Unsaid

Privacy

If you send a confession

• We store the text and which X handle it was sent to. You never need an account.
• We never store your IP address, account, device ID or browser fingerprint with a confession.
• To stop spam and let people block senders, we store keyed hashes of IP addresses, separate from account data. Recipient-scoped hashes cannot be matched across recipients; a separate site-wide hash lets our safety team ban abuse.
• There is no “who sent this” feature.

Bot protection

We use Cloudflare Turnstile to check for automated abuse when someone sends a confession or buys a reply. The check runs invisibly. Cloudflare processes signals such as your IP address and browser request details for this check; we do not attach those signals to a confession. Read Cloudflare’s Turnstile Privacy Addendum for details.

If you sign in with X

• X tells us your account id and handle. We read your public name, bio and photo from your X profile page.
• We cannot post, read DMs or see followers, and we throw X’s tokens away right after sign in.
• Your session is a random token in an HttpOnly cookie. We store only its hash.

Creator applications

For invited creator applicants, we store the X account ID and profile shown above, payout country, optional application note, the agreement version and time accepted, and our review decision. We encrypt the contact email you enter. Admins use this information to review access; an invite link alone does not approve an account. We store only a hash of each invite code.

Private replies and payments

• For a paid reply, we ask you to enter your email twice and confirm that you are an adult. We use the email to send purchase and delivery updates. Your date of birth is checked during checkout and is not saved.
• We encrypt your delivery email on a separate purchase record. It is not stored on the confession or shown to the creator. Stripe processes the payment and may collect separate billing details. Resend delivers the private reply emails.
• A private link gives access to that purchase and reply. Keep it private. The creator can see the confession and purchased tier, but not your email or payment identity.
• Text replies may be generated with Cloudflare Workers AI from the confession and creator-prepared styles. Voice tiers are recordings the creator prepared before purchase, kept encrypted in private storage. We keep a platform fee from each sale.
• Stripe collects creator identity, bank and tax details for payouts. We never see bank details. Historical gift payment records remain for receipts, disputes and refunds; new gifts are unavailable.

Moderation

• Creators receive confessions by default and can report one after reading or listening. Creators can also turn on an optional word filter. We do not run an AI moderation classifier. The voice word filter may transcribe a recording with Cloudflare Workers AI when a creator enables it. The text filter always refuses content involving minors.
• Our team can read held and reported confessions to handle safety and abuse. Reported content is retained as an encrypted review record, even if an unpaid confession is deleted. Every content read and review action is recorded in an internal audit log.
• To stop abuse, each confession also stores a keyed hash of the sender’s IP address that lets staff ban a sender site-wide. It cannot be turned back into an IP address.

Storage

Confession text and voice transcripts are encrypted (AES-256-GCM) before they are saved. Voice recordings are also encrypted before going into a private Cloudflare R2 bucket. Only the recipient and safety reviewers for held or reported messages can play them. Voice messages are removed after 30 days by default, except when retained for an open report. You can delete an unpaid voice message sooner from your inbox. Someone may still recognize your voice even though we do not reveal your account or IP address.

Creator email

If you add an email in Settings, we encrypt it and send a confirmation link. After confirmation, you can choose confession alerts, payout updates and daily recaps. Emails contain counts and payment status, never confession text or sender details. Resend delivers these emails. You can change alerts or remove your email in Settings.

Analytics

We count page visits, traffic sources and actions in daily totals. These totals do not contain IP addresses, accounts, device IDs, confessions or message text. Google Analytics loads only if you choose to allow it. You can change your choice here.