Privacy Policy

Riposte.to (“we”, “us”, “our”) is committed to protecting your privacy. This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data. By using the Platform, you agree to this policy.

Account data: When you register, we collect your email address, username, and a hashed version of your password. We never store your password in plain text.

Content data: Comments you post, Riposte Pages you create, savage votes you cast, and poll responses are stored in association with your account.

Usage data: We log your IP address at account creation (signup) and on each login, together with a country-code derived from Cloudflare's free geo-IP header (CF-IPCountry). Your IP at the time each comment is posted is also stored. These records are retained for the lifetime of your account and are used for abuse prevention, geographic content personalization, and — where required by law — disclosure to law enforcement or child-safety agencies. Login history records are retained for 12 months.

Behavioral data: To detect abuse and operate the platform's automated moderation system, we maintain a set of derived account-level records. These include an Edge Rating score (edge_rating_score, a behavioral score derived from your comment history), a violation-attempt counter (violation_attempts, tracking how often submitted comments have been flagged by moderation), and a record of any account-level flags raised by our automated systems (flagged_accounts). These records are derived from your comment activity and are not collected from any external source.

Preferences: Filter preferences you set on the site (Edge tier filter, hidden categories, ghost/echo/shill score thresholds) are stored in a per-account preferences record (user_filter_preferences) so the experience persists across sessions and devices. Filter preferences are not shared with third parties and exist solely to render your chosen view of the site.

Cookies: We use session cookies to maintain your login state. We do not use third-party tracking cookies or advertising cookies.

We use your data to:

• Provide and operate the Platform
• Authenticate your identity and maintain your session
• Run automated content moderation on submitted comments
• Detect and prevent abuse, spam, and prohibited content
• Send transactional emails (email verification, password reset) — no marketing email
• Analyze aggregate usage patterns to improve the Platform

We do not sell your data to third parties. We do not use your data for targeted advertising.

Google Gemini API: Every comment submitted to the Platform is sent to Google's Gemini API for automated content moderation analysis. Comment text and contextual thread data are transmitted to Google for this purpose. Google's data handling is governed by Google's Privacy Policy.

Cloudflare: We use Cloudflare for DNS, DDoS protection, and SSL. Cloudflare provides us with your approximate country of origin via the CF-IPCountry header, which we store at signup and on each login for geographic content personalization. Cloudflare may process request metadata per their privacy policy.

No other third-party services have access to your personal data.

We may disclose your personal data — including IP addresses, account identifiers, and content — to law enforcement or other government authorities when we receive a valid legal request (subpoena, court order, search warrant, or equivalent under the laws of the requesting jurisdiction), or where disclosure is required by applicable law.

Child sexual abuse material (CSAM): When our automated moderation system or a user report identifies content that is reasonably suspected to be child sexual abuse material, that content and any associated account data (account ID, email, signup IP, posting IP, timestamp) are escalated immediately to the National Center for Missing & Exploited Children (NCMEC) via their CyberTipline, and may also be reported to local law enforcement. This escalation is mandatory under U.S. federal law (18 U.S.C. § 2258A) and is not subject to user consent. The escalated report contains only the data necessary to identify the content and account involved.

Account data: Retained until you delete your account. When you delete your account, all personal data (email, username, IP addresses, bio) is permanently erased from the accounts table within the same transaction. The deletion is effective immediately.

Comments: Your comments are retained after deletion, but are anonymized — they are no longer linked to your name, email, or any personally identifiable information. The comment text itself is preserved for platform audit integrity and abuse-history review.

IP addresses: Your signup IP and per-comment IPs are stored for the lifetime of your account for legal compliance purposes. They are erased when your account is deleted.

Login history: We retain a rolling 12-month log of login IP addresses per account for security and law-enforcement compliance purposes.

Moderation audit logs: Do not contain personally identifiable information beyond account ID, and are retained for 12 months.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Delete your account and all personal data directly from your account settings — no email required. Comments are anonymized (no longer linked to your identity) but retained for platform integrity. Deletion is permanent and cannot be undone.
• Portability: Request an export of your data in machine-readable format
• Objection: Object to certain processing activities

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

If you are a resident of the European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR). Our legal basis for processing your data is primarily contract performance (providing the service you requested) and legitimate interest (security and abuse prevention).

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA), including the right to know what data is collected and the right to opt out of the sale of personal information. We do not sell personal information.

We use industry-standard security measures including HTTPS/TLS for data in transit, password hashing (PBKDF2-SHA256), and access controls on our database. No security system is perfect; if you discover a vulnerability, please disclose it responsibly to [email protected].

We may update this Privacy Policy from time to time. We will post the new effective date at the top of this page. Significant changes will be communicated via email to registered users.

For privacy questions or data requests, contact us at [email protected].