Privacy policy

Whispers & Embers is run by [legal name], [mailing address]. For anything in this policy, write to hello@whispersandembers.com.

Only what the room needs to work.

• Your waitlist details. Your email address, and your phone number if you give it. We never text that number without a separate opt-in.
• What you write. Your answer to each day's question, and whether you chose to share it.
• A session cookie. When you save a page, read someone else's, or report one, we set a single cookie holding a random id, so we know the page is yours. It expires at the next midnight, New York time. We don't use advertising or tracking cookies.
• Your account email. If you create an account, we keep your email address so we can send you sign-in links and keep your pages together. Signing in also sets cookies that keep you signed in.
• Gifts. If you buy a gift, your email address and what you bought, so we can send the codes.
• Payment details, held by Stripe. If you support the room, Stripe collects your card details and, for printed editions, your shipping address. We see only what we need, such as your plan and whether it is active.
• Technical details. Your IP address is used briefly to limit repeated requests and to tell people from bots through Cloudflare Turnstile. We don't store it with your answers.
• Messages you send us, if you write to us.

We use what we collect to:

• show you the day's question and save your page;
• send the emails you asked for, such as a welcome note, sign-in links, receipts, and gift codes;
• send occasional news, only if you said yes, with a way out in every email;
• keep the room safe, by limiting repeated requests, screening shared answers, and reviewing reports;
• take payments and send printed editions to patrons;
• meet our legal obligations, such as keeping tax records.

Sharing is off by default. Each day you can choose to let someone else read your answer, without your name. You can turn sharing off again at any time that day.

A shared answer is shown only on the day it was written. We don't keep an archive of other people's answers.

Before a shared answer is shown, it is checked automatically. Some answers are held back for a person to look at first, and a held answer that isn't looked at that day is never shown. Anyone reading can report an answer, and a reported answer leaves the room until we look at it.

A few companies process information on our behalf, only to provide their service to us:

• Supabase, our database and sign-in provider, hosted in the eastern United States.
• Cloudflare, which hosts the site, protects it from spam, and limits repeated requests.
• Stripe, which takes payments and holds payment and shipping details.
• Resend, which sends our email.

• Pages written without an account are deleted after 30 days. Once your cookie expires at midnight, no one can reach them anyway.
• Pages written with an account stay until you delete them or your account.
• Waitlist details stay until you unsubscribe or ask us to remove them.
• Payment records are kept as long as tax law requires.

Everything you've written stays yours. With an account you can export every page you've written, or delete it, at any time, free, whether or not you support the room.

You can also ask us to show you, correct, or delete what we hold about you. Write to hello@whispersandembers.com and we'll answer within 30 days.

If you live in the European Economic Area or the United Kingdom, you have the right to access, correct, erase, restrict, or object to how we use your information, and to take it with you. We rely on our agreement with you to run the room, on your consent for news and sharing, and on our legitimate interest in keeping the room safe. You can complain to your local data protection authority.

If you live in California or another US state with a privacy law, you have the right to know what we collect, to correct it, and to delete it. We don't sell or share personal information as those laws define it, and we will never treat you differently for using your rights.

Information travels encrypted, and access to the database is locked down so each person can reach only their own pages. No system is perfect, so if something ever goes wrong, we will tell the people affected and do what the law asks of us.

Our database is in the United States, and our providers may process information wherever they operate, such as at the Cloudflare location nearest you. If you write from elsewhere, your information travels there, protected by the safeguards our providers offer, such as standard contractual clauses.

Whispers & Embers is not meant for anyone under 16, and we don't knowingly collect information from them. If you think a child has written to us, let us know and we'll delete it.

If we change this policy, we'll post the new version here with a new date. If the change is significant, we'll also email people with an account.

Questions, requests, or worries: hello@whispersandembers.com.