Privacy
Privacy Policy
The short version
- We never ask for your name. Not at sign-up, not ever.
- We ask for your email once, to send you a login code. We don't keep the email — it's converted into a one-way code that tells us only "this is the same person as last time."
- Your posts aren't linked to anything public. Every thread gives you a fresh random name.
- You decide when a post is deleted. You can also delete it early.
- No ads, no data selling, no tracking you around the internet.
- We do keep short-lived server logs, including IP addresses, to stop abuse. 2 years, then they're gone.
This summary is here to be useful, not to be the legal bit. The sections below are what actually applies.
01What this policy covers
This policy covers unbirden.com. It doesn't cover any other website you reach from here.
02What we collect
2.1 The things you write
When you post or comment we store the text, the tag you chose, the lifespan you set, any relate actions, and the times these happened. We store your post's content exactly as you typed it — which is why 2.5 matters.
2.2 Signing in
You can read Unbirden without signing in. To post or comment, you sign in.
You enter an email address. We send a one-time code to it. You enter the code back.
After that, we do not store your email address. It is converted into a one-way identifier — a fixed-length value that cannot be reversed back into your email. We keep that identifier so we can recognise your account on your next sign-in and stop the same email creating multiple accounts. It is the only account identifier we hold. We hold no name, no phone number, no date of birth.
Your email address itself passes through mailtrap.io so the code can be delivered, and exists briefly in our systems during verification. It is not written into our user database.
One honest clarification. Because that identifier is derived from your email, data-protection law still treats it as personal data — it's pseudonymised, not anonymous. We treat it that way too, and give it the protections described in section 11. We'd rather tell you that than claim a stronger promise than we can keep.
2.3 Technical information collected automatically
Our servers and content delivery network record standard access logs: IP address, timestamp, the page or endpoint requested, and your browser and device type.
These are used only for security, abuse prevention, rate limiting, and diagnosing faults. They are kept for a minimum of 2 years and then deleted.
Access logs are stored separately from posts and comments, and we do not cross-reference them to work out who wrote what.
Cookies. We use only what's needed to keep you signed in and keep the session secure. No analytics cookies, no advertising cookies, no third-party trackers.
2.4 If you contact us
Our contact form collects the message you type, the topic you pick, and an email address only if you choose to provide one so we can reply. Contact messages are kept for one year and then deleted.
2.5 What we ask you not to give us
Please don't put real names, phone numbers, addresses, workplaces or social handles into a post, a comment or a message to us — yours or anyone else's.
Our systems try to detect and strip these automatically, but automatic filters miss things. The safest personal data is the personal data you never type.
↑ back to top03What we don't do
- We don't collect your name, date of birth, gender, phone number or address.
- We don't build public profiles. There are no followers, no user pages, and nothing to click through from a post to its author.
- We don't have private messaging. There are no DMs to intercept, log, subpoena or leak.
- We don't sell, rent or share your data for anyone else's commercial purposes.
- We don't run advertising, ad networks, or behavioural profiling.
- We don't track you across other websites.
- We don't use your posts to train AI models.
04How the anonymity actually works
- A new random name in every thread. Your identifier isn't shown to anyone, and the same person appears as different names in different threads.
- Your history is yours alone. Only you can see your own list of posts, and only while signed in.
- No path from a post back to a person. No public profile, no author link, no way to collect somebody's posts together.
- We hold a one-way identifier, not an email address.
And the honest limits. No online service can promise perfect anonymity. If you write identifying details into a post, they are public. Short-lived technical logs exist, as described in 2.3. And a determined legal order can compel us to hand over what we hold — though as section 10 explains, what we hold is deliberately very little.
05Why we're allowed to process this
| What we do | Under India's DPDP Act | Under GDPR / UK GDPR |
|---|---|---|
| Sign you in, stop duplicate accounts | Your consent | Contract, Art. 6(1)(b) |
| Publish your posts and comments | Your consent | Contract, Art. 6(1)(b) |
| Security, abuse prevention, access logs | Legitimate use — preventing fraud, ensuring safety | Legitimate interests, Art. 6(1)(f) |
| Answer your support message | Your consent | Contract / legitimate interests |
| Meet legal and regulatory duties | Legal obligation | Legal obligation, Art. 6(1)(c) |
Where we rely on consent, you can withdraw it at any time by deleting your account — see section 8.
06How long we keep things
| What | How long |
|---|---|
| Posts and comments | Until the lifespan you chose runs out, or you delete them with Delete Now — whichever is sooner. Removed from live systems within 24 hours, and from encrypted backups within 60 days. |
| Posts set to "Forever" | Until you delete them, or the service closes down. |
| Your account identifier | While your account exists. After you delete your account, retained for 180 days where India's IT Rules 2021 require it, then deleted. |
| Server and CDN access logs | 2 years |
| Contact form messages | 1 year |
| Reported content and moderation records | [12 MONTHS], so we can enforce consistently and answer complaints. |
"Deleted" means removed from our live systems, then cycled out of encrypted backups on the schedule above. We can't reach into a backup to pull out a single row, which is why backups run on a fixed rotation rather than instantly.
↑ back to top07Who else touches your data
| Who | What they do | What they see |
|---|---|---|
| AWS | Servers, storage, database | Encrypted data at rest, in India |
| mailtrap.io | Delivers your one-time login code | Your email address, for delivery only |
That's the list. No analytics providers. No advertising partners. No data brokers. Each provider is bound by a written contract, can only act on our instructions, and cannot use your data for their own purposes.
08Your rights, and the honest catch
Because we don't hold your email address, we can't look up your account from an email you send us. That's the anonymity working as designed — but it means rights requests have to be made from inside the Website while signed in. It's the only way we can be sure a request relates to your account and isn't someone else asking about you.
If you're in India, the DPDP Act 2023 gives you the right to access a summary of your personal data, correct or complete it, erase it, nominate someone to exercise your rights if you die or become incapacitated, and raise a grievance.
If you're in the EU or UK, GDPR gives you the rights of access, rectification, erasure, restriction, objection, portability, and withdrawal of consent — plus the right to complain to your national supervisory authority.
Withdrawing consent means deleting your account, which removes your identifier and your posts.
↑ back to top09Reports and moderation
When you report a post or comment, we store the report and a copy of the reported content so we can act on it and answer complaints.
Once a piece of content passes a reporting threshold it is hidden automatically, before anyone on our side reads it. Your report is never shown to the person you reported, and reporting someone doesn't reveal you to them.
10Law enforcement and legal requests
We'll say this plainly, because it's the section that matters most on a platform like this.
We comply with valid legal orders from courts and authorities with jurisdiction over us. But what we can hand over is limited by what we hold — and we deliberately hold very little. We have a one-way identifier that cannot be reversed, the content you chose to publish, and access logs no older than 2 years.
We cannot produce what we do not have. We do not give any authority voluntary or bulk access to user data, and we do not build back doors into the deletion timer.
Where we are legally permitted to do so, we will tell affected users about a request concerning them.
↑ back to top11How we protect it
- Encrypted in transit (TLS) and at rest.
- The secret material used to derive your account identifier is held separately from the database that stores those identifiers, so a database leak alone cannot be turned back into email addresses.
- Access logs are stored separately from post content.
- Staff access is limited to those who need it, and is logged.
- No system is perfectly secure, and anyone claiming otherwise is selling something. We aim to hold so little that a breach reveals as little as possible.
12Age
Unbirden is for adults. You must be 18 or over to use it.
Under India's DPDP Act 2023, anyone under 18 is a child, and processing a child's data requires verifiable parental consent and bars behavioural monitoring. That is not compatible with anonymous posting — we can't verify a parent without collecting exactly the identifying data this platform exists not to collect. So we don't allow under-18s at all.
↑ back to top13Contact and grievances
We acknowledge complaints within 24 hours and resolve them within 15 days, as required by India's IT Rules 2021.
14Changes to this policy, and your acceptance
Your acceptance. By accessing, browsing, registering for or otherwise using Unbirden, you accept this Privacy Policy and agree to be bound by it in full. If you do not agree to it, you must stop using the platform.
Our right to make changes. We reserve the right to amend, update, replace, add to or withdraw this Privacy Policy, in whole or in part, at any time and at our sole discretion — for example to reflect changes to our features, our technology, our service providers, our business, or applicable law. The version published on this page is the version in force. The "Last updated" date at the top tells you when it last changed.
How changes take effect. A revised policy takes effect from the date it is published on this page, unless we state a later date. Your continued access to or use of Unbirden after a revised policy is published constitutes your acceptance of that revised policy. It is your responsibility to review this page from time to time. If you do not agree to a change, your remedy is to stop using Unbirden and delete your account.
Where we will still tell you first. Some changes are not ours to make quietly, and the law does not allow silence to stand in for consent. Where a change materially alters the purposes for which we process your personal data, the categories of personal data we collect, or your rights — and where your consent is the basis on which we process that data — we will give you clear prior notice on the Website and, where the law requires it, ask for your consent again before the change applies to you. If you decline, we will stop the processing that depended on that consent. Nothing we did lawfully before the change is affected.
Previous versions. We keep earlier versions of this policy and will make them available on request, so you can see what changed and when.
↑ back to top