Privacy Policy

1. Overview

RegretWall is designed to be as private as possible. There are no user accounts, no email collection, and no behavioral tracking. This policy explains the limited data we do collect, why we collect it, and how it is used.

This Privacy Policy applies to all users of regretwall.com, regardless of location, including users in the Philippines (covered by Republic Act 10173, the Data Privacy Act of 2012), the European Union (covered by GDPR), and California, USA (covered by CCPA).

2. What We Collect

Content you submit

When you post a regret, we store: the text of your submission, an optional topic category, and an optional recipient name. This content is publicly visible to all visitors and indexed by search engines. Do not include sensitive personal information about yourself or others in your submissions.

IP address (hashed)

When you submit content, flag a post, or react to a regret, we process your IP address. We immediately convert it to a one-way cryptographic hash (SHA-256 with a server-side salt) and store only the hash — never the original IP address. This hash cannot be reversed to identify you and is used solely for:

• —Rate limiting to prevent spam and abuse
• —Deduplicating flags so one person cannot flag the same post multiple times
• —Deduplicating reactions ("felt this") to prevent manipulation

Technical / server logs

Our hosting provider (Vercel) and network protection service (Cloudflare) may collect standard server access logs including IP addresses, browser type, and page requests as part of normal infrastructure operation. These are governed by their respective privacy policies and are not controlled by us.

3. What We Do Not Collect

• —Names, email addresses, or any account information
• —Precise location data
• —Tracking cookies or advertising identifiers
• —Device fingerprints or cross-site behavioral data
• —Social media profile information
• —Payment information (the Service is free)

We do not use Google Analytics, Meta Pixel, or any third-party behavioral tracking scripts.

4. How We Use Your Data

Data collected is used only to operate the Service:

• —Submitted text and recipient names are stored and displayed publicly as part of the Service
• —IP hashes are used for abuse prevention, rate limiting, and deduplication as described above
• —We do not sell, rent, share, or monetize any user data
• —We do not use your data for advertising or profiling
• —We do not share data with third parties except as required to operate the Service (see Section 5)

5. Third-Party Services

We use the following third-party providers to operate the Service. Each has their own privacy policy:

• —Supabase — database and storage. Submitted content and IP hashes are stored on Supabase infrastructure. Data may be hosted in the US or EU depending on Supabase's configuration.
• —Vercel — web hosting and serverless functions. Processes requests and may retain server logs.
• —Cloudflare — network protection and DNS. May process IP addresses and request data as part of DDoS protection and CDN services.

We do not control the data practices of these providers. We have chosen providers who maintain high privacy and security standards, but we encourage you to review their respective policies.

6. Data Retention

Publicly submitted content (regrets, replies) is retained indefinitely as part of the public record of the Service, unless removed by us for policy violations. IP hashes are retained for as long as necessary for abuse prevention purposes.

Because there are no user accounts, we have no way to identify which submissions belong to a particular person based on a deletion request alone. If you can provide specific information identifying your submission (e.g., the exact text and approximate date), we will review removal requests on a case-by-case basis.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• —Right to be informed about how your data is used (this policy fulfills that)
• —Right to access data we hold about you
• —Right to correction of inaccurate data
• —Right to erasure ("right to be forgotten")
• —Right to object to processing
• —Right to data portability

To exercise any of these rights, contact us at the address below. Note that because we do not collect identity information, we may be limited in our ability to fulfill certain requests without additional identifying context about your submission.

Philippine users may also file a complaint with the National Privacy Commission (NPC) at privacy.gov.ph if you believe your data rights have been violated.

8. Children's Privacy

RegretWall is intended for users 18 years of age and older. We do not knowingly collect any information from minors. If you believe a minor has submitted content to our Service, please contact us and we will remove it promptly.

9. Security

We implement reasonable technical measures to protect data, including one-way hashing of IP addresses, HTTPS encryption in transit, and access controls on our database. However, no system is completely secure, and we cannot guarantee absolute security of data transmitted over the internet.

10. Anonymity Limitation

RegretWall does not link posts to identifiable users. However, we cannot guarantee complete anonymity. Your submission is publicly visible and may be shared, screenshot, or linked to by others. Search engines may index your submission. The content of your submission itself — if it contains identifying details — may be traced back to you. Submit only what you are comfortable being permanently public.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The effective date at the top of this page will reflect any changes. Continued use of the Service after updates constitutes acceptance of the revised policy.

12. Contact

For privacy-related questions, data requests, or content removal, contact us at: hello@regretwall.com

We are based in the Philippines and operate under Philippine law.