Privacy policy

What we collect

Depending on which form you use:

• Tickets — category, severity, subject, message body, and an optional reply email or Discord handle (at least one contact method is required so we can reply).
• Contact form — your name, email address, and message.
• Community stories — the story text, an optional topic tag, and an optional display name (posting anonymously is one click). A signed cookie identifies your own posts to you so you can edit or delete them; it contains no personal information.
• Every submission — a one-way cryptographic hash of your IP address, retained indefinitely, used only to rate-limit abuse.
• Tickets specifically — additionally, your raw IP address and browser user-agent. This is kept for one reason: if a ticket indicates someone may be in danger, it lets a human trigger an emergency welfare check. It is never shown on any public page.

Why we collect it

To reply to you, to display community content you chose to share, to detect and rate-limit abusive submissions (the IP hash), and — for the raw IP/user-agent on tickets specifically — to make an emergency welfare check possible if a ticket ever indicates someone is at risk. We do not use this data for advertising, analytics, or tracking, and don't run third-party analytics scripts on submission pages.

Who can access it

Only the site operator, through an internal admin route that requires a separate access key. There is no public page that lists ticket or contact-message contents. Community stories you choose to post are, by design, visible to other visitors on the community pages. The raw IP/user-agent kept on tickets has a narrower gate on top of that: it's only reachable via an admin-only Discord command, and every use of that command (including who ran it and when) is written to an internal audit log.

Where it's stored

In a self-hosted PostgreSQL database run by the site operator — not a third-party SaaS database provider. All app ports are bound to localhost on the host; a reverse proxy is the only public entry point, and the production site is served over HTTPS.

Encryption

Traffic to this site is encrypted in transit (HTTPS) via the operator's reverse proxy. Data in the database is not separately encrypted at rest beyond whatever disk-level protection the host itself provides.

How long we keep it

The raw IP address and user-agent stored on tickets are cleared automatically 90 days after the ticket is created (a scheduled script nulls just those two fields — configurable via SUPPORT_IP_RETENTION_DAYS). The IP hash used for rate-limiting is kept indefinitely, since it can't be turned back into an IP address. Ticket subject, body and status are kept so replies and history keep working, unless you request deletion.

Requesting deletion

There are no accounts, so deletion is handled manually: message the contact page referencing your ticket reference (e.g. SUP-XXXX-YY) or the wording of a story you posted, and it will be removed. Community stories can also be deleted yourself directly from the community page, as long as you're using the same browser you posted from.

Not an emergency service

This site is not monitored continuously and is not an emergency service. If someone is in immediate danger, call Triple Zero on 000. See the crisis support page for 24/7 lines.