Privacy Policy

1. What we collect

We collect personal information in the following categories:

Account information

Email address, username, display name, optional avatar image, and the timestamp when you accepted our Terms of Service.

Content you create

Posts (title, description, images), comments, votes, likes, bookmarks, and follow relationships.

Activity data

Login timestamps, notification preferences, and account settings.

Push notification data

If you enable push notifications, a device token identifying that install of the app. Notification content (e.g. "@username liked your post · Title") includes the acting user's username and the post's title — see "Who we share it with", below.

Technical data

IP addresses and browser information recorded in server logs, and included automatically when an error report is sent to our error-tracking provider (see "Who we share it with", below). We do not use advertising identifiers or ad-network tracking pixels.

Analytics data

Pages you visit and general device/browser information, collected via Google Analytics so we can understand how the platform is used (see "Who we share it with", below). We do not enable Google's advertising-linking features (Google Signals), so this data is not used for ads or to track you across other apps or websites.

Cookies and local storage

We use a single session cookie to keep you logged in and browser local storage for your theme preference. Google Analytics also sets cookies (under our own domain) to distinguish visitors and sessions — see "Analytics data", above.

Moderation data

Content reports you file or receive, moderation decisions, warnings, suspensions, and audit log entries associated with your account.

2. How we use it

We use personal information only for the following purposes:

Providing and operating the service (authentication, content delivery)
Sending login link emails, and account-related emails such as confirming a change to your email address
Sending push notifications about activity on your account (likes, comments, follows, votes) and moderation decisions, if you've enabled them
Moderating content and enforcing our Terms of Service
Complying with legal obligations, including mandatory reporting of CSAM, NCII, and trafficking content to the relevant authorities
Diagnosing technical problems using server logs
Understanding aggregate usage patterns (page views, feature usage) via Google Analytics, so we can improve the platform

We do not use your personal information for advertising, profiling, or automated decision-making, and we do not sell it to third parties. Our use of Google Analytics is limited to understanding aggregate usage — we do not enable Google's advertising-linking features (Google Signals).

3. Who we share it with

Hosting provider

Our servers are operated by a US-based cloud provider. Your data is stored on their infrastructure under a data processing agreement. See section 4 for cross-border transfer details.

Law enforcement and regulatory authorities

We disclose information when required by Canadian law, a court order, or to comply with a mandatory reporting obligation — for example, reporting child sexual abuse material (CSAM) to the Canadian Centre for Child Protection (Cybertip.ca) and NCMEC, or referring trafficking content to the RCMP. We will notify you of any such disclosure where permitted by law.

Push notifications

If you enable push notifications, your device token and the notification's text — which includes the acting user's username and the relevant post's title — are sent to Google (Firebase Cloud Messaging) or Apple (APNs) so they can deliver it to your device. This data is used only to deliver the notification, not for the provider's own advertising or profiling.

Analytics

Usage data — pages viewed and general device/browser information — is sent to Google Analytics so we can understand how the platform is used. We do not enable Google's advertising-linking features (Google Signals), so this data is not used for ads or shared for cross-app/cross-site tracking.

Error tracking

When the app encounters an error, a crash report — including your IP address — is sent to our error-tracking provider so we can diagnose and fix the problem. This data is used only for that purpose, not for advertising or profiling.

Email delivery

Your email address, and the content of emails we send you (login links, notifications), pass through our transactional email provider so it can deliver them on our behalf. This data is used only to deliver our emails, not for the provider's own advertising, profiling, or marketing purposes.

We do not sell your personal information to any third party.

4. Cross-border data transfer

Erisava Media Inc. is incorporated in British Columbia, Canada, and this platform is subject to PIPEDA. However, our servers are located in the United States. By creating an account, you acknowledge that your personal information is transferred to and processed in the US, where privacy protections may differ from those in Canada.

We take reasonable contractual steps with our hosting provider to protect your information in transit and at rest.

5. Data retention

Retention periods by data category:

Account data

Retained for as long as your account is active. Account deletion requests are reviewed and completed within 30 days (see "Your rights", below). Once approved, your email, username, bio, avatar, and password are immediately replaced with a generic placeholder. Your posts and comments are not deleted along with your account — they remain visible, reattributed to that placeholder — unless you remove them yourself first (see "Removed posts", below), except where retention is required by law or an ongoing moderation matter.

CSAM, NCII, and trafficking content

Posts reported as child sexual abuse material (CSAM), non-consensual intimate imagery (NCII), or human trafficking content are hidden immediately on filing and preserved indefinitely as evidence for law enforcement. This content is not accessible on any public or user-facing surface and is never automatically deleted.

Removed posts

When a post is removed — by you or by a moderator — it is immediately hidden from all public surfaces. The post content (title, description, image, and tags) is retained during a grace period, then permanently deleted from the database and cloud storage: 7 days for posts you remove yourself, 90 days for posts removed by a moderator. Posts with an outstanding moderation report are excluded from automatic deletion and held until the report is resolved.

Push notification tokens

Kept for as long as the device stays registered. Removed immediately if you disable notifications, or automatically once Google or Apple reports the token as no longer valid (e.g. the app was uninstalled).

Server logs

IP addresses and request logs are retained for up to 90 days for security and diagnostic purposes, then deleted.

Moderation records

Reports, warnings, suspensions, and audit log entries are retained indefinitely to support consistent enforcement and dispute resolution.

6. Your rights

Under PIPEDA (and, for Quebec residents, Loi 25), you have the right to:

Know what personal information we hold about you and request a copy
Correct inaccurate or incomplete information
Withdraw consent for uses beyond operating your account
Request deletion of your account and associated personal data
Lodge a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca)

Quebec residents: Loi 25 grants additional rights, including the right to data portability and to be informed of automated decision-making that significantly affects you. We do not engage in automated decision-making based on personal information.

Some of these you can act on directly, without contacting us:

To delete an individual post or comment, open it and use its Delete option — available any time, no review needed (see "Removed posts", above, for how long it takes to be permanently erased).
To delete your account and personal data, go to Settings → Danger zone → Request Account Deletion. We review these requests and complete them within 30 days.

For anything else — a copy of your data, correcting inaccurate information, withdrawing consent, or a complaint — contact us through our legal contacts page . We will respond within 30 days.

7. Users in the European Union

The platform is accessible to EU residents. Erisava Media Inc. acts as the data controller. Our legal basis for processing is the performance of a contract (operating your account) and, where applicable, compliance with a legal obligation. EU residents have the same rights listed in section 6 and may also contact their local data protection authority.

8. Changes to this policy

We will post any material changes to this page and notify registered users before they take effect. The effective date at the top of this page reflects the most recent revision. Continued use of the platform after changes take effect constitutes acceptance of the updated policy.

9. Contact

For privacy questions or to exercise your rights, visit our legal contacts page . You may also write to us at the mailing address listed there.