Privacy
Privacy policy
Effective 12 November 2026.
The short version: we collect what it takes to run your account and your stage, nothing for advertising, and we don’t sell or share it. You can download it or delete it whenever you like.
What we collect
If you only visit
- Server logs. Like every website, our server records each request: the address requested, the time, your IP address, and your browser’s user-agent. We use these only to keep the site running and secure (for example, to spot attacks). They are rotated and old ones are deleted on a schedule.
- Essential cookies. See the cookie policy. There are no analytics or advertising cookies.
- Abuse protection. To slow down bots, we keep short-lived counters keyed to a scrambled version of your IP address that changes every day, so it can’t be used to follow you over time.
If you create an account
- Your email address, used to confirm it’s you, reset your password and send security notices. It’s never shown on your stage.
- Your handle and display name, which are public: they’re how people find your stage.
- Your password, stored only as a one-way bcrypt hash. We can’t read it.
- When you created your account, when you last logged in, and your settings.
- When stages open: the work you put on your stage, its fingerprints (used only to stop copying), and counts of visits, shares and applause. Those counts are totals; we don’t keep a record of who visited.
Forms
Sign-up and password-reset forms use Cloudflare Turnstile to tell people from bots. Turnstile processes your IP address and browser signals for that check only; see Cloudflare’s Turnstile privacy notice.
What we don’t do
- No selling, renting or trading your information.
- No advertising, ad networks or tracking pixels.
- No marketing email. We only send account email: confirmations, password resets and security notices.
Who else handles it
Our server is our own (a virtual server in the United States), and our email is sent from it. Apart from Cloudflare Turnstile on the forms above, no third party receives your information, unless the law requires it.
How long we keep it
- Account information: until you delete your account.
- Server logs: rotated and deleted on a schedule.
- Backups: kept up to about three months, then they roll off. Once they do, deleted data is gone from them too.
- Records of emails we sent you: deleted when your account is.
Your choices and rights
- See and download your data: Settings → Download my data.
- Correct it: Settings, or write to us.
- Delete it: Settings → Delete your account. It happens immediately.
- Questions, or a request we haven’t covered: privacy@15offa.me. We answer within 30 days.
Wherever you live, you get these rights. If you’re in the EU, UK or California you may also complain to your local data-protection regulator.
Children
15offa.me is for people 13 and older. If we learn an account belongs to someone younger, we delete it.
Security
Everything travels over HTTPS. Passwords are hashed, sessions expire, and admin accounts need two-factor codes. No system is perfect; if something goes wrong that affects your information, we’ll tell you.
Changes
If this policy changes in a way that matters, we’ll say so on this page with a new date, and email account holders before it takes effect.