Privacy
The short version
Wordplay Talk is a public site. What you write here is meant to be read, and search engines index it. What is not public is your email address, your drafts, and what you have read; nobody sees those but you. There is no advertising, no analytics and no tracking, and nothing about you is ever sold or shared for advertising. Your account is a Wordplay account, kept by Wordplay Labs, which tells this site your username, email address and profile when you sign in. The site runs on a server in the United States. You can export everything you have written at any time, and deleting your account deletes everything you wrote.
Who is responsible
Wordplay Labs, the company, runs the sites: Wordplay Talk, this one, and Wordplay Labs and Wordplay Creator. Questions and requests about anything on this page go to [email protected], in English, and are answered within a month.
To report a post or reply, see About.
What we keep, where it comes from, and why
| What | From where | Why |
|---|---|---|
| Your username, name and email address | Wordplay, when you sign in | to have an account; the email is never shown to anyone |
| A profile picture, bio, affiliation and website, and your theme | Wordplay, which keeps them with your account; you set them on either site | shown on your profile; the theme so both sites look the way you chose |
| Posts, replies, tags, votes, who you follow, the groups you are in, the series you arrange, the works you cite | you | they are the site |
| Earlier versions of what you edit | you | readers are shown what changed, which is how writing here stays open to revision |
| Drafts, unsent replies, and what the composer saves as you type | you | so nothing you were writing is lost; private to you |
| Images and files you attach | you | shown where you put them; we strip location and camera data from photos you upload |
| Which threads you have opened and at which version, which threads you watch, which notifications you have read | the site, as you use it | so a thread you read before can show what moved since; shown to nobody |
| A push subscription, if you turn notifications on | your browser | to deliver notifications to that device |
| Which notifications you want by email, and when you were last on the site | you, and the site as you use it | to email only what you asked for, and only when you have been away ten minutes |
| API tokens and connected apps, if you make any | you | so an app can act for you until you revoke it |
| Request logs | the web server | to keep the site running and to find faults |
Giving an email address is the one thing an account needs; without it you can read but not write. Nothing else is required.
We keep these because you asked for an account and for what it does (posts, drafts, notifications, connected apps), because the site has to work and be kept safe (logs, read state, backups), and where the law requires it. Nothing is used to profile you and no decision about you is made by a machine. If you object to any of this, write to the address above.
Who can see what
Your posts, replies, votes, profile and the works you cite are public and indexed by search engines. That is the point of the site: writing here is findable months later. Deleting something here removes it from this site at once; it does not remove copies other people made or clear a search engine's cache, which Google and others refresh on their own schedule.
What you attach to a post (its files, its works and its Context) is listed under Sources on the post, and anyone who can read the post can open it, apps included.
A post in a group is visible only to that group's members: it stays out of the open feed, out of profiles, out of tag pages and out of search for everyone else. Nobody is put in a group without agreeing: you are invited and join only if you accept.
Your drafts and unsent replies are visible only to you. Your email address is never shown. Your profile can be closed to everyone but the people you follow, and your follower and following lists can each be hidden, when you edit your profile.
Where it is kept, and who else sees any of it
The site runs on one server in the United States (OVHcloud, Virginia). Its database, its search index and your images are there and nowhere else. If you are in the European Union or the United Kingdom, what you write and your account details are stored there.
Four others see something, each for one reason:
- Wordplay Labs holds your account (password, hashed and never in the clear, or your link to Google) and tells this site who you are when you sign in. Signing in with Google happens on Wordplay, between your browser and Google; Wordplay receives your email address, name and Google account id, and nothing else. Wordplay has a privacy page of its own.
- The registry of a work you cite. When somebody cites a paper, a book or an article, this server asks the work's own registry about it: Crossref, OpenAlex, arXiv, PubMed, Open Library, Wikipedia, Wikidata, the Internet Archive or MusicBrainz. The registry sees the identifier and this server's address, never yours, and nothing about who cited it.
- Your browser's push service, if you turn notifications on: Google, Mozilla or Apple, depending on the browser. It delivers each notification and so sees its text while doing so. The subscription this site keeps is an address and two keys for that device, not your identity.
- Resend, our email service, if you turn email on in Settings › Notifications: it delivers each email and so sees your address and the email's text while doing so. Email is off until you choose the kinds you want, goes only to an address Wordplay Labs has verified, carries what a push would (who, the post's headline, its first line), never anything from a group you are not in, and waits until you have been away from the site for ten minutes and have not read it here. Every email has a link that turns it off, and Settings › Notifications turns any kind off at once.
- A connected app, if you connect one over MCP or make an API token: it acts as you, within what you allowed (reading what you can read, reading and saving your drafts, listing the groups you are in and writing a draft for one, attaching Context to your posts; it cannot post, reply or vote). What it does with what it reads is that app's business and its policy, not ours. Disconnect it in Settings.
Nothing else. No analytics, no page-view tracking, no session recording, no third-party scripts, no fonts fetched from anyone. Search runs here. Images are stored in our own database. We never sell personal information and never share it for advertising. We hand data to nobody else unless the law makes us.
Cookies and what your browser keeps
| Name | What it is for | How long | Needed? |
|---|---|---|---|
__Host-au_session | keeps you signed in | 30 days from signing in | yes, for an account |
au-theme | remembers light or dark on this device; signed in, your account's choice | a year | no; your own choice |
Nothing on this site tracks you across sites, so there is no cookie banner to click through. Your browser also keeps, on your own device: what you were writing and had not yet sent, so a closed tab or a lost connection loses nothing (cleared when it is saved or posted); how you like the editor set up; and your theme. Clear them in your browser's site settings at any time.
How long we keep things
| What | How long |
|---|---|
| Posts, replies and everything public | until you delete them or your account |
| Drafts | until you delete them; the trash empties after 30 days |
| What you have read, what you watch | while your account exists |
| Request logs | 30 days |
| Backups | a copy is made every night; the server keeps seven days of them and a second machine keeps a year, so what you delete is out of every backup within a year |
| A push subscription | until you turn notifications off, or the push service says the device is gone |
| A token | until you revoke it |
Your rights, and how to use them
You can read, correct, export and delete what the site holds about you.
- Edit or delete anything you have written, at any time, on the site.
- Export everything you have written as Markdown or LaTeX from Settings.
- Revoke any token and disconnect any app in Settings; disconnect Google in your Wordplay account's settings.
- Ask for a copy of everything else the site holds about you, or for a correction, at the address above.
- Delete your account in Settings, under Account. It deletes your account on Wordplay and Wordplay Talk at once, and everything you wrote goes with it, your replies in other people's threads included, your votes, your groups and your drafts. A reply somebody answered keeps its place so theirs still makes sense, its text replaced by “deleted” and its author shown as Deleted account. Backups age out within a year. If you cannot sign in, write to [email protected] and it is done within a month.
If you think the site is handling your data wrongly, write to us first; you can also complain to the data protection authority in your country (in the UK, the Information Commissioner's Office).
Age
You must be 13 or older to have an account, or older where your country sets the age of consent higher. An account we learn belongs to somebody younger is deleted.
Security and breaches
Passwords are kept by Wordplay, hashed with bcrypt. Tokens are stored as hashes. The server is reached over HTTPS only. If a breach ever puts your data at risk, we will tell you, and the authorities the law names, as soon as we know.
Changes to this page
This page is written from the code and kept that way: a feature that starts keeping something new changes this page before it ships. Changes are listed here with their dates, and a change that matters is announced on the site.
- 10 October 2026: rewritten with where the server is, how long things are kept, your rights in full, the age line and a list of changes.
Last updated 10 October 2026.