Privacy notice

• We collect what’s needed to run a community, and nothing for advertising.
• We don’t sell your data, show ads, or use third-party analytics or tracking.
• Many conversations here are about health. We treat everything you post as sensitive.
• Private rooms show a pseudonym instead of your profile. That’s pseudonymity, not perfect anonymity.
• You can download your data or delete your account at any time from Profile → Your data.

HerThirdSpace is run by [legal name of operator], [address]. We are the controller of your personal data. Contact us about privacy at [privacy email].

Account: your email address and password (stored only as a secure hash by our authentication provider). If you sign in with Google, we receive your name and email from Google.

Profile: display name, username and an optional bio. These are shown in public rooms.

Preferences: topics you love, are open to or have hidden, and the design you chose.

Rooms: which rooms you’ve joined or asked to join, your role there, and your pseudonym in each private room.

What you post: posts, replies, reactions and the topics you tag them with.

Safety records: reports you make, reports about content you posted, people you’ve blocked, moderation decisions and appeals.

Technical: when you signed in, and error logs that record the page and error type but not what you typed.

Posts, replies and topic preferences can reveal information about your health, sex life, relationships or beliefs. In many places this is “special category” data with extra legal protection. We process it only because you choose to share it here, with your explicit consent given when you join, and only to run the community. We never use it to build advertising or marketing profiles, and we don’t infer sensitive traits about you from your preferences.

• To provide the service (our contract with you): your account, rooms, posts, personalised feed and chosen design.
• To keep members safe (our legitimate interest, and legal obligations): screening, reports, moderation, appeals and preventing abuse.
• To improve the community (our legitimate interest): counts such as how many members finished onboarding. These are aggregate numbers, viewed only by administrators.
• Sensitive information you share: your explicit consent, which you can withdraw by deleting the content or your account.

Other members see your public profile and posts in public rooms. In private rooms they see only your pseudonym for that room. They can’t see which private rooms you belong to.

Room moderators see reports from their rooms, with authors shown as they appear in the room (pseudonyms in private rooms). They never see who made a report.

Platform moderators can, for safety investigations only, find out which account is behind a pseudonym. They must record a reason, and every lookup is permanently logged and reviewed by administrators.

Nobody on the platform is told who reported them.

New posts and replies are checked automatically, inside our own database, for things like threats, contact details and dangerous medical instructions. A match is flagged for a human moderator. Only threats, and contact details posted in private rooms, are hidden while a moderator reviews them. Nothing is sent to an outside AI or moderation service. Automated checks never make final decisions about your account.

We use a small number of providers who process data on our behalf, under contracts that limit what they can do with it:

• Supabase — database and sign-in. Data is stored in the United States (AWS us-west-2).
• Cloudflare — hosting, network security and error logs.
• Google — only if you choose “Continue with Google”.
• [email provider] — sends account and password-reset emails.

Where data moves outside your country, we rely on [transfer mechanism, e.g. Standard Contractual Clauses].

• Your account and content: until you delete them or your account.
• Reported content kept as evidence: removed 180 days after the report is closed.
• Records of moderation decisions: details removed after 2 years.
• Moderation audit log: deleted after 2 years.
• Error logs: [Cloudflare log retention period].
• Backups: up to [backup retention period], then overwritten.

Depending on where you live, you can ask to access, correct, delete, restrict or move your data, object to how we use it, and withdraw consent. You can do most of this yourself:

• See and download your data: Profile → Your data.
• Correct your profile and preferences: Profile.
• Delete your account and everything you’ve posted: Profile → Your data.
• Appeal a moderation decision: Profile → Safety.

For anything else, email [privacy email]. You can also complain to your data protection authority: [relevant regulator, e.g. the ICO (UK)].

We only use cookies that keep you signed in. We don’t use advertising, analytics or tracking cookies, so there’s nothing to opt out of.

Access rules are enforced by the database itself, not just the app. Connections are encrypted, and passwords are stored hashed. No system is perfectly secure. If a breach affects you, we’ll tell you and the relevant authorities as the law requires.

HerThirdSpace is for women aged 18 and over, and is designed for women 30+. We ask you to confirm you’re 18 or over when you join; we don’t collect your date of birth or ID. We don’t knowingly collect data from anyone younger. If you believe someone underage has an account, contact us.

If we make material changes, we’ll tell you in the app before they take effect. See also our terms and community guidelines.