Privacy Policy

When you create an account we collect your email address (for authentication and account recovery) and a username you choose. Your username is displayed to other users. Your email address is never shown publicly.

Posts, comments, and direct messages you create are stored in our database. You choose what you share. Posts and comments are visible to other signed-in users. Direct messages are visible only to the participants of that conversation.

We also operate a public preview page (avelune.app/explore) that shows a small, rotating sample of recent posts — by username only, never your email or any identifying account information — to people who have not yet signed up. This is enabled by default. You can turn it off at any time under Settings → Privacy, after which your posts will only ever be shown to signed-in members. The preview page is marked noindex so its contents are not archived by search engines, and replies/comments are never displayed there.

If you report a post or comment for breaking a rule, that report stays anonymous, and it may be read by a member volunteer moderator as part of how we review it. A moderator can hide a post or reply that breaks the community guidelines, lock replies on a post, or close a report where nothing is wrong. Once trusted, a moderator can also remove a post or reply and pause an account's posting for an hour or a day (up to three days for a lead moderator). The admin can undo anything a moderator does. A moderator cannot see who filed the report or who posted the reported content, and we never show a moderator a report that touches on an immediate safety concern, self-harm or sexual content, regardless of how it was filed. If you think a removal was a mistake, the "say so here" link on your Removed page goes to the admin only.

Reports on direct messages, group messages, and Commons chat messages are read by an admin only. The same is true for anything you flag as "I'm worried about them" rather than a rule break: it goes to an admin only, and the person you're concerned about is never told.

Feedback you send may be read and sorted by a member volunteer, who sees what you wrote but not your name or account, and may send one of the admin's ready replies to simple things. Feedback marked as a safety concern, or that looks like someone may be in danger, is never shown to a volunteer.

In a chat with a listener, the listener sees your username once they pick up your request. Listener chats are checked automatically for signs that someone may be in danger, and the admin reads one only then or when the listener asks for help.

If you use Talk to put up a card, or to say hi to another member's card, we log that a connection formed — who reached out, who responded, when, and the topic — for safety oversight. We do not log the contents of the conversation itself; once connected, you're talking through our normal direct-message system, with the same privacy as any other conversation. If a message in that chat is later reported, only the reported message is reviewed — never the rest of the thread. If you post a request anonymously, your identity stays hidden from other members until you answer someone.

If you use the mood check-in feature, your mood scores and journal entries are stored privately and associated with your account. This data is only visible to you — no other user, including administrators, can read your personal wellness entries.

After replies arrive on something you posted, we may ask you once whether they helped. Answering is optional, skipping is always an accepted answer, and you are never asked twice about the same post. Your answer is stored privately against your account and is only visible to you. No other member, including administrators, can see what you answered, and the person who replied to you is never told.

We use these answers in two ways: to show you, in future, what has actually tended to help you, and to understand in aggregate whether Avelune is working. Any aggregate reporting counts answers across many members at once and never identifies anyone.

Submitting feedback requires being signed in, so we can follow up if you report a bug or ask a question. We store your message, the category you selected, your user ID, and — for bug reports — anything you add under "steps to reproduce" and basic device/browser information captured automatically from your browser (never typed by you).

To prevent abuse, we store a one-way HMAC hash of your IP address when you create an account, and a hash of your email address when you request a password reset. These hashes expire automatically after one hour and cannot be reversed to identify you.

When we ban or suspend an account for violating our community guidelines, a moderator may also block the IP address associated with that violation — stored as the same kind of one-way HMAC hash described above, but kept until a moderator manually lifts it (rather than expiring after an hour) so it can prevent that account from being recreated. This hash cannot be reversed to identify an IP address.

We also compute a device fingerprint from a handful of technical browser signals (screen size, timezone, and similar) when you create an account, and store a one-way hash of it. If your account is later banned or suspended, that hash can be blocked the same way, to make it harder to evade a ban by creating a new account from the same device. This hash also cannot be reversed to identify your device, and is not used for any purpose besides ban enforcement.

When you create an account, and when you open Avelune (at most about once an hour), we record the country and region your connection comes from, the name of your internet provider or mobile network, and your device and browser type (for example “iPhone, Safari”). This is worked out from your connection, not from your device's location services, and it never includes your city or address. Only the site owner can see it. It is used only to keep the community safe, for example to tell whether a new account was made by someone who was banned, and it is deleted after 90 days.

Our hosting infrastructure (Cloudflare Workers) may log standard access metadata such as IP addresses, request timestamps, and response codes for security and reliability monitoring. We do not use this data for advertising or sell it to third parties.

We count visits in two ways. Cloudflare Web Analytics records page loads without cookies or any identifier for you, and only in aggregate. Google Analytics records visits to browsing pages such as the feed and posts: the page address (without anything after a question mark), the page title, your device and browser type, and an approximate location. It sets a cookie on your device to tell repeat visits apart. Google Signals and ad personalisation are switched off, so this data is not linked to a Google account or used to target ads at you.

Google Analytics never runs on direct messages, the Commons, your journal and wellness pages, Talk, check-ins, search, your own activity pages, settings, or the help, safety and crisis pages. We use it to understand how the site is used and to verify our traffic figures to prospective advertising partners.

You can turn Google Analytics off for your device at any time in Settings → Privacy. If your browser sends a Global Privacy Control signal, it is off automatically.