Privacy Policy

Last updated: [DRAFT — not yet effective]

What No1 collects

No1 is designed to collect as little information as possible.

We do NOT collect:

• Your real name
• Email address
• Phone number
• Date of birth
• Profile photo
• Social media profiles
• Physical address
• Browser fingerprint
• Device identifiers

We do store in our database:

• A random account identifier (UUID) — used only for login, never shown publicly
• A short public code (e.g. "K7HDM") shown next to your posts and comments, so others can recognise your posts as coming from the same account — see below
• Your hashed password (Argon2id — we cannot recover the original)
• A hashed recovery code
• Posts, comments, and votes you create
• Moderation actions (if any apply to your account)
• Account creation timestamp

Your public code

Every account has a short public code shown next to everything it posts. This lets people recognise that two posts came from the same account within No1 — it is not a username, cannot be used to log in, and is not linked to anything outside the app. It does not change or rotate, so unlike a fully anonymous system, your posts can be linked to each other by anyone browsing the app. This is a deliberate trade-off for recognisability, not a mistake.

What No1 cannot control

When you access No1, your IP address is visible to our hosting infrastructure (Fly.io). We do not store your IP address in our application database, but it may appear in infrastructure logs maintained by Fly.io according to their own policies.

No1 does not provide network-level anonymity. If you require network-level anonymity, consider using Tor or a trusted VPN — understanding that those tools also have limitations.

Cookies and sessions

No1 uses a single session cookie. It is marked HttpOnly, Secure, and SameSite=Strict. It contains only a session identifier — not your account data. We do not use tracking cookies, analytics cookies, or third-party cookies.

Third-party services

No1 does not embed Google Analytics, Facebook Pixel, or any advertising or tracking services. We do not load any third-party scripts.

Data retention and deletion

You can delete your account in Settings. When you do:

• Your account is deactivated immediately.
• Posts and comments are anonymised (author information removed).
• The account record is retained in a deactivated state to preserve referential integrity.
• Infrastructure-level backups may retain data according to the hosting provider's retention policies. Deleting your account does not immediately remove data from all backups.

No1 does not claim to be anonymous

No1 provides pseudonymity — you participate without a real-world identity linked to your account in our database. This is different from anonymity. Network observers, infrastructure providers, and legal processes can potentially identify you through network-level data that No1 does not control.

Legal compliance

This policy requires legal review before No1 is operated in any jurisdiction. Users in the European Union may have rights under GDPR. This document is not a substitute for legal advice.

Contact

[Contact information to be added after legal review.]