Privacy Policy

Your account. Your name, email address and password. Passwords are stored only as a one-way hash, never in readable form. If you turn on two-step verification, its secret and backup codes are stored encrypted. Optionally, a short bio and a profile photo; photos are stored in our file storage (Cloudflare R2).

Accounts from the previous site. When Upstart Blogger moved to this platform, existing profiles came with it: name, email, profile photo and, where you had given them, phone number and date of birth. Phone number and date of birth aren't shown publicly. Passwords from the previous site were not carried over.

What you publish. Stories, cover images, website links and comments. These are public by design, together with your name, photo and bio.

Security and usage information.

• When you sign in, we record the IP address and browser/device details (user agent) with your session, to protect your account.
• With each comment we keep a one-way, salted hash of your IP address plus your user agent, to stop spam and enforce rate limits.
• To count story reads, we keep a one-way, salted hash of the reader's IP address and user agent, the referring page, and the account of a signed-in reader. The hash can't be turned back into an IP address.

Messages to us. If you use the Help Center form, we receive your name, email address and message.

• To create and run your account: signing you in, keeping sessions valid, two-step verification, and activating accounts carried over from the previous site.
• To send transactional emails, such as account activation, email confirmation and password resets, through our email provider, Resend.
• To show in-app notifications, for example when someone comments on your story or replies to you.
• To publish and display your content, and to show you statistics such as how many times your stories were read.
• To prevent spam, abuse and fraud, including automated bot checks with Google reCAPTCHA.
• To answer your support requests.
• To understand how the site is used, such as which stories are read and how people find us, with Google Analytics (see Cookies and Tracking).

We don't sell your personal information or show advertising. We use Google Analytics only to measure how the site is used, with Google's advertising features (Google signals and ad personalization) turned off.

We share data only with the providers that run the service for us, and only what each one needs:

• Neon: our database (hosted in the United States).
• Cloudflare R2: storage for images such as covers and profile photos.
• Resend: delivery of transactional email.
• Google reCAPTCHA: bot protection on sign-in, sign-up, password and Help Center forms. Its use is subject to Google's Privacy Policy and Terms.
• Google Analytics: anonymous usage statistics, such as pages viewed, how visitors arrived, and their device type and approximate location. Its use is subject to Google's Privacy Policy; you can also use Google's opt-out add-on.
• Hostinger: the server the site runs on.

We may also disclose information if the law requires it, or to protect the safety of our users or the service.

We use the cookies and browser storage the site needs to work, plus analytics cookies that you can refuse:

• Session cookie: keeps you signed in. Page scripts can't read it, and it expires after a period of inactivity.
• Two-step verification cookies: a short-lived one while you finish signing in, and, if you choose “Don't ask again on this device”, one that remembers the device for up to 30 days.
• Browser storage: your light/dark theme choice, and unsaved drafts in the story editor. These stay on your device and aren't sent to us.
• Google reCAPTCHA: on pages with protected forms, Google may set its own cookies and read device information to tell people from bots.
• Google Analytics (_ga, _ga_…, kept for up to 2 years): count visits and tell new visitors from returning ones. In the EU/EEA, the UK and Switzerland they're set only after you choose “Allow analytics”; elsewhere they're used unless you choose “Decline”. Your choice is stored in your browser, and you can change it at any time with Cookie settings at the bottom of every page. Declining removes these cookies.

Read counts don't use cookies. A visit is counted once per reader, per story, per day, using the one-way hash described above, and known bots are ignored. We don't use advertising or cross-site tracking cookies.

Your data is stored in a managed PostgreSQL database run by Neon, and files in Cloudflare R2. Connections between our server and the database are encrypted, passwords are hashed, two-step verification secrets are encrypted, and only a small number of administrators can access account tools. No system is perfectly secure, but we work to protect your information and will act promptly if something goes wrong.

Your writing belongs to you (see our Terms of Service). You can update your name, bio, photo and password at any time in Settings.

You can ask us to delete your account at any time through the Help Center. Deleting an account permanently removes your profile, your stories and your comments. You can also ask for a copy of your data, or for corrections.

Depending on where you live (for example in the EU, the UK or California), you may have further rights, such as to object to or restrict some processing, or to complain to a data protection authority. Contact us and we'll help.

We keep your account and content for as long as your account exists. When it's deleted, its data is removed from the live database; copies in backups expire on their normal schedule. Support emails are kept as long as needed to handle your request. Security records such as sessions expire automatically.

Upstart Blogger isn't intended for anyone under 16, and we don't knowingly collect their information. If you believe a child has given us personal information, contact us and we'll delete it.

If we change how we handle personal information, we'll update this page and its date, and let you know by email or on the site when the change is significant.