Privacy & removal
What we collect, what we publish, and how removal works, including its limits.
What gets published
Only conversations that a contributor explicitly consented to publish, and that a human moderator approved. File imports become private drafts first, and each one needs its own review and consent.
What we never publish
- Your email address, OAuth account identifiers, or internal user ids.
- Consent records, IP addresses (we only store salted hashes, for abuse prevention), moderation notes, or privacy-scan details.
- Upstream location, IP or request-header fields from imported datasets. We drop them during import.
Automated detection is imperfect
We scan for email addresses, phone numbers, API keys, payment card and bank numbers, US SSNs, street addresses and some sensitive self-disclosures. The scanner misses things: names, indirect identifiers, context. It also flags harmless values. Automatic redaction does not guarantee anonymity. Read the whole conversation before you publish.
Third parties
Don’t submit identifiable private information about other people without their permission. If you appear in a conversation, report it with “takedown request” checked. You don’t need an account.
Removal
Contributors can remove their own conversations at any time, and moderators remove content after reports or takedown requests. Removal:
- takes the conversation off the site, search and the API, and deletes its stored text;
- adds a content hash to a suppression registry, so the same conversation can’t be re-submitted or re-imported;
- excludes it from all future dataset releases;
- adds a content-free entry (count and reason category) to the next release’s changelog.
Limits: releases that were already published are immutable, and people may have downloaded them. We can’t delete copies held by others. We ask users of past releases to apply later removal notices.