Privacy policy

Last updated 20 September 2026

This policy explains what Exceptionerror (“we”, exceptionerror.com) collects, why, and the choices you have. We collect only what the site needs to run.

What we collect

• Account details. Your display name and email address. The email address is stored encrypted, plus a keyed one-way fingerprint used only to find your account when you sign in; it is never shown to other members. If you sign up with a password, we keep only a salted, peppered Argon2id hash of it — never the password itself.
• Sign in with Google. If you choose this, Google tells us your name and email address. We never see your Google password and receive no other Google data.
• What you post. Posts, comments, images, votes, and your friend, follow and group relationships.
• Messages. The private messages and pictures you send, who is in each conversation, when messages were read, and the people you have blocked (see “Messages” below).
• Reports. If you report a post, comment or message, we keep who reported it, what was reported, and any reason you give, so administrators can review it. We don’t tell the person you reported.
• Security records. Sign-in and account events are logged with a time and one-way hashes of your IP address and browser type. The IP hash includes the date, so it cannot be used to follow you across days. Our web server also keeps standard access logs (which include IP addresses) for security and troubleshooting, for a limited time.

Cookies and local storage

• A session cookie that keeps you signed in. It is essential, HTTP-only and not used for tracking.
• A short-lived cookie during Google sign-in to protect against forged requests.
• A random ID in your browser’s local storage, used by the voting feature while you are signed out.
• Advertising cookies set by Google and its partners (see “Advertising” below).

If you install the site as an app, it stores a single offline page so it can tell you when you have no connection. Nothing else is cached.

What is public

Posts in public groups and on profiles whose owner switched Public profile on can be read by anyone without an account and may be found by search engines. Private groups and private profiles are visible only to the people you allow. Public pages show your display name and posts — not your email address.

Messages

Direct and group messages are visible to the people in that conversation. They are stored on our server in readable form — they are not end-to-end encrypted, so our systems can technically access them. We do not read or browse them, and administrators have no screen for doing so. An administrator sees a message only if someone in the conversation reports it, together with a few messages before it for context.

Pictures sent in messages are kept in private storage and are shown only to people in that conversation. Deleting a message removes its text and pictures for everyone and leaves a “message removed” note. Someone who isn’t your friend can send you one message request, which you can accept, ignore or block. Ads are never shown in messages.

Advertising

We show ads provided by Google AdSense. Google and its advertising partners use cookies and similar identifiers to show and measure ads, and — where the law and your choices allow — to personalise them using your activity on this and other sites. Google may also read the content of the page you are viewing to pick relevant ads. In the EEA, the UK and Switzerland you will be asked for your consent before personalised ads are used, and you can change it at any time.

See how Google uses information from sites that use its services, and manage your ad preferences at adssettings.google.com. We do not give advertisers your email address, your name or your posts. Ads are labelled “Advertisement”; posts labelled “Sponsored” are placed by us.

Who we share data with

We do not sell your data. A few services process data on our behalf: our hosting provider (where the site and its database run); Resend, which delivers the verification and password-reset emails we send you; and Google, for sign-in and for ads as described above.

Your choices

• Edit or delete your own posts and comments at any time.
• Keep your profile private, or make it public and switch it back whenever you like.
• Delete your account from the account menu. It is deactivated straight away and permanently erased after 30 days (sign in during that time to restore it). Erasing removes your email address and display name and cannot be undone. Posts, comments and messages you have not deleted may remain, shown as from “[deleted]” — delete them first if you want them gone.
• Delete any message you sent, and block anyone from messaging you, at any time.
• Depending on where you live you may have the right to ask for access to, correction of, or deletion of your data.

Children

The site is not intended for children under 13, and we do not knowingly collect their data.

Changes

If we change this policy we will update the date above. Material changes will be announced on the site.