Privacy

What we keep

• Your email address and a scrambled (hashed) version of your password, so you can sign in. Your email is never shown to other members.
• Your username, and the bio you choose to add. Other members can look up one profile at a time; there is no public member list.
• The posts and replies you write on the boards. These are public.
• Private messages you send and receive.

Private messages are private, but not secret

Private messages are only shown to the people in the conversation. They are not end-to-end encrypted. That means the site's systems store them in a form the site could read. We don't read them, with one exception: if someone reports a message, a moderator can look at that reported message while the report is open. Every time that happens, it is written to a log.

Please don't send anything in a private message that you wouldn't be comfortable with the site being able to see.

How long we keep things

• Private messages are deleted automatically after 90 days. Once every message in a conversation is gone, the conversation is removed too.
• Reported messages are kept until the report is closed. When you report something, we save a copy of it with the report so moderators can review it, even if the sender deletes their account. Once the case is closed, that copy is removed on the normal 90-day schedule.
• In rare cases, such as a legal request, we may have to hold specific messages or reports longer than usual. Only what's needed is held, and only for as long as it's needed.
• No backup copies: the site's current hosting plan doesn't include automatic backups, so when something is deleted it isn't kept in a backup. If that ever changes, we'll update this page first and say how long backups are kept.
• If you delete your account, your posts stay up but show as written by a "deleted user".

Where your data lives

Everything the site stores, including your account, posts, replies and private messages, lives with our database host, Supabase. The pages themselves are delivered by Cloudflare, which also runs the "are you human" check on new posts before they're saved. Your data isn't sold, and it isn't shared with anyone for advertising.

The only outside connections

Pages on Winnfield Talks load from our own site, and your browser talks to our database host (Supabase, above) to show the boards and your messages. Beyond that, it talks to just two outside services, and only for these jobs:

• Cloudflare Turnstile: the "are you human" check when you sign up, sign in, reset your password, post, reply, or start a new private conversation. It keeps bots out.
• The weather lookup: the little weather reading in the top bar comes from api.open-meteo.com, or api.weather.gov (the National Weather Service) as a backup. It asks for Winnfield's weather, not yours: your location isn't sent. Like any website, the weather service can see your internet address when your browser asks.

That's the whole list. No ad trackers, no analytics scripts, no social media widgets. Our site's security settings block pages from connecting anywhere else.

Ads

If we ever run ads, they'll be for local businesses and they'll look the same to everyone. They won't use your personal data and won't follow you around. Ads never change what gets moderated: posts are only removed for spam, scams, threats or harassment, never for disagreeing.

Questions or requests

Want a copy of your data, or want something removed? Email [email protected] and we'll help.