Privacy Policy
The short version
- We collect as little as we can: a username, an email address and a password we can't read. No real name, no phone number, no payment details.
- Your stories are anonymous and their locations are blurred before they are stored.
- No ads, no trackers, no analytics, and one cookie, only to keep you signed in.
- We never sell your data. A few service providers handle it for us; they're all listed below.
- You can delete everything yourself, at any time, from your account page.
- Who we are
- What we collect
- What we don't collect
- What other people can see
- Why we use it
- Who else receives data
- Legal requests
- Where data is stored
- How long we keep it
- Your rights
- Cookies
- Security
- Children
- Changes
- Contact
1. Who we are
[operator's legal name] runs HSH at hadsexhere.com and is responsible for the personal data described here (the "controller"). Contact: legal@hadsexhere.com.
The site is about sex, so a story you post reveals something about your sex life. The law in many places, including the EU's GDPR, treats that as especially sensitive. We designed the site around that fact: we don't ask who you are, and we don't show stories with any account detail.
2. What we collect
| Data | When | Notes |
|---|---|---|
| Username, email address, password | Sign-up | The password is stored only as a one-way hash (Argon2id); nobody, including us, can read it. |
| Date of birth | Sign-up | Used once to check you are 18 or older. It isn't stored. |
| Consent record: time, IP address, browser (user agent), the version of the content rules you accepted | Sign-up | Proof that you accepted these policies and the content rules. |
| Stories: text, approximate location, optional date it happened, your own rating | When you post | The location is moved to the center of an area about 300 meters across before it is stored; the exact spot you picked never reaches our database. |
| Ratings you give other stories | When you rate | Only totals are shown to others. |
| Reports: the reason, your comment, a copy of the reported story, your email if you choose to give it | When you report a story | Signed in: linked to your account. Signed out: we store a keyed hash of your IP address, not the address itself, to stop one person hiding stories at will. |
| Moderation records: the automated check's verdict and the rule categories involved, and our decisions on reports | When you post, or when a story is reported | The text of a story the check blocks is not kept. |
| Place searches on the map | When you search | The search text is cached for 30 days without any link to you or your account. |
| Technical data: IP address, browser, pages requested, time | Every visit | In server access logs, used for security and to fix problems. Query strings and story links are removed from them. IP addresses are also held briefly in memory to rate-limit abuse. |
| Emails we send you | Confirming your address, resetting your password | We record when we emailed an address, to limit how often we do. |
3. What we don't collect
- Your real name, phone number, postal address or ID documents.
- Payment details. The site is free; if paid features come, a payment provider will handle cards and accounts, and this policy will say so first.
- Your device's location. The map opens near the area of your device's time zone and asks for your location only if you press the locate button. Neither is sent to us; you choose where a pin goes.
- Advertising or analytics data. There are no ad networks, trackers, analytics tools, social media buttons or third-party fonts on the site.
4. What other people can see
- Anyone can see a pin's approximate location, and whether it has a story. Signed-in members can read stories, with the date posted (no time) and ratings.
- Nobody can see which account wrote a story: not your username, not your email.
- Your username appears only to you, in the site's menu when you are signed in.
Remember that what you write can still identify you to people who know you. Leave out details that point to you or anyone else.
5. Why we use it
| Purpose | Legal basis (GDPR) |
|---|---|
| Running your account and the site, signing you in, confirming your email, resetting your password | Performing our contract with you (the Terms) |
| Publishing your stories, which reveal information about your sex life | Your explicit consent, given at sign-up and each time you choose to post. You can withdraw it by deleting a story or your account. |
| Checking stories against the content rules, handling reports, preventing abuse and keeping the site secure | Our legitimate interest, and yours and other people's, in a safe site that doesn't expose anyone |
| Keeping the consent record, answering lawful requests, reporting illegal content | Legal obligations, and our legitimate interest in proving what you agreed to |
We don't use your data for advertising, profiling or selling, and no decision about you is made by automated means alone except blocking a story the check finds clearly breaks the rules, which you can rewrite and post again. Bans are always decided by a person.
6. Who else receives data
We never sell or rent personal data. These providers process it for us, only for the purpose listed:
| Provider | What it receives | Why |
|---|---|---|
| Hostinger (servers in the USA) | Everything on our servers, which it hosts but doesn't use | Hosting |
| Anthropic (USA) | The text of each new story, with no account details, from our server | The automated content check before publishing |
| Our email provider | Your email address and the message | Confirmation and password-reset emails |
| OpenFreeMap | Your IP address and which map area you view, when your browser loads map images | Map images (tiles) |
| OpenStreetMap Foundation (Nominatim) | The text of a place search, from our server, never your IP address | Finding places on the map |
| Our backup storage provider | Encrypted database backups it cannot read | Recovering from failures |
If the site is ever sold or transferred, the data would go with it under this policy, and we would tell you first.
7. Legal requests
We disclose personal data to authorities only when the law requires it, in response to valid legal process, or to protect someone from serious harm, including reporting content involving a minor. We disclose the least we can. Where the law allows, we tell the person concerned. Because we don't collect real names, addresses or exact locations, there is little we could disclose.
8. Where data is stored
Our servers are in the United States. If you use the site from elsewhere, including the European Union, your data is transferred to the US. Where the law requires a safeguard for that transfer, we rely on the standard contractual clauses in our providers' data processing agreements.
9. How long we keep it
| Data | Kept |
|---|---|
| Account, stories, ratings, consent record | Until you delete them or your account. Deletion is immediate. |
| Database backups | 30 days, then overwritten. Deleted data leaves the backups within 30 days. |
| Automated check records | 90 days |
| Accounts whose email address was never confirmed | 7 days, then deleted with everything linked to them |
| Reports, including a copy of the reported story | Until decided, then 6 months. Reports that a story involved a minor are kept longer, because the authorities may ask for them. When your account is deleted, reports you made are no longer linked to it; an email address you typed into a report stays with that report until it is deleted. |
| Records of moderation decisions (hide, restore, ban) | While the site runs, to handle repeat abuse. They hold no story text. |
| Place search cache | 30 days |
| Server access logs | 6 months |
| Application logs | 30 days |
| Email links (confirmation, password reset) | Until used or expired: 48 hours and 30 minutes |
| Failed sign-in counters | 24 hours |
10. Your rights
Wherever you live, you can:
- Delete your account and everything in it, yourself, or any single story, from your account page.
- Access a copy of your data, or have it sent to you in a portable format.
- Correct inaccurate data.
- Object to, or ask us to restrict, how we use it.
- Withdraw consent at any time, by deleting stories or your account. It doesn't affect what happened before.
For anything you can't do on the site, email legal@hadsexhere.com from the address on your account. We answer within 30 days. If you are in the EU or UK, you can also complain to your data protection authority.
If a story is about you, you don't need an account: use the report link on the story and choose "It's about me". Those reports are handled first.
11. Cookies
The site sets one cookie, named session, when you sign in. It keeps you signed
in, is strictly necessary for that, can't be read by scripts, and is deleted when you sign out. There are no
advertising, analytics or third-party cookies, so there is no cookie banner.
12. Security
- All traffic is encrypted (HTTPS), and passwords are stored as Argon2id hashes.
- Sign-in tokens are stored hashed; repeated failed sign-ins are slowed down.
- Backups are encrypted with a key that is never on the server.
- Pins are blurred before storage, so even a breach wouldn't reveal an exact location.
No system is perfectly secure. If a breach affects your data, we will tell you and the authorities as the law requires.
13. Children
The site is for adults only. We don't knowingly collect data from anyone under 18. If we learn an account belongs to a minor, we delete it and its stories. If you believe a minor is using the site, tell us at legal@hadsexhere.com.
14. Changes
We will update this policy when what we collect, or who receives it, changes. The effective date at the top always shows the current version. For significant changes, we will tell signed-in members before they take effect.
15. Contact
Privacy questions and requests: legal@hadsexhere.com.