What we collect when you join
Creating an account asks for exactly four things and keeps exactly four things:
- Your email address — how the site knows it's you, and the only path to account recovery later.
- Your display name — the name you'll appear under. You choose it; no real name is ever asked for.
- A password hash — your password runs through salted PBKDF2 before it is stored, and only that one-way hash is kept. Your actual password never touches the database.
- An age attestation — the 16-or-older checkbox is stored as a plain yes/no. No birthdate, nothing granular.
No real name, no birthdate, no phone number, no location, no social profiles. Joining asks for nothing else, and the account stores nothing else.
What we collect when you post
When you publish a thread or a reply, the text you write is stored under the display name you chose — and it is public. Anyone can read forum content, and search engines may index it. Write with that in mind.
Public stays public until you choose otherwise: posts remain up until you delete your account. Deleting the account (Settings → “Delete account — everything goes”) removes your threads, your replies, your reports, and your notifications in one stroke. The removal is immediate and irreversible.
What the site reads, but never stores
One exception worth naming honestly: when you open the Get Help page, the site reads a Cloudflare geo header to pick your region's crisis lines. It learns which country a request comes from — country only, nothing finer — uses it to show the right phone numbers, and then it's gone. The value is transient: it is never written to the database or logged anywhere by this app.
Hosting and infrastructure
The site runs on Cloudflare Pages. As the host, Cloudflare keeps standard security logs of requests — the kind any server keeps to catch abuse and failures. That is Cloudflare doing its job as the host, not BreakFree acting as an analyst: nobody here profiles visitors or mines those logs for behavior.
Analytics
The entire analytics stack on this site is Cloudflare Web Analytics. It is cookie-free, does no fingerprinting, does no cross-site tracking, and has nothing to do with advertising. It reports rough page counts and nothing more — that really is the whole stack.
What we will never do
- We will not sell your data — to anyone, for any price.
- We will not run ads.
- We will not embed third-party trackers. (If the join form ever shows a human-check, it is Cloudflare Turnstile guarding bots — a security widget, not a tracker, and it exists only if it is switched on.)
- We will not email you marketing. Nothing is sent from the platform today at all — your address sits quiet unless you're the one writing in.
- We will not share your data.
The project's charter makes this permanent rather than a policy that can drift: the app is free and stays free. There is no revenue leaning on you, so there is no reason to ever want more than the four things above.
Your control
- Sign out anywhere — the Sign out button removes your session cookie from the device, right away.
- Delete everything — Settings → “Delete account — everything goes” removes the account and every thread, reply, report, and notification attached to it. Immediate, irreversible, no support ticket required.
- Ask a question — the Contact page is the door; a human answers.
Changes to this policy
If anything material changes — what is collected, where it goes — you'll hear it in the app first: an inbox notice goes out before the change takes effect. Small edits (clarity, typo fixes) may land quietly, but the date line above is always current.