On Our Privacy Practice

What we keep

When you submit a reply, two things are written to our database: the text of your reply, and the moment it was received. The latter is kept only so that we know when to delete it.

That is the entire record. Nothing more.

What we do not keep

We have deliberately designed the system so the following are never written to disk:

• IP addresses. Used in-memory for a few minutes at a time to rate-limit submissions, then discarded.
• User-Agent strings. Your browser and device are not logged.
• Device fingerprints. No canvas, font, or hardware probing.
• Tracking cookies. Only an essential session cookie for signed-in organisers; nothing for respondents.
• Third-party analytics. No Google Analytics, no Meta pixel, no Segment, nothing.
• Identifiers of any kind from respondents — no names, no emails, no phone numbers, no addresses.

Why, and on what legal basis

Organisers gather feedback to understand the people they serve. The bargain we try to strike is that the organiser learns from the chorus without ever identifying a single voice within it. A reply is only processed after at least 7 others have been received, and an AI assistant is the only reader of raw text — not a human at the organisation.

Under the GDPR (Article 6), the lawful basis is legitimate interest. Because no personal data is collected from respondents, the usual obligations around consent and identification do not arise.

The AI, and what it sees

When an organiser composes a story from the replies, we pass the text (and only the text) to Anthropic's Claude API. Before it leaves our server, every reply is run through a PII scrubber that redacts emails, phone numbers, credit-card numbers, postal addresses, and common name patterns. The model is instructed to weave a collective narrative, never to attribute.

The threshold of 7 replies holds here too — no story, draft or published, exists below it.

How long we keep the text

Replies and stories are deleted automatically after 180 days. A retention job runs once a day and simply drops rows past that cutoff. There is no archive, no backup copy held beyond standard database snapshots, and no export to a warehouse.

Anti-abuse measures

To keep the form useful and quiet, three small protections are in place:

• A rate limit of three submissions per fifteen minutes, per IP, held only in memory.
• A honeypot field, hidden from humans, that bots tend to fill and thereby reveal themselves.
• Duplicate detection, to stop identical text being submitted repeatedly.

These all touch the IP address briefly in memory, but none of them write it to storage.

Your rights, honestly

Because we never learn who you are, we cannot look up your reply, alter it, or remove it on request. This is the cost of true anonymity, and it is, in our view, the better side of the trade. If you have concerns about a particular campaign, please reach the organisation that published it — they know their own audience; we do not.

Questions

For platform-level questions about this document, write to privacy@feednovel.com. For anything specific to a campaign, the organisation that ran it is the right address.