vpvd Privacy Policy

Draft, not legal advice. This text describes how the vpvd code works as of the revision date. The operator, contact and jurisdiction are chosen by the project owner; until then they are placeholders: [OPERATOR], [CONTACT], [JURISDICTION]. A lawyer must review this text before publication. The Russian version (/privacy) is the primary one; this translation is provided for extension stores and non-Russian readers.

Revision of [DATE]. The service is operated by [OPERATOR] ("we"). Data questions: [CONTACT].

1. In short

• We do not store IP addresses. For anti-spam we keep a keyed hash of the address with a salt that changes every day.
• We do not store the text of other websites. A discussion is tied to the page address; from the page itself we take only its title.
• The browser extension does not send your browsing history. The "there is a discussion here" check runs inside your browser.
• Anonymous comments live for 30 minutes, are then dropped from the database and never get into backups.
• The website has no third-party analytics, ad scripts or tracking widgets.
• We do not sell data and do not share it with advertisers.

2. What data the service has and why

2.1. Account

Posting permanent comments, voting and filing full-weight reports require an account. You sign in with Telegram or an email link; there are no passwords and no phone numbers.

• Telegram. We store your numeric Telegram ID to recognise you next time. We do not store or show your Telegram name, username or photo.
• Email. We store the address in lower case for one-time sign-in links and, if you enable them, reply notifications. A sign-in link is valid for 15 minutes; only its hash is stored.

Your account also has: a display name (neutral user_xxxxxxxx by default, you can change it), sign-up date, karma, account status, notification settings (on/off, quiet hours, time zone), the "may quote my comments in digests" flag, badges and premium entitlements if any.

Session. After sign-in the browser gets a vpvd_session cookie with a random token. The database keeps only the token hash and the creation and last-use times. The session cookie lasts 30 days from sign-in, after which you sign in again. "Sign out" and "Sign out everywhere" delete the session on the server immediately.

2.2. Comments, votes, reports

• Permanent comments: text, author, time, status, rating. Edits keep the previous version, and edit history is public. A comment deleted by its author disappears from view, but the row and its text stay in the database so replies keep their parent and reports and appeals can be reviewed. The text is erased on account deletion if you choose so (section 6), or on request to [CONTACT].
• Comment votes: who voted, on which comment, up or down, and the vote weight with its reason, so ratings are explainable and vote rings can be undone.
• Thread polls. With an account: your ID. Without one: a device key that depends on the thread (votes of one device in different threads cannot be linked), plus daily-salted hashes of the device and address for the daily limit.
• Reports: reason, optional text up to 1000 characters, the reporter key (hash of the account ID or the daily-salted address hash) and the moderation case.

2.3. Anonymous comments

You can post without an account. Such a comment is visible for 30 minutes and then disappears.

• Stored: text (up to 500 characters), a label like "Anonymous #3fa", the daily-salted address hash, creation and expiry time, the hash of a "keep after sign-in" token.
• The label is derived from a daily secret, the address hash and the thread: within one thread you can tell two people apart; across threads the same person cannot be linked.
• Deletion: the table is partitioned into 10-minute slices and an expired slice is dropped whole. A comment disappears from view exactly after 30 minutes and from the database within 40.
• Anonymous comments are excluded from backups.
• Exception: reports. If an anonymous comment is reported before it expires, a copy (text, label, address hash, time) is kept in the moderation case, otherwise unlawful content would vanish along with the evidence. The copy lives as long as the case (section 4).
• The author's browser gets a vpvd_claim cookie for the same 30 minutes. If you sign in within that time, you can keep your anonymous comments: they become permanent under your account.
• Honestly: "disappears from the site" does not mean "nobody saw it". Others can read, copy or screenshot it within those 30 minutes.

2.4. IP address and address hash

The raw IP address is not written to the database or to logs; the web server log format has no address field.

For rate limits and anti-spam the server computes HMAC(daily salt, address). For IPv6 the /64 block is used, since an ISP gives a subscriber the whole block. There is one salt per UTC day, stored in the database.

• The hash is stable within a day and differs between days, so hashes from different days cannot be linked.
• The hash is pseudonymous, not anonymous: while that day's salt exists, someone with database access could test whether a hash matches a given address. Salts are deleted after [30] days; after that such a test is impossible.
• The hash is kept longer than a day in: anonymous comments (30 minutes), poll votes without an account, reports of outlets that closed comments, reports without an account, and copies of anonymous comments in moderation cases.
• The hash is linked to an account in one place only: a record "this account used this hash on this day", written on sign-in, commenting, comment votes and poll votes. It is used only to find groups of accounts that inflate votes from one address, and is deleted after 30 days.

Country is derived from the address using a local GeoIP database on our server, without external services. Only the two-letter country code is stored, in aggregates (2.6). The database is IP to Country Lite by DB-IP, licensed under CC BY 4.0.

2.5. Device key

When you post an anonymous comment or create a discussion without an account, the browser gets a vpvd_dev cookie with a random token for 1 year. The server uses its hash for limits ("no more than N anonymous comments per day per device") and as the poll vote key. Limits live in server memory and are not written to the database.

2.6. Discussion view statistics

We count how many times a discussion was opened and how many distinct viewers it had per day, by thread, outlet and topic. This shows where discussions happen and lets us sell ads per thread without reader profiles.

• A view is counted when you open a discussion page on the website, click "Open discussion" in the extension, or receive a thread from the bot. Visiting any other website is not a view, and the server does not learn about it.
• Only aggregates per (thread, day, source, country) are stored: a view count and a probabilistic distinct-viewer counter (HyperLogLog). What goes into the counter is HMAC(daily salt, viewer key); the key itself (account, device, address) is never stored. The salt is deleted the next day, after which even a known key cannot be checked against the counter.
• There is no record of "this person opened that thread".
• Per-thread aggregates are kept for [3] months, outlet and topic aggregates for [25] months.

2.7. Discussed pages

A discussion is tied to the page address normalised to a canonical form: campaign tags (utm_*, fbclid and the like), extra parameters and fragments are removed. We store its hash, host and domain.

When a discussion is created, the server fetches the start of the page up to the end of <head> (at most 256 KB) once and takes only the title (og:title or <title>). The article text, images and other page content are never read or stored.

Who created a discussion is not stored with the thread, only the source (website, extension or bot).

2.8. Telegram bot and channels

• In private chat the bot receives the link you sent and your numeric Telegram ID (as any bot does).
• If an admin connects a channel, we store the channel ID, title and username, the admin's ID, settings, and the posts that carry a "Discuss" button (post number and thread).
• Clicks on the "Discuss" button are counted as a number only: channel, day, count. No address, cookie or browser data is recorded.

2.9. Reply notifications

If notifications are on, a reply to your comment or a mention creates an event in a queue. The notification text is assembled at send time and not stored; the queue holds neither your email nor your Telegram ID. Events and delivery records are deleted after 30 days, unsubscribe links after 90.

On-site inbox. Regardless of notification settings, a reply to your comment or a mention adds a row to your Inbox: recipient, which comment, its author, when it arrived and when you marked it read. The text is not copied into it — it is shown from the comment itself, so anything hidden by moderation or deleted by its author disappears from the inbox. Inbox rows are deleted after 90 days.

Telegram notifications are sent by our bot via the Telegram Bot API. Emails are sent by [EMAIL PROVIDER], which receives the recipient address and the message text.

2.10. Anti-spam and moderation

• Text signature. To find near-duplicates we keep a 256-byte MinHash signature from which the text cannot be recovered. Signatures are deleted after 7 days.
• Classifier scores are stored for every checked comment version so decisions can be explained and thresholds tuned.
• Moderation decisions are stored with their author (moderator or system) and reason.
• Anti-spam counters (published, hidden, rejected; no text or identifiers) are deleted after 90 days.
• Proof of work. For anonymous posting the browser solves a small computational puzzle. A solved puzzle is kept only until it expires so it cannot be reused.

3. Cookies and browser storage

Only strictly necessary first-party cookies are used, all HttpOnly, Secure, SameSite=Lax, none for ads or analytics.

• vpvd_session: signed-in session, 30 days from sign-in.
• vpvd_claim: lets you keep your anonymous comments after sign-in, 30 minutes.
• vpvd_dev: device key for anonymous-action limits, 1 year. Set only on your first anonymous comment or discussion created without signing in.

Your theme choice (light or dark) is kept in the browser's localStorage and never sent to the server.

There is no cookie banner because there are no cookies that need consent. If that changes, this policy changes first.

4. Retention

• Account data: while the account exists (deletion: section 6).
• Session: 30 days from sign-in.
• Email sign-in link: deleted one day after expiry (valid for 15 minutes).
• Anonymous comment: 30 minutes on the site, up to 40 minutes in the database, never in backups.
• Address-hash and anonymous-label salts: [30] days.
• "Account × address hash × day" records: 30 days.
• Distinct-viewer salt: until the end of the next day.
• Near-duplicate signatures: 7 days. Anti-spam counters: 90 days.
• View statistics: [3] months per thread, [25] months aggregated.
• Notification events: 30 days; unsubscribe links: 90 days; inbox (replies and mentions): 90 days.
• Permanent comments, edit history, votes, moderation cases and copies in them: while the thread or account exists; after account deletion see section 6.
• Server logs (no IP addresses): 14 days. Technical metrics (no personal data): 30 days.
• Backups: daily copies kept 7 days, weekly copies 4 weeks, so deleted data leaves backups within 5 weeks. Anonymous comments are not in backups.

5. Browser extension

This section is the complete privacy policy for the extension stores.

• Without any action from you. Once an hour the extension downloads from our server a file that is the same for all users: address normalisation rules and a compact filter (a Bloom filter) of fingerprints of pages that have a discussion. The request carries no cookies, identifiers or information about your tabs.
• Page check. The address of the active tab is normalised and hashed inside the browser and checked against the downloaded filter. On a match a dot appears on the icon. Neither the address nor the result is sent anywhere.
• On your click. When you click "Open discussion" or "Start discussion", the address of that page is sent to our server, together with your vpvd session cookie if you are signed in on the vpvd website. Opening a thread from the popup adds one to the view statistics (2.6): the thread ID is sent and, if you are signed in, your session cookie, only so the same viewer is not counted twice. The page address is not part of that request.
• What it does not do. It does not read or modify page content (it has no content scripts). It keeps no browsing history. It uses no analytics, advertising IDs or third-party services. It does not download or execute remote code: all code, including the WebAssembly module, ships inside the extension package.
• Permissions: tabs to read the active tab address for the local check; storage to keep the downloaded filter; alarms to refresh the filter hourly; host access to a single address, our API server.
• On-device storage. The filter and rules live in the extension storage and are removed with the extension.

6. Account deletion and your rights

Account deletion. The /settings/delete page has a "Delete account" form: it asks you to confirm your display name and whether to erase your comment text or keep it under a "deleted user" byline. After deletion:

• sign-in methods (Telegram ID, email), all sessions, notification settings and your inbox (replies and mentions) are deleted; in other people's inboxes you appear as "deleted user";
• the display name is replaced by "deleted user" and comments are unlinked from the account;
• at your choice, the text of your comments and their edit history either stay under "deleted user" or are erased;
• your comments are no longer quoted in digests, and quotes already published are removed on request where technically possible.

Moderation decisions and copies kept in cases opened by reports are retained for [PERIOD] if needed to handle the violation or required by law. Deleted data leaves backups within 5 weeks.

Other rights. You can ask what data we hold about you, correct or delete it, or object to processing, by writing to [CONTACT]. We answer within [30] days. Display name, notification settings and quoting consent can be changed by you in settings.

We cannot find data linked only to an address hash or device key: by design it is not linked to a person.

7. Who receives data

Data is stored on our servers in [HOSTING COUNTRY]; we do not use third-party cloud databases. Data is not sold or shared with advertisers. Ads, if any, are targeted by thread and topic, not by reader profile: we have no reader profiles.

Third parties involved in running the service:

• Telegram: Telegram sign-in and the bot. The "Log in with Telegram" button is a Telegram widget loaded from Telegram's servers on the sign-in page only, so Telegram sees that you opened that page. When you sign in with Telegram or message the bot, Telegram processes data under its own terms.
• [EMAIL PROVIDER]: sign-in and notification emails.
• Our own server: runs the service; not a third-party cloud host.
• Cloudflare: tunnel to the server and DDoS protection/CDN. All site traffic passes through it, and Cloudflare technically sees the visitor's IP and request contents at its edge (TLS terminates there). Cloudflare does not see the browser extension's local check (section 5).

We disclose data to public authorities only when and to the extent required by applicable law of [JURISDICTION].

8. Security

Session and sign-in secrets are stored only as hashes. The website is served over HTTPS only. Backups are verified by test restores. Only [OPERATOR] has access to servers and the database.

If a breach affects your data, we will announce it on the website and, where we have a way to reach you, tell you directly.

9. Age

The service is not intended for people under [16]. If you learn that an account belongs to a child, write to [CONTACT].

10. Changes

Material changes are published on this page at least [14] days before they take effect. The revision date is at the top.