Privacy

The controller for this data is Fleeq, which also runs fleeq.net. For anything on this page, including a request about your own data or a postal address for written correspondence, write to [email protected].

• —What you write. The text, its title, and the form and themes the reviewer assigned it. Published without any author attached. Kept until it is removed.
• —Your email address, only if you make an account. Used to send the sign-in link, and for nothing else. Never displayed, never attached to your writing, never sent to anyone.
• —A keyed hash of your IP address — never the address itself. The address is put through HMAC-SHA256 with a secret key and only the result is written down, so the stored value cannot be turned back into an IP. It exists to stop one source flooding the site, and it is blanked after 24 hours.
• —A random id for your browser, if you mark something. It is not created until the first time you press the heart, and it identifies nobody — it exists so a mark counts once and can be taken back.
• —The reviewer’s decision about each piece, kept with the piece so there is a record of why something was published or declined.
• —Reports, with the reason given and the same keyed IP hash.

Server logs may briefly hold ordinary request information, including IP addresses, as any web server does. These are kept only as long as needed to run and secure the site.

• —A password. Signing in is a one-time link sent by email, so there is nothing to leak.
• —Your IP address in readable form.
• —Your name. There is no field for it, and no author is shown on any piece.
• —Any profile of you built from what you read.

• —Google. Every submission is sent to the Gemini API to be reviewed before it appears, so the text of your piece leaves this server. Nothing identifying goes with it — no email, no account id, no IP, no cookie.
  
  This site uses Gemini’s free tier, and you should understand what that means before you post anything you would not want read. On the free tier Google states that it uses submitted content “to provide, improve, and develop Google products and services”, and that human reviewers may read, annotate and process it. Google separates the text from account details before that happens, and its own guidance is not to submit sensitive or personal information through the free tier.
  
  In plain terms: what you write here is reviewed by a machine, may be read by a person at Google, and may be used to train Google’s models. That is the trade this site makes to review everything at no cost. Do not post anything here that you would not want read by a stranger.
• —The mail server that delivers your sign-in link, if you use an account.
• —Our hosting provider, which necessarily handles traffic to the site.

Nothing is sold, and nothing is shared for advertising. Data may be disclosed where the law genuinely requires it.

Two, both set by this site, both marked HttpOnly and SameSite=Lax so no other site and no script can read them. Neither follows you anywhere. There are no third-party cookies and no analytics, which is why this site does not ask you to click through a consent banner: both cookies are strictly necessary for something you explicitly asked it to do.

• —velune_session — created only when you use a sign-in link. It keeps you signed in. Removing it signs you out; it lasts a year, or until you sign out.
• —velune_visitor — a random value created only the first time you mark a piece, and kept for 30 days. It lets the site count your mark once and let you take it back. It is never created for someone who only reads, and it is not linked to an account or an email. After 30 days it lapses and your browser is simply new again.

Being straight about the one wrinkle: marks are stored against that random value, so the database does contain the fact that some browser marked a particular set of pieces. It is not connected to your identity and is not used for anything, but it is a correlation that exists. It is capped at 30 days by the lifetime above, and clearing your cookies severs it immediately.

Under the GDPR: publishing your writing and keeping you signed in are the service you asked for (Article 6(1)(b)). Reviewing submissions, limiting the rate of posting, and keeping records of decisions rest on legitimate interests (Article 6(1)(f)) — keeping the site lawful and available — balanced by holding as little as possible and hashing what could identify you.

• —Writing: until it is removed, by you or by us.
• —The keyed IP hash: blanked after 24 hours.
• —Sign-in links: fifteen minutes, and one use.
• —Account and email: until you ask for the account to be deleted.

You may ask for a copy of your data, for it to be corrected or deleted, for its use to be restricted, or object to it. Write to [email protected]. You may also complain to your national data protection authority.

The limit is real and worth understanding before you post. Writing posted without an account is not linked to you in any way. That means a request from you cannot reach it either — there is nothing to match you against, and we cannot take your word for it without reintroducing exactly the identity this site refuses to keep. The one-time key you were given when you posted is the only handle that exists. Keep it, and you can remove the piece yourself at any time. Lose it, and the piece stays up.

Writing posted while signed in is different: it is linked to your account, and you can remove any of it from your page.

The site and its database run on servers in Paris, France (Scaleway fr-par). Review requests go to the Gemini API, which may process them outside the EEA under Google’s terms for that service.

This site is not intended for children under 16, and no account should be made by one. If you believe a child has posted here, write to [email protected] and it will be removed.

If this notice changes, the date at the top changes with it.