Unsaid

Privacy

If you send a confession

• We store the text and which X handle it was sent to. You never need an account.
• We never store your IP address, account, device ID or browser fingerprint with a confession.
• To stop spam and let people block senders, we store keyed hashes of IP addresses, separate from account data. Recipient-scoped hashes cannot be matched across recipients; a separate site-wide hash lets our safety team ban abuse.
• There is no “who sent this” feature.

Bot protection

We use Cloudflare Turnstile to check for automated abuse when someone sends a confession or gift. The check runs invisibly. Cloudflare processes signals such as your IP address and browser request details for this check; we do not attach those signals to a confession. Read Cloudflare’s Turnstile Privacy Addendum for details.

If you sign in with X

• X tells us your account id and handle. We read your public name, bio and photo from your X profile page.
• We cannot post, read DMs or see followers, and we throw X’s tokens away right after sign in.
• Your session is a random token in an HttpOnly cookie. We store only its hash.

Creator applications

For invited creator applicants, we store the X account ID and profile shown above, payout country, optional application note, the agreement version and time accepted, and our review decision. We encrypt the contact email you enter. Admins use this information to review access; an invite link alone does not approve an account. We store only a hash of each invite code.

Gifts and payments

• Gifts are paid through Stripe. Stripe (and we, as the platform) can see the payer’s payment details and email. The person who receives the gift never sees who paid.
• If you receive gifts, Stripe collects your identity, bank and tax details to pay you out. We never see your bank details.
• We keep a platform fee from each gift (shown before you set up payouts).

Moderation

• Creators receive confessions by default and can report one after reading or listening. Creators can also turn on an optional word filter. We do not run an AI moderation classifier. The voice word filter may transcribe a recording with Cloudflare Workers AI when a creator enables it. The text filter always refuses content involving minors.
• Our team can read held and reported confessions to handle safety and abuse. Reported content is retained as an encrypted review record, even if an unpaid confession is deleted. Every content read and review action is recorded in an internal audit log.
• To stop abuse, each confession also stores a keyed hash of the sender’s IP address that lets staff ban a sender site-wide. It cannot be turned back into an IP address.

Storage

Confession text and voice transcripts are encrypted (AES-256-GCM) before they are saved. Voice recordings are also encrypted before going into a private Cloudflare R2 bucket. Only the recipient and safety reviewers for held or reported messages can play them. Voice messages are removed after 30 days by default, except when retained for an open report. You can delete an unpaid voice message sooner from your inbox. Someone may still recognize your voice even though we do not reveal your account or IP address.

Creator email

If you add an email in Settings, we encrypt it and send a confirmation link. After confirmation, you can choose gift alerts, payout updates and daily recaps. Emails contain counts and payment status, never confession text or sender details. Resend delivers these emails. You can change alerts or remove your email in Settings.

Analytics

We count page visits, traffic sources and actions in daily totals. These totals do not contain IP addresses, accounts, device IDs, confessions or message text. Google Analytics loads only if you choose to allow it. You can change your choice here.