Privacy Policy

• By default, your posts and comments appear without your name. If you choose to set a username or display name on your account, that public identity appears alongside the content you post.
• “Anonymous to other users” is not the same as “anonymous to us.” We keep internal records connecting content to devices and accounts so we can keep the community safe, enforce our policies, and comply with the law.
• Gabberhood is built around location. We use your precise location (with your permission) or an approximate location based on your IP address to show you a local feed. When you post, we do not show your precise location to anyone. A person who sets out to do so could still work out the general area a post came from. We keep a record of the areas, to about a kilometre, you open the feed from, for five years.
• We use AI systems to help moderate content and to rate posts for the feed. Content you submit is processed by our AI service providers for those purposes.
• We collect device and usage signals to fight spam, bots, vote manipulation, ban evasion, and location spoofing.
• We do not sell your personal information.

Content. Posts, comments, images, votes, reports on a post or comment or on a person who posts under a name (the reason you choose and what you write about it), the authors you block, appeals, and any other material you submit through the Service. Even when content is displayed anonymously, we store it together with the device and (if you have one) account it came from.

Account information. Creating an account is optional for browsing. If you create one, we collect your email address and — optionally — a username and display name. Sign-in uses one-time codes sent to your email, so we never collect or store a password. We no longer collect phone numbers, and the numbers people gave us earlier have been deleted. In jurisdictions that require it, we may also collect your date of birth to verify eligibility.

Communications. Messages you send us, such as support requests, appeal submissions, and survey responses.

Location information. If you grant location permission, we collect your device’s precise location to build your local feed and to attach a neighborhood to posts you create. If you don’t, we estimate an approximate location from your IP address. Posting requires location permission. To measure growth by area, we keep one approximate home location (about a kilometre) per installation, set when you first arrive and updated once if you later grant location permission; it is never shown to other users.

Where you browse. Each day you open your local feed, we record the area you opened it from, rounded to about a kilometre (two decimal places of latitude and longitude), with the day, the first and last time you opened it there, and how many times. Opening it from another area that day adds another record. If your device doesn’t share its location, the area is the one we estimated from your IP address, and the record says so. We don’t record a location our location checks (below) did not believe. We keep these records for five years (Section 8). They are never shown to other users: Gabberhood’s administrators can see them, and each time one does, we record it; we also use them to answer valid legal process.

Where a post was written. When you post, we store the post’s location rounded to about a kilometre, and the precise location your device reported separately, encrypted. The precise location is read only to answer valid legal process, and each time it is read we record who read it and for which case. We do not show either to other people. However, the Service is local by design: posts are delivered to people in the surrounding area and ordered partly by distance. A person who deliberately uses technical methods could therefore work out the general area a post was made from, to about a kilometre. The feed works only from the rounded location, which is designed to prevent anyone from narrowing it down further. Where homes are far apart, an area of that size may contain only a few households, and the area, together with what a post says, may suggest who wrote it.

Location checks. Spoofing your location violates our Terms, and we check for it. When your device reports a location, including when you post, we compare it with the approximate location of your network and with the area you last reported, to see whether you could really be there. For the second comparison we keep the rough area you last reported (to about 10 kilometres) for up to one day; it is a working value, apart from the record of where you browse above. In our apps, your phone also tells us whether the location it reported was a simulated one, such as from a location-changing app. If a check fails, we may limit who can see what you post, pause your installation’s ability to be seen for a time, or show you the feed for your network’s location, and we may do so without telling you. We keep a record of a failed check: which check it was, the day, the distance involved, the country of your network, and the rough area. It does not include your precise location or your IP address.

Device and installation identifiers. When you install our app or visit our site, we generate an installation identifier stored on your device. If you sign in, we associate that installation with your account.

Device signals and integrity data. We collect technical information about your device and connection — such as device model, operating system, browser type, language, app version, IP address, network information, and platform integrity or attestation results (for example, Google Play Integrity or Apple App Attest). For Apple App Attest we keep the public half of a key your device creates for our app, and a counter it raises each time it uses the key. On our website only, this also includes characteristics of your browser and screen that together can tell browsers apart (sometimes called a browser fingerprint), and the result of a Cloudflare Turnstile check that tells people from automated scripts; our apps collect neither. Cloudflare also uses the signals its check reads, as its own controller, to improve how it tells people from bots: see Cloudflare's Turnstile Privacy Addendum. We may combine these signals to recognize devices across installations and to build trust and integrity assessments. We use this strictly for safety, security, and platform-integrity purposes: detecting bots and coordinated manipulation, weighting votes, setting how often a new installation can post, enforcing suspensions, and preventing ban evasion. The one exception is the short, general description of each visit set out under “Usage information” below, which we use to understand how the Service is used.

Usage information. How you interact with the Service — pages viewed, posts opened, how far you scroll, votes, comments, shares, reports, whether you saw a sign-in prompt and what you chose, and notification taps. We record these events ourselves, in our own database, keyed to your installation identifier. They never include your precise location, the text you type, or your contact details, and we do not use any third-party analytics service or session replay. We keep them for five years, with the one exception described in Section 8. In the apps, we also use them to decide when to ask you to rate the app, which we do at most once every eight months, and we record that we asked.

Posts you saw. Which posts appeared on your screen in a feed, and which you opened, keyed to your installation identifier. We use this only to measure how widely reported content was seen, so a post can be taken down when enough of the people who saw it report it, and we delete it after 90 days.

At the start of each visit we also record a general description of it: the app version; your operating system and its version number (without the patch level); your device model in our apps, or on the web simply whether you are on a phone, tablet, or computer; your language and timezone; whether location permission is on; and the city, region, and country of the last location we resolved for you — never its coordinates. We keep this general on purpose, so that it describes a group of people rather than picking out one device.

Arrival source. When you first open our website, we record the site that linked you to us (its domain only), the page you landed on, and any campaign tags in the link, so we can tell which places bring people here. This is recorded once per installation and only on the web; the apps do not receive a referrer.

Shared links. When you share a post or an invitation from the Service, the link carries a short code made at random for that one share. We record the code with the share, and if someone new opens the link, with their installation. This lets us tell that a share brought a new visitor, and which share it was. The code is not made from your identifiers, and it tells the person who opens the link nothing about who shared it.

Cookies and local storage. We use cookies and similar technologies (such as browser local storage) to remember your preferences, keep you signed in, and understand how the Service is used. Your browser settings can limit cookies, though parts of the Service may stop working.

Log data. Standard server logs, including IP address, request timestamps, and error diagnostics. With each post and comment we keep the IP address it was sent from, so that we can answer valid legal process about it.

Error reports. When the app or our servers hit an error, a report goes to our error-monitoring provider (Sentry) so we can find and fix the fault. A report holds the error and where in our code it happened, the page or screen and the app’s recent actions leading up to it, and your device model, operating system, browser and app version. Reports from our mobile apps also carry a random identifier that the monitoring software creates for the installation by itself; it is separate from the installation identifier described above and we do not connect the two. A report from our servers can name the record it concerns, such as a post or an installation, by its reference number in our database. Reports are built to leave out your IP address, the installation identifier stored on your device, your sign-in cookies and tokens, your precise location, the details in page and request addresses, and what you were sending at the time, such as the text of a post.

We estimate approximate location from IP addresses using third-party geolocation data (provided by DB-IP). We may also receive technical signals from platform providers such as Apple and Google (for example, push notification tokens and device integrity verdicts).

• Provide the Service — build your local feed, attach neighborhoods to posts, display content, deliver notifications, and operate accounts.
• Moderate content — review posts, comments, and images against our Content Policy, using a combination of automated AI review and human review; handle reports, including measuring how widely reported content was seen; note when several people block or report the same person, or when someone keeps writing to a person who blocked them, so a moderator can look; and record appeals. Who made a report or a block is never shown to the person reported or blocked, nor to our moderators, who see totals.
• Keep the platform safe — detect and prevent spam, bots, fraud, vote manipulation, harassment, location spoofing, ban evasion, and other abuse; protect the integrity of votes and rankings; and respond to urgent safety situations.
• Improve the Service — analyze usage to understand what works, debug problems, and develop new features.
• Communicate with you — send verification codes, service announcements, and (if you opt in) push notifications you can customize or turn off.
• Comply with the law — meet legal obligations, respond to lawful requests, and enforce our Terms and policies.

If we ever introduce advertising, we will update this Policy first and explain what (if anything) changes about how your information is used.

By default, your posts and comments are shown to other users without your name or any public identity. If you choose to set a username or display name on your account, that identity is shown publicly alongside the content you post under it — including a display name you set to your real name — and you can post anonymously instead, whenever you choose. Aside from any identity you choose to display, other users cannot see who wrote a post.

Content you post anonymously never shows your username, even if you set or change one later, or sign in to your account on the device you posted it from. You can make anything you posted under your username anonymous at any time, one post at a time or all at once; this cannot be undone.

A comment is marked “OP” (Original Poster) when you wrote both the comment and the post it is on, and both show your username, or both are anonymous and have never shown a name. This shows that the comment and the post came from the same author. It never connects anonymous content to a name, and it does not show who you are.

Other users can block the author of a post or comment. If someone blocks one of your anonymous posts or comments, they stop seeing what you post anonymously afterwards, from the same account or device. By comparing what they see with what others see, they could work out that those later posts came from the same author as the one they blocked. That does not show who you are, and a block never connects an anonymous post to a named profile.

If someone blocks you while you post under your username, they stop seeing what you post under it, including after you change your username if you keep your posts under the new one. If you release your posts as anonymous instead, or remove your username, what you post afterwards starts fresh for them. You also stop seeing what they post under their username, and can't reply to it; to you it shows as not found, never as blocked. Their anonymous posts are unaffected, so a block never shows you which anonymous posts are theirs. If they release their posts or remove their username, you see what they post afterwards.

Posts and comments are public. Anyone can read them without an account, and post pages may be indexed by search engines and appear in search results. Removed content is excluded from search listings; already-indexed copies may take time to disappear.

Internally, however, we maintain records linking content to the installation, device, and account it came from. We keep these links because they are essential to running a safe anonymous platform: they let us remove bad actors rather than just bad posts, stop the harassment campaigns that have destroyed platforms like this before, and respond to genuine emergencies. Anonymity on Gabberhood protects you from other users — it is not a shield for threats, harassment, or illegal activity.

We use AI models (currently provided by Anthropic) to review content submitted to the Service. Content you post, including images, is sent to our AI service providers for moderation analysis. As part of that review, the AI also rates how useful each post is likely to be to people nearby, and that rating is one of the things that decide where the post appears in the feed. When content is reported, what the reporters wrote about it is sent with it, but not who wrote it. These providers process content on our behalf and are not permitted to use it for their own purposes beyond providing the service to us.

We also use the same AI providers to write Gabberhood's own local content (see the Terms of Service). That generation uses public local news and the campaign area only; no personal information about you is sent to the provider for that purpose.

Automated moderation decisions can affect whether your content is displayed and whether your account receives a strike or restriction. Content taken down on reports without the AI finding a broken rule in the content itself is reviewed by a person before it counts toward a strike, and every child-safety report goes to a person. If you believe a decision was wrong, you can appeal through the Service; appeals are recorded and help us improve our policies, but submitting one does not reopen the decision.

A ban, whether a person or an automated decision places it, signs the account out everywhere and also applies to the phones it was used on, so that reinstalling the app does not get around it. It also bans any other account that used one of those phones in the 90 days before the ban, because we cannot tell people apart who share a phone. Other accounts linked less closely (a phone shared earlier, a phone used by one of those accounts, or a shared web browser) are listed for a person to review, and nothing happens to them unless that person decides it should. A device the ban applies to shows a notice saying the account is banned, with a form to appeal. You can appeal a ban once, at any time while it stands. Appeals are recorded and may be reviewed, but we do not promise a reply beyond a standard acknowledgment, and the ban stays unless it is lifted.

We do not sell your personal information. We share it only as follows:

• Service providers — companies that process data on our behalf under contractual confidentiality obligations, including cloud hosting (Railway, Vercel), database hosting (Neon), file storage (Cloudflare), error and crash monitoring (Sentry), AI moderation and content generation (Anthropic), email delivery (Resend), push notification delivery (Apple, Google), and checking that a device or browser is genuine (Apple App Attest and DeviceCheck, Google Play Integrity, and on our website Cloudflare Turnstile).
• Legal and safety disclosures — we may disclose information to law enforcement or other parties when we believe in good faith that disclosure is required by law (for example, in response to a subpoena, court order, or other legal process), or is necessary to prevent imminent harm to a person, to investigate threats of violence or other urgent safety issues, or to protect the rights, property, and safety of Gabberhood, our users, or the public.
• Business transfers — if Gabberhood is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this Policy’s commitments.
• With your direction — for example, when you use the share feature to send a post somewhere else.
• Aggregated or de-identified data — we may share information that cannot reasonably be used to identify you.

We retain information for as long as needed to provide the Service and for the purposes described above, and no longer than the periods below. When we are required to preserve information for a legal matter (a legal hold), we keep what it covers until the requirement ends, whatever its period here.

• Your posts and comments stay up until you delete them. When you delete one, its content is removed from public view immediately. We keep a copy in restricted internal storage for one year, for safety investigations, legal compliance, and abuse prevention, and then delete it, with the IP address it was sent from. If it had been taken down after reports and a moderator had not yet reviewed it, or a report about it is still waiting for a person, the copy and the reports are kept until the review is done. A moderator may still review it, and what they find can count against your account as it would have if you had not deleted it.
• A photo you post is stored as a file at its own web address. When you delete the post, we delete the photo. When a post is removed under our Content Policy, or is waiting for a person to review it, its photo is taken off that address and kept in restricted internal storage for as long as we keep the post, so that it can be shown again if the decision is reversed. If you delete a post while it, or a comment on it, is the subject of a safety case, or while we are required to preserve your data, we keep its photo in restricted internal storage: with the record of the case unless a reviewer clears it, or until the requirement ends. A phone or browser that has already loaded a photo may keep its own copy.
• The precise location of a post is kept, encrypted, for as long as the post exists. Deleting the post deletes it, and the copy of a deleted post that we keep does not include it. The one exception is a legal hold: if we are required to preserve your data when you delete a post, we keep that post’s precise location until the hold ends. Closing your account does not delete your posts, so delete them first if you want them and their locations removed.
• Usage information (the product events described in Section 2) is deleted five years after we receive it, with one exception: the record that your installation opened its local feed at a given time, together with the number of posts that loaded. It contains no location and nothing you typed. We keep it for as long as we keep the installation identifier it belongs to, because our measurements of whether people come back count those visits over a long period, and deleting them would make past figures impossible to reproduce.
• The record of which posts you saw (Section 2) is deleted 90 days after you saw them, or sooner if the post is deleted.
• The rough area you last reported, which we keep for the location checks in Section 2, is deleted after one day.
• The record of where you browse (Section 2) is deleted five years after the last time you opened the feed in that area on that day.
• Safety and legal records are kept for five years. These include moderation decisions, reports you made about another person, device trust signals, records of failed location checks (Section 2), and the usernames an account has used, each kept five years from when it was made; the IP addresses your installation and your sign-ins used, kept five years after the installation was last used or the sign-in ended; and suspensions, bans, appeals, safety cases and the record of which terms you accepted, kept five years after they end (for the terms, after the account is closed). Running a safe anonymous platform depends on recognizing devices and networks that have abused it before, and abuse patterns play out over months or years. These records are held in restricted internal storage and used only for the safety, security, and legal purposes described in this Policy. Moderation records keep the text they judged. The internal links between an installation, the device it ran on, and the accounts that signed in on it are kept for as long as those records exist, without their IP addresses after five years.
• When you close your account, we delete or de-identify your account information 30 days later (signing in before then reopens it): your email address, username, display name and date of birth, and the history of the email addresses and display names you used. At the same time we delete what only you had a use for: the posts you saved and followed, what you hid, the blocks you made, and your notifications and notification settings. Your posts and comments stay up, without your name; delete them first, in settings, if you want them gone. Your votes keep counting. The safety and legal records described above are kept for their periods, so that closing an account cannot be used to escape a suspension or erase a history of abuse. If we are required to preserve your data, we keep it until that requirement ends.
• If an account is banned, we keep a keyed, one-way hash of its email address for as long as the ban stands, even after the account is deleted, so that the address cannot be used to register again. The hash is deleted if the ban is lifted.

• Location — you control location permission through your device or browser settings. Without it, you can still browse using an approximate feed, though posting requires location.
• Notifications — push notifications are opt-in, customizable by category, and can be turned off at any time in settings or at the device level. The only emails we send are transactional, such as sign-in codes — we do not send marketing email.
• Content — you can delete your posts and comments at any time.
• Account closure — you can close your account from settings or by contacting us.
• Cookies — you can limit cookies through your browser settings.

Depending on where you live, you may have legal rights over your personal information, including the rights to access, correct, delete, or receive a copy of it, to restrict or object to certain processing, and to withdraw consent.

United States. Residents of California and other states with comprehensive privacy laws may have rights to know, access, correct, delete, and opt out of the sale or sharing of personal information, and the right not to be discriminated against for exercising those rights. We do not sell personal information or share it for cross-context behavioral advertising.

European Economic Area and United Kingdom. We process personal data under the legal bases of performance of a contract (providing the Service), legitimate interests (safety, security, and service improvement), consent (where required, such as precise location), and legal obligation. You may also lodge a complaint with your local supervisory authority.

To exercise any of these rights, contact us at privacy@gabberhood.com. We will verify your request — which may be harder for unauthenticated anonymous use, since we may have no way to reliably connect you to a device’s history — and respond within the time required by applicable law.

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Where local law sets a higher minimum age, that higher age applies. If you believe a child has provided us personal information, contact us at privacy@gabberhood.com and we will delete it.

We use technical and organizational safeguards designed to protect your information, including encryption in transit, access controls, and restricted internal access to identity-linking data. No system is perfectly secure, so we cannot guarantee absolute security — because sign-in codes are delivered to your email address, please keep access to your email account secure.

Gabberhood Inc. is based in the United States and processes information there and in other countries where our service providers operate. These countries may have data protection laws different from those in your jurisdiction. Where required, we use appropriate safeguards for international transfers.

We may update this Policy from time to time. If we make material changes, we will notify you through the Service or by other reasonable means before the changes take effect. The effective date at the top tells you when this Policy was last revised. Your continued use of the Service after changes take effect means you accept the updated Policy.