Privacy policy

Young people's privacy

HNDSYT is intended for people aged 15 and over. We ask users to confirm that they meet this minimum age, but we do not independently verify every user's age.

If you are under 18, do not share your full name, home address, school, workplace, phone number, personal email, usernames, daily schedule, exact location, or other details that could identify or locate you. Ask a parent, guardian, or trusted adult if you are unsure.

If we reasonably believe an account belongs to someone under 15, we may restrict or remove the account and associated content. A parent or guardian can contact us to raise a concern or request review. We may also remove content that creates an unnecessary privacy or safety risk to a younger person.

What we collect

When you create an account

• Your name and email address
• Your profile photo, if Google provides one through sign-in
• Account identifiers, session records, and authentication information needed to secure your account

HNDSYT currently uses Google Sign-In. Google may provide the name, email address, profile information, and account identifier needed to authenticate you. HNDSYT does not receive your Google password.

When you use HNDSYT

• Stories, lessons, comments, reactions, reports, and other content you submit
• Bookmarks and account, privacy, consent, and feature preferences
• Information about interactions needed to provide, moderate, or secure the service
• Technical information such as IP address, browser or device information, requests, security events, and activity logs

Public and anonymous content

Published stories, comments, and reactions may be visible to anyone. Every submitted story remains private until a human moderator reviews it and decides whether to publish it.

If you post anonymously, your name and profile are not shown publicly. The content remains linked to your account internally so we can operate HNDSYT, investigate abuse, address safety concerns, and meet legal obligations. Anonymous means anonymous to the community, not to HNDSYT.

Anonymous publishing does not remove identifying details written inside your content. Review your content carefully before submitting it.

Sensitive information

Stories may voluntarily reveal sensitive information, including information about physical or mental health, sexuality, religious or philosophical beliefs, political views, racial or ethnic origin, or other deeply personal experiences.

Share only what is necessary and do not reveal sensitive information about another person without an appropriate reason and permission. If you choose to publish sensitive information, it may become public. HNDSYT processes this information only as needed to host the content you request, conduct human and AI-assisted moderation, protect users, and operate the service.

How we use information

We use information to:

• Create, authenticate, secure, and manage accounts
• Review, publish, and manage content and features you choose to use
• Provide bookmark-category recommendations only if you enable them; this feature is off by default
• Prevent spam, fraud, abuse, and harmful activity
• Moderate content, investigate reports, and protect users
• Maintain performance, security, and reliability
• Understand use, improve HNDSYT, and develop new features
• Produce aggregated or anonymised insights where appropriate
• Meet legal obligations and establish, exercise, or defend legal claims

We do not sell personal information.

AI-assisted processing

HNDSYT uses OpenAI's API for limited moderation and administrator-initiated editorial work. We aim to minimise the information sent and do not intentionally send account credentials or unrelated account information.

Story moderation

Relevant story content may be sent to OpenAI to identify potentially unsafe, abusive, offensive, or prohibited material. AI is decision-support: it may produce categories, scores, and explanations, but it does not publish a story. Every submitted story is reviewed by a human moderator irrespective of whether AI flags it. AI results may be retained with HNDSYT's moderation record so the moderator can make and explain a decision.

You may contact us if you wish to question a moderation outcome or request a further human review.

Monthly Issues

An administrator may use selected story titles, categories, lessons, and editorial context to help draft Monthly Issue themes, summaries, quotations, or ordering. OpenAI may also generate cover artwork from an editorial prompt. These tools support editorial work; HNDSYT remains responsible for what it publishes.

Training and advertising

HNDSYT does not train its own AI models with personal information, has not opted into OpenAI API model-improvement data sharing, and does not intentionally provide personal information to train general-purpose AI models. HNDSYT does not sell personal information to AI companies.

OpenAI states that API data is not used to train its models by default unless a customer opts in. Provider processing remains subject to OpenAI's applicable business terms, retention rules, and data protection arrangements.

Anonymised and aggregated information

HNDSYT may use information that has genuinely been anonymised or aggregated so that a person can no longer reasonably be identified to understand usage and content trends, improve features and safety systems, develop editorial insights, and evaluate future functionality. We do not intentionally use such information to identify people.

Reports and moderation records

When content is reported, HNDSYT may store the report reason and details, the signed-in reporter's internal account identifier where applicable, authentication status, browser-family metadata, and a pseudonymous fingerprint derived from technical information such as IP address and browser family. These records help prevent duplicate or abusive reporting and support safety review.

Reporters are not identified to the community. Anonymous reporting does not mean that no security information is processed internally.

A dismissed report is not erased. HNDSYT keeps a durable moderation history that may include the original report, status, decision date, moderator, internal decision note, related enforcement action, and audit record. This allows consistent decisions, safeguarding, dispute handling, and detection of repeated abuse.

Third-party service providers

HNDSYT uses selected providers to operate the service:

These providers may use subprocessors and process data in the United States or other countries where they operate. Their applicable terms, privacy information, retention rules, and data processing arrangements govern their provider-side processing. HNDSYT does not use OpenAI's consumer ChatGPT service to process user content.

Data sharing

HNDSYT may share personal information with providers where reasonably necessary to provide, secure, moderate, and operate the service. We may also disclose information:

• When you ask or authorise us to do so
• To protect users, HNDSYT, or the public from abuse, fraud, or security threats
• To investigate or respond to a safety report
• When required by law, court order, or lawful authority
• To establish, exercise, or defend legal claims
• As part of a merger, acquisition, or asset transfer, subject to applicable law

We do not sell personal information or share it with third parties for their independent advertising or marketing unless clearly disclosed and legally permitted.

Analytics and platform monitoring

Vercel's essential hosting, logs, observability, firewall, and security services may process IP addresses, browser or device details, requests, traffic, performance, errors, and security events. HNDSYT uses these to secure the service, diagnose problems, maintain reliability, and prevent abuse.

Vercel Web Analytics is separate and is loaded in production only after you choose Accept all in Cookie preferences. It remains disabled when consent is absent or set to essential only. HNDSYT uses it to understand general website usage and does not treat it as an HNDSYT user profile.

Advertising and editorial placements

HNDSYT includes functionality for editorial and advertising placements, but advertising is not currently active. Editorial placements may highlight HNDSYT stories, Monthly Issues, features, or initiatives.

If advertising is activated, we will review this policy and explain the provider, information used, purposes, technologies, and available choices. HNDSYT does not sell personal information to advertisers and will not use personal information for targeted advertising unless legally permitted and appropriately disclosed.

International processing and transfer safeguards

HNDSYT and its providers may process or store information outside the United Kingdom, including in the United States. Where UK law requires a transfer mechanism, HNDSYT relies as applicable on UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful mechanism.

We also rely, where appropriate, on providers' contractual, technical, and organisational safeguards. For example, Vercel's current Data Processing Addendum includes contractual mechanisms for relevant international transfers.

How long we keep data

These are HNDSYT's practical retention standards. We may retain particular information longer when reasonably needed for safeguarding, repeated abuse, a dispute, legal preservation, or another legal obligation.

• Account and feature data: while your account is active. Deleting your own content removes it from active use. A complete account-deletion request is handled manually and is normally completed within 30 days after identity verification.
• Backups: deleted account or content data may remain until overwritten through the provider backup cycle, targeted at no more than 90 days unless legal preservation is required.
• Sessions and routine technical or security records: expired sessions and HNDSYT-controlled routine logs are kept for up to 90 days, subject to shorter or separate provider defaults.
• Reports and moderation records: generally 2 years after a report or case closes. We may retain them longer for repeated abuse, safeguarding, disputes, enforcement, or legal obligations.
• Privacy-request records: generally 3 years after the request closes so we can demonstrate how it was handled.
• Analytics: according to HNDSYT's Vercel configuration and Vercel's applicable retention, and only after consent.
• OpenAI processing: API inputs and outputs are subject to OpenAI's applicable provider retention. Moderation results or editorial outputs deliberately saved by HNDSYT follow the relevant HNDSYT content, moderation, or editorial record.

When information is no longer required, we delete, anonymise, or securely dispose of it where reasonably practicable. Provider-side copies remain subject to the provider's deletion and backup lifecycle.

How data is stored and protected

HNDSYT uses cloud infrastructure and reasonable technical and organisational measures designed to protect information from unauthorised access, loss, misuse, alteration, or disclosure. Measures may include authentication, access controls, encryption, security monitoring, and firewall protection.

No online service can guarantee absolute security. If we become aware of a personal-data breach requiring notification, we will follow applicable legal requirements.

Your rights and choices

Depending on your circumstances and applicable law, you may have rights to access, correct, delete, restrict, or object to processing; receive portable data where applicable; and withdraw consent where consent is the basis.

• Edit or delete your own stories and comments
• Control bookmark-category recommendations in account Privacy controls
• Choose anonymous publication where available
• Change Cookie preferences and withdraw analytics consent
• Ask about a moderation outcome or request further human review

To make a request, email contact@hndsyt.com. We may verify your identity. Some records may be retained when we have a legitimate or legal reason.

You may also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint. You are welcome to contact HNDSYT first, but you do not have to do so before contacting the ICO.

Legal bases for processing

Where the UK GDPR applies, HNDSYT relies on one or more of these bases:

• Contract: to provide the account and service you request.
• Legitimate interests: security, fraud and abuse prevention, human and AI-assisted moderation, reliability, technical monitoring, improvement, and protecting users and HNDSYT. We consider users' interests and rights.
• Consent: where we request it, including optional analytics, with a way to withdraw it.
• Legal obligation: where processing is necessary to meet a legal duty.

Cookies and browser storage

HNDSYT uses the following technologies:

• Secure authentication cookies: Better Auth uses an essential session cookie to keep you signed in. The session lifetime is seven days, with routine renewal while you remain active.
• Consent cookie: hndsyt_cookie_consent stores either essential-only or all consent for one year.
• Essential preferences: browser storage may remember interface choices such as theme.
• Foresight reflection: after completion, we store anonymous aggregate answer counts and a set-specific completion cookie. We do not store an individual answer sheet or connect choices to an account, email, session, or other identifier. Your browser may retain only the result summary locally so you can revisit it; question-by-question selections are excluded. Foresight uses fixed Bold or Measured classifications and administrator-written result bands; no AI processes or interprets your answers.
• Cloudflare Turnstile: protected forms use essential security technology to detect bots and automated abuse.
• Vercel Web Analytics: loaded in production only after analytics consent.

You can reopen Cookie preferences and withdraw analytics consent at any time. Essential storage cannot be disabled through HNDSYT because it is needed for authentication, preferences, or security, though browser settings may remove or block it and may prevent parts of HNDSYT from working.

Changes and contact

We may update this policy. If changes are significant, we will update the effective date and, where appropriate, notify users through HNDSYT.

For questions, privacy requests, parental or guardian concerns, or moderation review requests, contact contact@hndsyt.com.

Not every HNDSYT has to be yours.