Privacy Policy
In effect from 1 September 2026
This says what we hold about you and why. It describes what the site actually does, which is why some of it is more specific than you may be used to.
The short version
We do not sell your data. We do not profile you to sell advertising. There is no engagement ranking here — the feed is chronological, on purpose, and nothing is scored to keep you scrolling. We never see your card details. Guardians cannot read your private messages.
The one thing that may surprise you: this site uses Google Analytics, and that is set out in full below.
What we hold
Your account
Your email address and sign-in details, held by Clerk, our authentication provider. If you sign in with Google, Clerk receives your name, email and profile picture from Google. We do not receive or store your password.
Your profile
Your handle, display name, colour, and anything else you choose to put on your profile. Your handle is public. So is anything you post in a public circle.
What you write
Posts, comments, reactions and private messages, with the time they were written. Edits keep a history, so an edited message can be seen in its earlier form by the people who could already see it.
Your membership
When you connect Patreon, we ask for two permissions: your identity, and your memberships. We read one thing from the answer — whether you support this campaign, in what state, and the date of your last charge. That becomes a status and a review date on our side.
The access token Patreon issues for you is used for that single request and then thrown away. It is never written to our database. We do not receive your card, your billing address, or what you pay.
What you play
When you play something we record that it was played and roughly where you got to, so the site can offer to resume and so we know what people listen to. If you are signed in, that is linked to your account and gives you a resume point. If you are not, it is recorded with no identity attached to it at all.
Reports you make
A copyright notice or a report of an intimate image shared without consent is a legal record, and it is kept as one. Copyright law requires that a notice carry your name, address, phone number and a sworn statement, and that we can produce it. The copyright page says so before you fill anything in.
Technical records
Our hosting and network providers keep ordinary server logs, which include IP addresses. We use them to keep the site up and to investigate abuse, not to build a picture of you.
Google Analytics
This site runs Google Analytics 4. It records which pages you visit, which links you press — navigation, pressing listen, pressing join — your approximate location from your IP address, and your device and browser. It sets cookies in your browser to recognise a returning visit, and the data goes to Google, who process it under their own terms.
It is not connected to your account. We do not send Google your handle, your email, or anything you have written.
If you would rather not be counted, Google publishes a browser add-on that turns it off everywhere, and most browsers and ad blockers will block it if you ask them to. We are working on giving you that choice on the site itself rather than leaving it to your browser.
Who else is involved
Running a site means other companies handle parts of it. These are all of them:
Clerk holds sign-in and identity. Supabaseholds the database — your profile, posts and messages. Fly.io runs the servers and Cloudflare sits in front of them. Patreon handles membership and payment. Mailgun sends email we have to send you. Google provides analytics, and YouTube and Mux serve video, which means an embedded player may set its own cookies when you play something.
Each of them sees only the part they need. None of them is permitted to use your information for their own purposes, except where their own terms govern — Google and Patreon being the two where that is true, and both publish their own policies.
We will also hand over information if the law requires it. If we are allowed to tell you that has happened, we will.
Who can see what
Your private messages are private. There is no permission anywhere in this system that lets a Guardian read them — not a setting that is turned off, an ability that was never built. A Guardian sees a private message only when somebody reports it to them, and then only that message.
Blocking is mutual and silent. Muting is one-directional and the muted person is never told. Both are enforced on the server, so blocked content is not sent to your browser and hidden — it is not sent.
How long we keep it
Your account and what you posted are kept while your account exists. Delete something and it goes, apart from copies in routine backups, which age out.
Moderation records — what was done to an account and the reason — are kept after the fact, because a decision nobody can look back at cannot be appealed or corrected.
Copyright and intimate image reports are kept as legal records. Records of your consent to a subscription are kept for three years, which is what California law requires of us.
What you can ask for
Ask us and we will tell you what we hold about you, correct it if it is wrong, give you a copy, or delete your account and what is in it. Email [email protected]. We aim to answer within thirty days and we will not make you jump through a process to get there.
If you live in California, you have rights under the CCPA to know, delete, correct, and to opt out of the sale or sharing of your personal information. We do not sell or share it in the way that law means, so there is nothing to opt out of, but the right to ask stands and we will not treat you differently for using it.
Deleting your account does not cancel your Patreon pledge. That has to be done on Patreon — the Refunds and Cancellation policy explains why and how.
Cookies
Three kinds, and no more. Clerk sets a cookie to keep you signed in. Connecting Patreon sets one short-lived cookie that exists only to prove the trip to Patreon and back was really yours; it lasts ten minutes and cannot be read by any script. Google Analytics sets its own, described above. Embedded video players may set theirs when you press play.
Children
This site is for people 18 and over. We do not knowingly collect anything from a child. If you believe a child has an account here, tell us and we will close it.
Where your data is
On servers in the United States. If you are somewhere else, using this site means your information is handled there, under United States law.
Changes
When this changes in a way that matters, we will say so on the site and move the date at the top rather than quietly editing the page.
432 The Drop Radio, 333 N Main Street #88, Cedar City, Utah 84720. [email protected]