Compliance center

Security controls

Firebase authentication, verified-email checks, short-lived identity tokens, Cloudflare Turnstile, IP and user rate limits, strict schemas, payload limits, CORS allowlists, security headers, Firestore deny-by-default rules, and backend ownership checks protect sensitive operations.

Uploads use controlled media identifiers, MIME and size validation, image compression, storage quotas, and server-authorized operations. Public errors are generic while technical details remain in restricted logs.

Private-message administration is restricted to the configured superuser, paginated, loaded only after an explicit action, rate-limited, and audited. Message text is never copied into the audit record.

Deletion and evidence

Timeline deletion uses a reversible trash for up to 24 hours, with an immediate permanent-delete option. Purging removes timeline and event discussions but keeps private account messages, whose source link becomes unavailable. Deleted private messages are tombstoned and their prior versions are kept in a server-only history for up to 365 days.

Account export and deletion controls are available. Some restricted evidence may remain temporarily where required for security, backups, disputes, moderation, or law.

Analytics, advertising, and consent

Analytics consent is separate from accepting the user contract. Optional Google measurement remains denied until the visitor records a valid choice through the site's privacy control or a configured consent platform.

React route changes emit one page_view event through the existing Google tag path. The implementation intentionally avoids installing a second History Change tracker that would double-count views.

Optional PostHog product analytics has its own privacy control. It remains off without an explicit choice; automatic text capture and session recording remain disabled by default.

The AdSense account marker and ads.txt file verify publisher ownership but do not load advertisements. Before ads are activated, eligible content routes, certified consent controls, page exclusions, and advertising consent signals must be reviewed together.

Reports and review

Use Contact + suggestions to report unlawful content, rights infringement, abuse, privacy issues, or vulnerabilities. Do not exploit a vulnerability or access third-party data.

Infrastructure settings, provider contracts, backups, alerts, and these documents require periodic review. This page is operational information, not a certification or a substitute for qualified legal advice.