Privacy policy

• Account: email, hashed password (or OAuth identifier), profile fields you fill in.
• Activity: prompts, likes, saves, follows, comments, reports.
• Usage counters: an anonymous first-party cookie (vac_sid) de-duplicates copy, view and ad-impression counts. No cross-site tracking.
• Abuse prevention: rate limits use your IP address in memory only. The daily free-copy allowance is tied to a keyed hash of your IP together with your browser’s own headers (user agent, language) — never the address or the headers themselves, and only for the current day — so the allowance can’t be reset by clearing cookies.
• Logs: technical server logs (email addresses masked), rotated by size.
• Backups: backups of the database are kept for up to 14 days.

We count page views ourselves, first-party. We never store IP addresses: your country comes from the request (a proxy country header, a one-off lookup of the address that is kept only as a country for a day, or your browser language), and the visitor id is a keyed hash of the vac_sid cookie that changes every day, so visits can’t be linked across days. We also record the referring site, campaign tags (utm) and a coarse device, browser and OS type. While a page is open, the site keeps in memory (never on disk) that a visitor is here, which page they are on and their country, so the team can see how many people are on the site right now. If your browser sends Do Not Track or Global Privacy Control, no page views are recorded by us.

We also use Google Analytics 4 to understand which pages people visit and where they come from. Google receives the page address, the referring site, a coarse device and browser type and an anonymous id stored in its own cookies; Google Analytics 4 does not log or store IP addresses. We don’t use Google Analytics data for advertising. You can block it with any content blocker or Google’s opt-out add-on (tools.google.com/dlpage/gaoptout).

Some pages show ads served by Google AdSense, clearly labelled as advertising. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this and other websites. Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the Internet.

You can opt out of personalised advertising in Google’s Ads Settings, or opt out of other vendors’ cookies at aboutads.info. How Google uses data from sites that show its ads: policies.google.com/technologies/partner-sites. Visitors in the EEA, the UK and Switzerland are asked for consent before personalised ads are shown, and can change their choice at any time.

• No fingerprinting and no selling data: your account details, e-mail address and private activity are never shared with advertisers.
• Sponsor click-throughs are counted on our server; sponsors only see aggregate numbers.
• YouTube videos load only after you press play, through YouTube’s privacy-enhanced player (youtube-nocookie.com).

Account emails (verification, password reset, moderation decisions) and activity emails when someone likes, saves, comments on your prompt or follows you, sent from our own mail server. Turn activity emails off any time in Settings → Notifications; the weekly digest is opt-in.

When you buy Pro, the payment is handled by Polar, our reseller, and its card processor Stripe. We never see or store your card details. We send Polar your account e-mail, display name and account id, the country we detect and the site’s language so the payment is linked to your account; Polar sends back the status of the subscription and orders (amount, dates, status), which we keep for accounting. Polar’s own use of your data is described in its privacy policy.

Delete everything from Settings → Delete account. Deletion is immediate and removes your profile, prompts, uploads and personal identifiers in usage statistics; copies inside rolling backups expire within 14 days. For a data export or any other request, contact the site owner.

vac_sid (anonymous session id, 1 year), vac_sidebar (UI preference), vac_lang (the language you picked, 1 year), the Auth.js session cookie when signed in, and Google Analytics’ _ga and _ga_* cookies (anonymous visitor id, up to 2 years). On pages with ads, Google AdSense and its partners may set advertising cookies (for example __gads, __gpi, IDE); see “Advertising” above.