Privacy Policy
Still Unsaid is a place to publish letters about things left unsaid. Letters can be anonymous to other people, but the service uses an internal account identifier to operate and protect the app.
Information we handle
- Anonymous account information: Supabase creates an internal user UUID and stores the authentication session needed to keep your letters and actions connected to your device.
- Letters and profile choices: letter text, recipient type and optional first name, category, country, city, time carried, anonymity choice, and an optional public display name.
- Interactions and safety actions: Likes, saved letters, reports, blocks, and the details you choose to include in a report.
- Local app data: encrypted drafts, language and appearance preferences, and your selected feed location. The app does not request GPS location.
- Security information: Cloudflare Turnstile processes information needed to check new anonymous sign-ins. Supabase and Cloudflare may process network and device information, such as IP address and browser or device signals, to provide and protect their services.
Public information
Published letter text, the selected city and country, category and other letter metadata are visible in the app. A recipient first name is public only when you choose to show it. A display name is public only when you publish non-anonymously. Internal user UUIDs, reports, blocks, saved letters, drafts, and precise account ownership are not shown publicly.
How information is used
We use this information to authenticate your session, publish and display letters, provide Likes and saved letters, apply blocks, review reports, prevent abuse, maintain the service, and delete your data when requested. Still Unsaid does not use automated AI moderation or privacy scanning in the current release.
Service providers
Supabase provides authentication, database storage, and server functions. Cloudflare provides Turnstile CAPTCHA and website infrastructure. Information is disclosed to these providers only as needed to operate and secure the service. We do not sell personal information or use it for third-party advertising.
Retention and deletion
Published letters and account-linked interactions remain until removed through the service, moderation, or account deletion. Short-lived abuse-prevention records expire and operational failure records are pruned after 30 days. You can permanently delete your anonymous account and its linked letters, Likes, saved items, reports, blocks, local drafts, and session data from Profile → Delete My Data. See the account deletion instructions.
Your choices
You can publish anonymously, omit the recipient name, avoid including personal details in a letter, remove your own letters, unsave or unlike letters, block authors, and delete your account. Anything written in the letter body is published as written.
Contact and updates
For help with privacy or account deletion, use the information on the Support page. We may update this policy when the product or its service providers change. The effective date above identifies the current version.