Privacy

Short version: we don’t track you, and you can read everything here without an account.

• No analytics, no ads, no tracking pixels, and no third-party scripts or fonts.
• Reading the site needs no account and sets no cookies.

If you make an account

Accounts are optional and are only for the private journal (and, later, community posts and messaging). Here is everything an account stores:

• A username you choose. Please don’t use your real name. We don’t ask for your name, email, phone, birthday, school, or location.
• Your password, scrambled (a one-way hash with a random salt). We can’t see or tell you your password.
• A recovery code, also scrambled. We show it to you once. If you lose it and your password, we can’t get you back in.
• That you checked “I’m 13 or older.” Just a yes. We don’t store your age or birthday.
• Your role (member or staff) and the date your account was made.
• Your journal entries: title, text, optional mood, and when you wrote or edited them. Only your account can see them on the site. They are stored on our host’s servers (Cloudflare) and are not end-to-end encrypted, so people who run the site technically could access the database. We don’t read journals.
• One login cookie (__Host-nwe) that keeps you signed in for up to 7 days. It’s marked HttpOnly, Secure, and SameSite=Strict, and it’s deleted when you log out.
• Short-lived counters that limit how many login or sign-up tries come from one connection, to stop password guessing. These use your IP address or username as a key and expire within an hour.

Community posts and messages (not open yet)

Community posting and “Message someone for help” are switched off. When they open, posts will be read by a trained moderator before anyone else can see them, and help messages will be read by NoWhereElse staff. We’ll update this page before they open, including what staff may have to do if a message says someone is in danger.

Deleting your data

In Settings, “Delete my account” permanently removes your account, every journal entry, and anything else tied to your account. It can’t be undone.

Other things to know

• The story form is not live yet and doesn’t collect anything.
• Our web host may keep standard technical logs (like IP addresses) briefly for security. We don’t use them to identify visitors.
• Links to hotlines and other sites take you to services with their own privacy policies.

Staying private on your device

• Use a private or incognito window so this site isn’t saved in your history.
• If you can’t, clear your browser history after visiting, and log out when you’re done.
• “Quick exit” (or Esc twice) jumps to Google fast, but it doesn’t erase your history or log you out.
• Calls and texts to hotlines may show up on your phone log or phone bill. Delete them if you need to, or use a friend’s or school phone.

Accounts are for ages 13 and up. We don’t knowingly collect information from children under 13. If you think a child under 13 made an account, it can be deleted from Settings.