Privacy Policy

Effective date: [EFFECTIVE DATE]

WorldSay is a public one-sentence leaderboard. Sentences and comments you publish are public. We collect the minimum needed to run the service, store passwords only as hashes, and do not store your raw IP address in our analytics.

1. Who we are

WorldSay (“we”, “us”) at worldsay.online is operated by [OPERATOR NAME] (“the Operator”). You can reach us at [CONTACT EMAIL]. This policy explains what we collect and how we use it.

2. What we collect

• Account data — email address, username, display name, preferred language, optional country and avatar, your anonymity preference, and email-verification status. Your password is stored only as a salted scrypt hash; we never store it in plain text.
• Content you publish — sentences, comments, echoes (“resonance”), reports you file, users you block, and any boosts applied to your sentences.
• Technical and usage data — a session cookie so you stay signed in, and anonymous visit analytics: a random identifier generated by your browser, stored only as a SHA-256 hash, together with the page type (home, sentence, profile, account) and a timestamp. We do not store raw IP addresses, full URLs or query strings for analytics.
• Rate limiting — to prevent abuse we derive a short-lived, hashed bucket key from your IP address and the request scope. It is not linked to your account and expires within two minutes.

3. Cookies and local storage

• worldsay_session and worldsay_admin — HttpOnly session cookies that keep you signed in (up to 7 days). We do not use them for advertising.
• Local storage: worldsay-language (your interface language) and worldsay-visitor (the random analytics identifier described above).
• Advertising: our pages load Google AdSense, which may set its own cookies and use device identifiers. See section 4.

4. Advertising (Google AdSense)

We show advertising through Google AdSense to keep publishing free. Google and its partners may use cookies or device identifiers to serve and measure ads, including personalized ads where permitted. You can manage personalized advertising in your Google Ads Settings (adssettings.google.com) and review how Google uses data from partner sites (policies.google.com/technologies/partner-sites). Where required by law — for example in the EEA, the UK and Switzerland — we will request your consent before non-essential advertising cookies are used.

5. How we use information

• To create and secure accounts, and to sign you in.
• To publish, rank and display sentences and comments.
• To enforce our limits (three sentences per UTC day and comment rate limits), prevent spam and abuse, and moderate content.
• To understand aggregate usage and improve the service.
• To send service emails (for example, address verification) when email delivery is configured.

6. Legal bases (where the GDPR applies)

Performance of a contract (running your account and publishing your content); legitimate interests (security, abuse prevention, aggregate analytics and free-to-use advertising); consent (non-essential advertising cookies where required); and legal obligations (responding to lawful requests).

7. Sharing

We do not sell personal data. We share it only with service providers that help us run WorldSay: hosting and database (Hostinger); email delivery (our configured SMTP provider, only when enabled); advertising (Google AdSense); and, when payments are enabled, our merchant of record for web purchases (Dodo) and Apple for in-app purchases — payments are currently disabled. We may also disclose information where required by law or to protect rights and safety.

8. International transfers

Our providers may process data in countries other than yours, including the United States, using appropriate safeguards.

9. Retention

We keep account and content records while your account exists and for as long as needed to operate the service, resolve disputes and comply with the law. Analytics events are aggregated and kept for a limited period. Deleted content may remain in backups for a short time.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing, to data portability, and to lodge a complaint with your local authority. To exercise these rights, contact [CONTACT EMAIL]. To delete your account and its content, email us from your registered address and we will action the request; self-service account deletion is not yet available in the product.

11. Children

WorldSay is not directed to children under 13 (or the minimum age in your country). We do not knowingly collect their data.

12. Security

Passwords are hashed with scrypt, sessions use HttpOnly cookies, tokens are stored hashed, and writes are rate-limited and same-origin checked. No system is perfectly secure, but we take reasonable measures to protect your information.

13. Changes

We may update this policy. We will post the new version here and update the effective date above.

14. Contact

[OPERATOR NAME] — [CONTACT EMAIL]