What we collect
- The username you choose. We don't ask for your real name.
- A bcrypt hash of your 7-word recovery phrase. We never store the phrase itself; even we can't recover it.
- If you set one, a bcrypt hash of your urgent-delete password.
- The content you create on the app: confessions, comments, reactions, mood entries, companion chat messages, survey responses, prediction votes, game scores.
- The facts the companion learns about you (name, age, pets, etc.) — visible to you on the Companion page, with a per-fact "forget" button.
- An anonymous session cookie so we know you're logged in (httpOnly, expires after 7 days).
What we don't collect
- No email address.
- No phone number.
- No real-name, address, or government ID.
- No analytics, no third-party trackers, no advertising pixels. The app loads only Google Fonts (for typography). Nothing else makes outbound requests with your data.
- No location tracking. Server logs do record the IP address that made each request (standard for any web server) but we don't tie those to your account, profile you with them, or share them.
Where things go
Everything is stored in a single SQLite database on the server we host the app on. Nothing is sent to a third-party AI, analytics, marketing, or backup service. The companion chat is rule-based — your messages never leave this server.
Who can see your content
- Confessions and comments are visible to anyone signed into the app, with your username attached.
- Mood entries and companion chat are private to your account. Other users can't see them.
- Admins (whoever runs the server) can technically read anything in the database, including private content. We only do this to moderate flagged content. We do not read private chats casually.
What you control
- Forget facts — every fact the companion learns has a "forget" button. Click it and the row is deleted.
- Clear chat — wipes your companion conversation history.
- Delete your account — set an urgent-delete password in Settings and type it on the login screen. Your account, posts, comments, hearts, moods, chat, survey records, prediction votes, and game scores are all atomically deleted.
Risk-detection scanning
Every confession, comment, and companion message runs through a keyword-based risk detector before being saved. If it scores high enough, the message is held back and crisis resources are shown instead. The detector runs on the server, doesn't call any external service, and the score is stored alongside the row only so admins can review escalated patterns.
Cookies
One first-party cookie: gvot.sid, the session cookie. httpOnly, expires after 7 days of inactivity. No tracking cookies, no advertising cookies, no third-party cookies.
Children
The service is for adults 18 and over. Accounts created by minors will be deleted on report. We do not knowingly collect data from anyone under 18.
If we change this
Material changes will be announced on the dashboard before they take effect. You can always close your account by typing your urgent-delete password on the login screen.