Privacy Policy

1. Who operates Chirpy

The service operator has not supplied a legal business name, mailing address, or privacy contact. This page does not invent one. “Chirpy” below means the operator of this application. Operator contact information must be configured and published before production so people can direct privacy or safety requests to a responsible contact.

2. Information the service handles

• Discord sign-in and profile: Discord account ID, username, display name, and avatar details returned by Discord’s identity sign-in. The app uses these to create and maintain your Chirpy account and profile.
• Content and activity: your Chirpy handle, display name, bio, posts, uploaded image bytes, comments, internal messages, likes, reposts, bookmarks, poll questions/options and votes, and social notification records for follows, mentions, comments, likes, reposts, and messages.
• Safety and service records: staff role, verification application and decision status, mute or termination status, and moderation audit records needed to administer the service.
• Technical data: the app uses an HttpOnly session cookie and stores session records and short-lived OAuth state in MongoDB. The sign-in cookie has a rolling 30-day inactivity expiration and is removed on sign-out. The hosting platform or network providers may generate technical or request logs according to their own settings; the operator has not configured a public log-retention statement.

3. How information is used

Information is used to authenticate users, operate accounts and profiles, display community content, save messages and interactions, record poll votes, administer moderation and verification, protect service integrity, and respond to operational or legal needs. Discord profile images may be loaded from Discord’s content-delivery network. The application code contains no advertising or analytics feature, but third-party hosting and infrastructure may process technical data under their own terms.

4. Storage, sharing, and service providers

Application records, including account data, user content, image bytes, messages, polls, notifications, and moderation records, are stored in the MongoDB database configured by the operator. Discord handles the authentication flow and supplies identity data; the app does not store your Discord password or retain the OAuth access token after retrieving your identity. The app is hosted on infrastructure selected by the operator. The specific hosting provider, processing locations, and provider retention settings have not been identified on this site. Data may be processed by those providers to deliver their services or as required by law; their own privacy policies apply.

The app does not provide a public directory of recipients or a configured data-sale integration. Content you post or send may be visible to the recipients or users allowed by the feature and may be copied by people who can access it.

External resources

The site loads typefaces from Google Fonts and may load Discord-hosted avatar images from Discord’s content-delivery network. Those providers may receive ordinary connection data, such as your IP address and browser request details, when your browser requests those resources.

5. Retention and deletion

Account and content records are retained in the configured database while the account and service operate. The app currently has no self-service account deletion. A terminated account is disabled and may be reinstated only within 30 days of its current termination. After 30 days, Chirpy purges the account and associated posts, uploaded images, comments, poll votes, messages, notifications, follows, likes, reposts, and bookmarks from the application database. Purge runs periodically, so removal may not happen at the exact deadline.

To prevent a deleted identity or handle from being reused to evade a termination or claim the same handle, Chirpy retains a minimal tombstone containing the reserved normalized handle (if any), the account’s original database identifier, a keyed hash of its Discord ID, termination date, and one-time appeal-use/status and decision-reference metadata. The submitted appeal text and profile/content data are not copied into this tombstone. Moderation audit entries, which can include staff-entered action details such as mute or termination reasons, are retained with account-ID references. These minimal records are not a restored user account and cannot be used to sign in. MongoDB backups, if enabled, and provider logs may retain copies according to provider settings that are not specified here.

One appeal may be submitted within 30 days of a termination. Once used, an appeal is not available again even if an account is reinstated and later terminated. Appeals pending at the 30-day purge deadline are recorded as expired; staff cannot reinstate an account after the deadline.

You may request access, correction, or deletion by contacting the operator, but no contact details or request workflow are currently configured. Requests cannot be reliably processed until the operator publishes a contact method. Applicable legal requirements may affect what can be deleted or retained.

6. Security

The service uses reasonable application measures such as Discord-based authentication, an HttpOnly session cookie, and server-side role checks. No online service or storage system can be guaranteed secure, and the operator cannot promise that unauthorized access, loss, or disclosure will never occur. Avoid sending highly sensitive information through Chirpy messages or posts.

7. Children and COPPA

Chirpy is not intended for children under 13 in the United States, and the operator does not knowingly seek to collect personal information from a child under 13. If the operator learns that a child under 13 has provided personal information, the operator should take steps to delete it. A parent or guardian who believes a child’s information was submitted should contact the operator; contact details have not yet been configured and must be supplied before production. Users must also satisfy Discord’s applicable age requirements.

8. U.S. privacy rights and policy changes

Depending on where you live, state privacy laws may provide rights concerning personal information, such as access, correction, deletion, or opting out of certain processing. The app does not currently implement an automated privacy-request portal. Contact the operator once contact information is published to submit a request; the operator will assess and respond as required by applicable law. This policy may change as the service or its providers change. The updated version will be posted at this URL.