Privacy Policy

Privacy at a glance

• Your email and login details are not displayed publicly.
• Your alias, avatar, bio, public Case Files, Sister Takes, and public social counts can be seen by other members and, where sharing is enabled, by anyone with a public link.
• Spill Sisters uses account and security data to provide login, prevent abuse, moderate content, and answer support requests.
• Direct messages are not public, but they are not end-to-end encrypted and may be reviewed if reported or when reasonably necessary for safety, support, or legal compliance.
• We do not sell or rent personal information. We do not currently use personal information for cross-context behavioural advertising.
• You can delete your account in Settings or contact support@spillsisters.com if you cannot log in.

1. Information we collect

Account and sign-in information

When you create or use an account, we may collect:

• Your email address
• A password hash and salt if you use email-and-password sign-in; we do not store your plaintext password
• Your selected login method
• Confirmation that you are at least 18, and the time of that confirmation
• Email-verification status and records needed to deliver and validate one-time codes
• Password-reset records, including hashed reset tokens and delivery status
• Session identifiers, security tokens, account status, and account-creation time

If you use Google sign-in, Google provides a verified email address after you approve the sign-in. Spill Sisters requests the OpenID, email, and basic profile scopes for authentication, but the current Service stores your verified email rather than your Google name, profile photo, contacts, or Google password. Google's handling of your information is governed by its own terms and privacy policy.

Profile information

We create or collect your:

• Internal user ID
• System-issued alias and internal profile handle
• Selected avatar
• Optional bio
• Account, warning, suspension, or deletion status
• Follower, following, room-membership, and related counts

Your public profile may show your alias, avatar, bio, public Case Files, and public social counts. Your email is not shown on your public profile.

Content and activity

We process the information you choose to create or interact with, including:

• Case Files, titles, story text, questions, categories, rooms, tags, polls, and updates
• Uploaded images and GIFs, including basic file information such as type and size
• Sister Takes, replies, reactions, likes, saves, follows, hides, blocks, poll votes, and requests for updates
• Message requests, direct messages, message reactions, conversation settings, read status, and limited typing-status timestamps
• Notifications and links between related content

Do not include real names or unnecessary personal information in stories, comments, profiles, media, or messages. If you disclose information about another person, you are responsible for having a lawful basis and permission to do so.

Reports, moderation, and support

We may collect:

• Reports and the reasons or details submitted with them
• The reported post, comment, profile, media, message, or account context
• Warnings, restrictions, bans, moderator decisions, and staff audit records
• Support emails and information you provide when asking for help, making a privacy request, or appealing a decision

Please give us only the information needed to handle the issue. Never email us your password, verification code, or password-reset link.

Technical, device, and security information

When you use the Service, we and our infrastructure providers may process:

• Browser and device type, operating system, language, referring page, requested pages, and timestamps
• Internet Protocol address and network or request information used for delivery, security, bot detection, and abuse prevention
• Session-cookie and browser-storage information
• Rate-limit and fraud-prevention signals
• Error type, affected route, response status, and request duration for operational monitoring

Spill Sisters' durable rate-limit records use a hashed user or Cloudflare request actor rather than retaining a raw IP address. Our limited operational-event store is designed not to contain community content, email addresses, passwords, tokens, full exception messages, or raw IP addresses. Cloudflare and other service providers may independently process request information under their own privacy terms.

2. How we collect information

We collect information:

• Directly from you when you create an account, post, message, report, contact support, or change a setting
• Automatically when your browser or device communicates with the Service
• From Google when you choose Google sign-in
• From other members when they interact with or report your content or account
• From safety, fraud-prevention, and hosting providers that help us protect and operate the Service

3. How we use information

We use personal information to:

• Create, authenticate, secure, and administer accounts
• Verify email addresses and deliver password-reset or essential account messages
• Create your system-issued identity and display your chosen public profile
• Publish Case Files and Sister Takes and provide rooms, feeds, search, reactions, saves, follows, polls, messaging, and notifications
• Remember settings and maintain signed-in sessions
• Detect spam, scams, automated abuse, ban evasion, and security threats
• Apply privacy checks, review reports, enforce the Community Guidelines, and protect users or the public
• Investigate errors, monitor reliability, maintain backups, and improve Service performance
• Respond to support, privacy, account, moderation, and legal requests
• Establish, exercise, or defend legal rights and comply with applicable law
• Notify you of material changes to the Service or these policies

We will ask for additional consent where applicable law requires it for a new use that is not reasonably connected to these purposes.

4. What other people can see

Your public identity may include your alias, avatar, bio, public Case Files, public Sister Takes, reactions or activity counts, followers, following, and room participation.

Public content may be visible to other members. Some Case Files may be available through share links. People who see content can copy, quote, download, or screenshot it. Spill Sisters can remove content from its own systems, but it cannot guarantee removal of copies made by other people or indexed or cached by third parties.

Your saves, password, account email, security tokens, and private account settings are not displayed publicly. Direct messages are visible to conversation participants and may be available to authorized personnel when reported or when reasonably necessary for support, safety, security, or legal compliance.

5. When we disclose information

We disclose information only as needed for the Service and the purposes in this Policy.

Service providers

Current providers include:

• Cloudflare, for website delivery, Pages Functions, D1 database hosting, R2 media storage, security, and Turnstile bot protection
• Resend, for verification, password-reset, and essential account email
• Google, when you choose Google sign-in
• GIPHY, for GIF search and delivery; user-supplied GIF links from GIPHY or Tenor may also cause your browser to contact those providers

These providers may receive account, network, device, request, or content information needed to perform their services. Their processing is also governed by their own privacy terms. The provider list may change as the Service develops; we will update this Policy when a change materially affects how personal information is handled.

Other users and the public

We disclose the public-profile and content information described above according to the features you use. Please treat anything you post publicly as information that may travel beyond Spill Sisters.

Safety, legal process, and enforcement

We may preserve or disclose information when we reasonably believe it is necessary to:

• Comply with a valid subpoena, court order, law, or other legal process
• Investigate or prevent fraud, abuse, security incidents, or violations of our agreements
• Protect the rights, property, or safety of Spill Sisters, our users, or another person
• Respond to a credible and imminent threat of serious harm
• Report content where reporting is required by law

We assess requests and disclose only what we reasonably believe is necessary, subject to applicable law.

Business changes

Information may be transferred as part of a financing, reorganization, merger, acquisition, sale, or insolvency involving all or part of the Service. Where required, we will provide notice and require the recipient to handle personal information consistently with applicable law.

6. Cookies and browser storage

Spill Sisters uses a secure session cookie to keep you signed in and an OAuth state cookie during Google sign-in. We may use browser storage for preferences such as theme, selected avatar, navigation state, or privacy reminders. Cloudflare may use cookies or similar technologies for security and Turnstile bot detection.

These technologies are used for authentication, security, preferences, and essential Service functions, not behavioural advertising. Blocking essential cookies may prevent login or other features from working.

7. Retention

We keep information only as long as reasonably needed for the purposes in this Policy, subject to safety and legal requirements. Current operational periods include:

• Active account and public content: retained while the account or content remains active, unless removed earlier
• Sessions: expire after no more than 14 days and are deleted after expiry
• Email-verification codes: expire after 10 minutes; expired codes are deleted, and consumed codes are removed after 7 days
• Password-reset tokens: expire after 30 minutes; used or invalidated records are removed after 7 days
• Rate-limit records: removed after the applicable rate-limit window expires
• Retention-job history: removed after 90 days
• Deleted conversations: after every participant deletes a conversation, the conversation, membership records, messages, and reactions are removed after 30 days; disappearing-message settings may remove message content earlier
• Deleted-account media: we try to remove it immediately; if a storage deletion fails, the cleanup process begins retrying it after 30 days and removes the media record after the underlying file deletion succeeds
• Support, operational, moderation, and legal records: retained only as long as reasonably needed for support, security, abuse prevention, dispute resolution, enforcement, or legal obligations

Backups and provider systems may take additional time to cycle out deleted data. We will not use information retained solely for safety, backup, or legal purposes for unrelated product activity.

8. Account deletion

You can delete your Spill Sisters profile in Settings → Delete profile. Deletion is permanent and signs you out. See Delete Account for the full walkthrough.

The deletion process removes or scrubs your email, password material, verification status, alias, public profile details, active sessions, verification and reset records, public Case Files, Sister Takes, and the text of messages you sent. It removes your post and comment likes, saves, story reactions, follows, and blocks, marks your conversation membership deleted, and marks uploaded media for removal. We retain a non-personal internal tombstone, an internal ID, deletion time, and empty or scrubbed records, where needed to preserve database integrity and avoid exposing information belonging to other users.

Reports and moderator actions may be retained when reasonably needed to prevent repeat abuse, protect users, resolve disputes, or meet legal obligations. Deleted-account references in those records are reduced to non-personal tombstone identifiers where practicable.

If you cannot access the account, email support@spillsisters.com from the address connected to it with the subject "Delete my Spill Sisters account" and include your current alias if known. We may ask for reasonable verification before acting. Deleting Spill Sisters does not delete a Google account or data controlled independently by Google, Cloudflare, Resend, GIPHY, Tenor, or another user.

9. Your choices and privacy rights

Depending on where you live, you may have the right to:

• Ask whether we hold personal information about you
• Request access to, or a copy of, your information
• Correct inaccurate information
• Delete information or your account
• Withdraw consent where processing relies on consent
• Object to or restrict certain processing
• Receive certain information in a portable format
• Complain to a privacy regulator

You can manage some information directly in the Service. For another privacy request, email support@spillsisters.com from your account email. Put "Privacy request" in the subject line and tell us what you are requesting. We may need to verify your identity, and some rights are subject to legal exceptions. We will not discriminate against you for exercising an applicable privacy right.

Spill Sisters does not currently sell personal information or share it for cross-context behavioural advertising. If that changes, we will update this Policy and provide any legally required choices before the change applies.

10. Security

We use administrative, technical, and organizational safeguards intended to protect information, including hashed passwords and reset tokens, secure session cookies, CSRF protection, rate limits, bot checks, access controls, moderation logs, and restricted infrastructure access.

No online service can guarantee absolute security. Use a unique password, keep verification codes and reset links private, sign out of shared devices, and report suspected account compromise to support@spillsisters.com.

11. International processing

Spill Sisters and its providers may process or store information in Canada, the United States, or other countries where they operate. Privacy laws in those places may differ from the laws where you live, and information may be accessible to courts, law enforcement, or regulators under local law.

12. Adults only

Spill Sisters is for people age 18 and older. We do not knowingly allow anyone under 18 to create an account. If you believe a person under 18 is using the Service or that content includes a minor's personal or sexual information, report it immediately or email support@spillsisters.com. Do not send or duplicate harmful material in your report.

13. Changes to this Policy

We may update this Policy as the Service, providers, or law changes. We will post the revised version and update the effective date. If a change materially affects your privacy choices, we will provide additional notice or request consent where required by law.

14. Contact and complaints

Privacy contact: [PRIVACY CONTACT OR TITLE]

Email: support@spillsisters.com

Mail: [LEGAL NAME], [MAILING ADDRESS]

If you are not satisfied with our response, you may have the right to contact the privacy or data-protection regulator where you live.