Privacy policy

What do we collect and why?

Reference ratings and hashed browser/network identifiers

Record private feedback, prevent duplicate ratings and abuse, and support editorial review

Email, signup source, subscription status and delivery records

Send requested newsletters and account emails, manage delivery and honor unsubscribe choices.

Account name, email, X identity, avatar, login method and sessions

Create and secure your account, sign you in and show its private profile.

Saved reference IDs, Header revisions and account preferences

Provide your private Saved collection and remember your choices.

Suggested URLs, messages, contact details, member credit and hashed IP addresses

Review submissions, operate member chat, prevent abuse and credit contributions where appropriate.

Sponsorship links, contact and company emails, selected options and hashed IP addresses

Review sponsor requests, prevent abuse and follow up about a proposed placement.

IP address, request time, browser/device category and request or error information

Deliver and secure the site, enforce limits and troubleshoot failures.

Page paths, aggregate visits, realtime sessions, cursor or card positions and eligible public avatars

Measure aggregate use and provide live visitor counts and cursor activity.

Library page paths (including V2), referring sites, approved campaign tags, source clicks, search result-count ranges, filter use, country, browser/device category, performance timings and daily hashed visitor identifiers

Measure discovery, traffic and page performance with self-hosted, cookieless analytics. We process IP addresses to derive daily identifiers without storing the raw address in analytics. We exclude search text, source destination URLs, account identities, account/admin pages, owner previews and URL queries other than approved campaign tags, and honor Do Not Track and Global Privacy Control for this collection.

Questions, requests and supporting evidence

Answer questions and handle corrections, rights requests, accessibility issues and security reports.

Public source posts, account names, profile images and credited work

Present and attribute editorial references with a link to the source.

Information comes from you, your browser, our providers and public sources linked from featured items. You can browse without an account or newsletter subscription.

Where a legal basis is required, we use:

• Contract performance for accounts, authentication, Saved collections and other features you request.
• Consent for requested marketing email and technologies that require consent.
• Legitimate interests to operate and secure the site, review suggestions, handle correspondence, measure aggregate use, provide live presence and publish source-linked editorial references.
• Legal obligations when the law requires us to keep or disclose information.

We do not sell personal information, use it for cross-site targeted advertising or make solely automated decisions about you that have legal or similarly significant effects.

Who receives your data?

Cloudflare processes network and security data. Resend delivers newsletters and account email. X processes sign-in requests when you choose X login; posts.design does not retain X access or refresh tokens.

Header requests and legacy URL suggestions are saved in private review records and forwarded to a private Telegram review channel. Signed-in member suggestions and chat messages are kept in our private review records and signalled through our realtime service.

Sponsor requests are saved in private review records and forwarded to the private Telegram review channel.

Reference ratings are private usefulness feedback. Aggregate ratings and a reference link may be sent to our private Telegram review channel; voter identities are not included. Editorial decisions remain manual.

Connected visitors can see participating visitors' cursor activity and, for eligible signed-in members, a public profile avatar. Names, handles, email addresses, account IDs and private session data are not sent through the cursor feed.

People helping operate posts.design may access information needed for their work. We may also share relevant information when required by law, to protect people or to establish or defend a legal claim.

Our providers may process information outside Honduras. Where applicable law requires transfer safeguards, we rely on the lawful mechanism available for that provider and transfer, such as an adequacy decision or contractual safeguards. Contact us for details.

When you follow a source, social or affiliate link, that provider handles your visit under its own privacy policy. Remote images or embeds can send request information to their provider, and an affiliate destination may receive referral information.

What do cookies and browser storage do?

Member sessions last up to seven days. Email sign-in codes last 15 minutes; X sign-in and deletion confirmation state lasts up to 10 minutes; deletion-status receipts last up to 30 days. These are secure, same-site cookies used for account access rather than advertising.

We also use local and session storage for preferences, newsletter interface state, navigation and realtime sessions. A six-month browser cookie remembers only whether you last signed in with X or email, so we can mark that choice next time; it does not contain your account identity. Persistent values remain until changed or cleared; session values normally last for the browser session. Clearing browser storage may sign you out or reset features, but it does not unsubscribe you or delete server records. Cloudflare may use cookies needed for access and security.

When you choose to rate a reference, a secure browser cookie identifies your guest feedback for up to one year. A temporary IndexedDB record and a hashed server mapping support interrupted first ratings for ten minutes. Guest feedback expires with its cookie; clearing browser storage does not withdraw an existing rating.

When will we email you?

Creating an account with email does not subscribe you to marketing. A new X account with a confirmed email starts subscribed to Posts Weekly and Hot Headers; returning accounts and prior opt-outs keep their choices. Neither sign-in method subscribes you to Pro launch updates. You can manage Posts Weekly, Hot Headers and Pro updates separately in account settings.

Account, login, security, sponsorship follow-up, support and legal emails are service messages. Newsletter and product updates are marketing messages and include an unsubscribe option. Unsubscribing from marketing does not stop service messages. We use delivery, bounce, complaint and unsubscribe records; we do not build profiles from email opens or clicks.

How long do we keep data?

We keep account data while the account is active.

Member ratings remain until removed or the account is deleted. They stop contributing when account deletion starts and are removed during deletion cleanup. Guest ratings and anonymous sign-in bindings expire after one year. Daily hashed network identifiers enforce rating limits and expire after their daily window. Non-identifying alert receipts may remain to avoid repeated notifications.

Newsletter subscription, delivery and suppression records remain as needed to deliver requested email and honor opt-outs. Suggestions and correspondence remain while needed for review, credit, duplicate prevention, rights requests or disputes. Security logs, provider records and backups follow limited operational schedules and may be kept longer for an active security issue, legal obligation or claim. Non-identifying aggregate counts may be kept without a fixed period.

What does account deletion do?

Account deletion closes the account, revokes its sessions, removes Saved pointers and local contributor identity, and cancels account Pro updates. You may separately unsubscribe the current email from the digest. Deletion does not recall messages, emails, public credits or copies already received by others.

What are your privacy rights?

Email [email protected] to request access, correction or deletion of your personal information. Depending on applicable law and the processing involved, you may also have rights to restrict or object to processing, receive portable data, withdraw consent or appeal a decision. We may ask for proportionate information to verify your request and may retain information where the law allows or requires it.

You can object to processing based on legitimate interests or direct marketing. Withdrawing consent does not affect earlier lawful processing. You may also complain to the data-protection authority where you live, work or believe an infringement occurred.

How do we protect your data?

We use HTTPS, access controls, restricted operational access and provider security controls to protect personal information. No online service can guarantee absolute security.

Is this site for children?

posts.design is intended for a general adult and professional audience and is not directed to children under 16. Contact us if you believe a child has supplied personal information that should be removed.

How can this policy change?

We will update the effective date and provide appropriate notice when this policy or our practices materially change. If a new use requires consent, we will ask before that use begins.