Privacy

What we never ask for

No name, email, phone number, photo or profile. The river gives you a nickname.

What we keep about your device

A random device token and a recovery code, both stored only as one-way hashes. Your nickname. When you confirmed you are 18 or older. Roughly when you were last here. Whether a moderator closed the river to your device, and why. How much of your daily allowance you used, what you have already read, and your answers to “lighter now?”.

How long your words stay

Some of what you write fades on its own. Today, a bottle sinks after 7 days on the water and its words are erased. Answers to tonight’s question fade after 3 days, half sentences after 7, requests to talk after 12 hours. Letters to someone going through the same thing stay up to 180 days, because they are written to help people later.

Replies you write to someone else’s bottle, answer, half sentence or letter stay until you erase yourself. Anything held back as a possible crisis is kept for safety review, even after that.

Burned letters never leave your device. We only count that a letter was burned, never what it said.

Your journal is yours alone. Moderators never read it, and you can delete any entry.

Conversations

Conversations run on our own chat server, not a third party’s. A conversation stays open only if you both press keep; otherwise it closes when either of you ends it, or after 12 hours without a message.

Closing a conversation hides it from both of you, but its messages stay on our chat server. We are building a way to delete them for good.

Your network address

To stop one person from creating endless identities, we turn your network address into a code that changes every day and cannot be turned back. We delete it the next day. Like most websites, our servers also keep technical logs that include network addresses, used only to keep the service running and safe.

Reports and safety records

When something is reported, we keep a copy of the reported words so a person can review it. For a reported conversation, that is up to the last 20 messages the other person sent. Words held back as a possible crisis are kept for the same reason.

What we never do

We never sell what you write, never share it with advertisers, and never use it to train AI. We do not use tracking cookies.

On your device

The web app keeps your device token, your nickname and a few small settings in your browser’s storage so you stay signed in, and keeps unsent drafts until you close the tab. One cookie remembers your language.

Leaving the river

You can erase yourself at any time from the app’s settings. This removes your nickname, your recovery code, what you wrote in every mode, your replies and your journal, and ends your conversations.

What stays: copies kept for reports that were already filed, words held back as a possible crisis, the blocks you made, your answers to “lighter now?”, which are only ever counted as totals, and a letter you sealed together with someone, which stays in their journal too. Past chat messages also stay on our chat server, out of everyone’s view, until we finish building full deletion.