious circumstances.

children

this site is not intended for anyone under 18. account creation requires confirming you are at least 18 years old. see the terms of use for details.

changes to this policy

this policy may be updated from time to time. the "last updated" date at the top of this page reflects the most recent change. continued use of the site after an update constitutes acceptance of the revised policy.

contact

questions, concerns, data deletion requests, or legal correspondence can be sent to the webmaster at:

bxsxm@protonmail.com

← home · terms of use

mysterywhisper