Privacy Policy

Note: This site now runs stock werc. The previous Tokumei microblog account/session model no longer applies. Posts are available on the /p/timeline.

This policy describes what Heyaoi Micro stores. We design for frank conversation: optional accounts, optional anonymity, no third-party trackers, and no Cloudflare.

Information we collect

Posts and replies: until you delete a post (deletion password or account owner tools) or staff remove it for a rules breach, we keep:

The text you post;
Tags you attach, if any;
Uploaded files, if any (images are re-encoded and metadata stripped server-side when possible);
A timestamp (anonymous posts and replies are rounded to the day to reduce timing fingerprints);
An optional deletion password for the post, stored hashed;
For signed posts: the username of the author (and optional display name / avatar linked from your profile).

Accounts (optional): if you register, we store your username, password hash (Argon2id), optional display name, bio, website URL, avatar image, join time, lists of your posts, follows, followers, likes, and in-app notifications. Session and CSRF tokens are stored server-side and in a secure cookie while you are logged in.

Cookies:

Session (werc_user): set only when you log in. HttpOnly, Secure (on HTTPS), SameSite=Strict. Cleared on logout.
Posts per page (ppp): preference for timeline pagination.
Theme (theme): optional accent overlay; default is the site dark theme with no cookie.
Followed tags (following): tags you chose to follow on the Following index.

Follow backups: exporting followed tags writes a one-time code on the server so you can import later. Avoid export if you do not want that list stored.

Captcha challenges: short-lived one-time math challenges are stored server-side (not in the browser token) and deleted when used or expired.

How we use this information

Public content: posts, tags, files, signed usernames, likes counts, and profiles are public by design. Anyone can read them (clearnet, Tor onion, or RSS/API where enabled).

Account data: used only to authenticate you, show your profile, deliver follows/likes/notifications, and let you manage your content.

Cookies: used only for login sessions and the preferences listed above — not for advertising or third-party analytics.

Logs and IP addresses

Web server access logs for this site use an anonymized client identifier (truncated address), not a full IP address, so routine operations and abuse response do not retain raw IPs. Error logs may briefly include connection metadata needed to fix outages; they are not used to profile posters. We do not sell or share visitor lists.

Anonymous posting is still not a guarantee of anonymity against a global adversary (your network, browser, or Tor setup may leak elsewhere).

Information we do not collect

No third-party analytics, ads, or social pixels.
No email address is required to register (there is no password-reset email).
We do not use Cloudflare or other CDN identity products.

Contact

Questions: admin@heyaoi.online.