🔒

Privacy Policy

Your privacy matters deeply to us. This policy explains what we collect, why, and how we protect it.

Last updated: July 2026

Our Philosophy: Minimal Data Collection

WeForgiveThem is not a social media platform. We do not sell your data, serve you ads, or track you across the web. We collect only what is necessary to keep the platform safe and running.

Anonymous Posting

You do not need to create an account to submit a message. Anonymous users may submit, browse, search, and react to messages. When posting anonymously, no personally identifiable information is required or collected beyond what is listed below.

What We Collect

TimestampTo prevent spam and for moderation auditing

Browser & OS (User-Agent)For security analysis and bot detection

CountryFor spam detection and analytics (no city-level data)

LanguageTo serve appropriate content

TimezoneFor display purposes only

Session IDTo manage your browsing session

Hashed IP AddressFor rate limiting and IP reputation checking. We store a one-way hash — your real IP is never stored.

CAPTCHA VerificationTo confirm you are human (via Cloudflare Turnstile)

Spam / AI ScoreAutomatically calculated to assist moderation

Registered Users

Registration is entirely optional. If you choose to register, we additionally store your email address and a securely hashed password (we never store your plaintext password). Registered users can edit or delete their own pending submissions, receive email notifications on approval, and reset their password via email verification.

Cookies

We use only essential cookies by default. No advertising or tracking cookies are ever set without your explicit consent.

sessionManages your browsing session. Expires when you close the browser.

auth_tokenFor registered users only. Keeps you logged in securely.

csrf_tokenProtects against cross-site request forgery attacks.

themeRemembers your preferred display theme.

langRemembers your preferred language.

Donations

Donations are processed through PayPal. WeForgiveThem does not store your payment card information. Please refer to PayPal's Privacy Policy for how they handle payment data.

Data Retention & Deletion

Approved messages may be stored indefinitely as they contribute to our public archive of healing. Rejected and spam submissions are deleted after 90 days. Registered users may request deletion of their account by contacting us.

Security

All traffic is encrypted via HTTPS. We implement Content Security Policy (CSP), HTTP Strict Transport Security (HSTS), secure & HttpOnly cookies, rate limiting, and input sanitization. Passwords are hashed using bcrypt. We conduct daily backups and maintain audit logs of moderation actions.

Contact

If you have any questions about this Privacy Policy, please contact us.