what is written down.

what a visit writes down

every time someone opens a page here, a record of that visit is written and filed under a scrambled key that finds them again on the next one — on that page only.

the owner of the page never sees that record. they see totals: how many came, from which app, which cities, what hour, how many came back. never who. we can read the record itself; it is not sold, and there is no advertising network in this product to sell it to.

taps are filed beside it: which link, at what moment, and which visit it belonged to. that is how an owner learns which block people actually use.

the owner is not counted on their own page when they open it from the browser they edit in, and neither are bots, link previews or automated browsers.

a visitor cannot switch any of this off, and nothing asks them first. that is a decision, not an oversight, and it is the one on this page we are least comfortable defending.

how the site itself is used

on the site — the front page, sign-up, the dashboard, upgrading and paying, the waitlist and these pages — PostHog measures how it gets used. it never runs on anybody's page, so nobody opening your link is measured by it.

it notes the pages opened and for how long, what was clicked, the steps of making a page, what was bought, and what broke. addresses are cut down before they leave the browser, so no code, token or email in a link goes with them.

once you sign in it is filed under your account id, with your plan, whether you have a page, and your school if a degree pass names one. never your email, your birth year, a note, or anything you type.

it can record a session: a replay of the screen as you used it, so we can see where something broke. every field you type into is blanked, and the notes left for you, your account, billing and the payment screen are not recorded at all.

it sees your ip address, which it uses to work out a city and a country. a browser that sends do not track is not measured, and neither is one switched off below.

how long PostHog keeps it is a setting we choose there, and it is not settled yet. deleting your account asks PostHog to delete what it holds under your id once that request is switched on; until then, write and it is deleted by hand.

what we hold about you

an email address, a password we never hold in readable form, the handle you chose, and everything you put on your page.

signing in with Google or Apple instead means they hold the password and tell us who you are. connecting Spotify, Apple Music, Last.fm, TikTok or YouTube stores a token for that account so a block can read what you asked it to read.

your birth year, and your birth month if you give it. your school status and class year. a birthday if you add one: month, day and your time zone, never a year.

if you use mutuals, the list of names you added is sealed: only you can read it, and a match shows only when both people listed each other.

turning on notifications stores a push token for your phone. following a game or asking for a game-day reminder stores that you did.

ordering a signed shirt stores the name and address it ships to, until it reaches the printer.

when the app crashes it sends the error, the phone's system version and the page handle, and no account id.

the app notes how it gets used: when it opens, each setup step, whether you allowed notifications, when you share your page. each note carries the app version, a random id the app made for your phone, and your account once you sign in.

those notes come to our own server. no ad tracking, and deleting your account deletes them.

blocking someone or reporting a page stores who did it and who or what it was about.

if you pay, we hold a Stripe customer id and the state of your plan. never a card number.

worth knowing before someone points it out: if you never chose a handle, the part of your email before the @ became one, and handles are readable by anyone. change it in settings.

a published page is public

anything on a published page — photos, links, a phone number, an instagram handle — is readable by anyone who has the address.

uploaded photos and videos are stored at a public address of their own. it is long and it is listed nowhere, but it is not a secret, and it keeps working after the photo comes off your page.

your handle and your avatar are readable across the product by design. that is what holding a page means.

when a stranger types on your page

the guestbook and the contact form store what the person typed, together with their ip address and the browser string their device sent. the signup box stores the email address and the ip address.

a contact message keeps a name, an email address, what it is about and the message. a guestbook note keeps a name and the note. a signup keeps an email address.

the owner of the page reads all of it, and an approved guestbook note is shown on the page to everyone.

a question keeps the question and, if they gave one, a name. it also keeps a scrambled code made from their ip address, and their account if signed in, so the owner can block them without ever seeing it.

a question shows on the page only once the owner answers it, and never with the code.

nothing clears these on a schedule. deleting the page they were left on deletes them with it, so whoever takes the handle next starts with none of them.

photos, and the cut-out

the cut-out that lifts you off your background is made by Cloudflare, who already run the site, inside the same request. the photo is not handed to anyone else.

if that fails, the app makes the cut on your phone with Apple's own tools instead, and only the finished cut is uploaded.

the original and the cut-out are both kept. the original is not discarded after the cut, and nothing in this product deletes a stored file yet.

who else touches any of this

here is each of them, and precisely what reaches it.

nothing third-party counts a view of a published page. Vercel Analytics did, on every published page including yours, and before that this page wrongly said it did not. that script is out of the code; on a published page the visit record above is the only counting, and it is ours.

the site around the pages is different: PostHog measures the front page, sign-up, the dashboard and paying. the section on using the site says what it sees.

cookies, and what sits in your browser

on a published page, one cookie: mzmo_vid. it carries a random visitor id for a year, on this product's own domain, and it is not http-only, so any script running on the page can read it.

when that cookie is missing a new random one is made. nothing is worked out from your ip address or your browser any more, so clearing cookies does hand you a new one.

one more thing sits in the browser itself: a visit id in session storage, one per page you open, so a reload is the same visit rather than a second one.

on the site, never on anybody's page, PostHog keeps a random id in a cookie named after it and in the browser's storage, so a second visit reads as the same visitor. it lasts a year unless cleared.

there is no cookie banner on this product. nothing is asking you first, and you should read that as the plain fact it is. the switch for PostHog is in the section on using the site.

how long any of it is kept

visits and taps are deleted after ninety days, automatically: every five minutes a sweep clears whatever has crossed the line. the scrambled key that remembers you came before goes thirteen months after your last visit.

what stays for the life of a page is its totals — a count of views, visitors and taps, and the day each round number was hit — which say nothing about anyone.

notes, contact messages and signups stand until the owner deletes them or the page is deleted. no job comes along and clears them sooner.

for those we would rather print no retention period than a made-up one. there isn't an honest one yet.

what you can ask for

a copy of what is held about you, a correction to it, or the whole lot removed. one address, at the foot of this page.

you can delete your own account from settings, in the app or the dashboard. read the next section first.

if you left a note on someone else's page and want it taken down, write and name the page and roughly when.

what deleting your account does

the delete button takes your page, everything on it and your login, and it cannot be undone.

if you are paying, the subscription is cancelled at stripe before anything is removed, so nothing keeps charging afterwards. you are not refunded for the remainder of the month already paid for.

if that cancellation cannot be reached, the deletion stops and nothing is removed. an account that still exists can be deleted again in a minute; a charge with no account behind it takes a person to undo.

age

the app asks the year you were born, and the month if you want to give it. it keeps under-thirteens out and decides who can use mutuals, which is eighteen and over. only you can see it.

school status and class year are asked too. they set the letter on your page.

a birthday is optional: month, day and your time zone, never a year. on the day, anyone who opens your page is told it is your birthday. switch that off, or delete the date, in settings. your age shows only if you turn that on.

it is built for college students. if you are under thirteen, do not make a page here. if a page belongs to someone under thirteen, write and it comes down.

when this changes

the date on this page changes when the words do.

a change that adds something collected, or adds a company to the list above, moves the date at the top and is written into the section it belongs to.