Privacy policy

1. Who is responsible

The operator of I Told You So is the controller of the personal data described here. Questions, access requests, and deletion requests go to [email protected].

2. What we collect

• Account data: email address, username, display name, and an account identifier. Passwords are stored by our authentication provider as a one-way hash; we never see the plaintext.
• Guest data: an anonymous session identifier and its display name, so a guest record can later be saved to an account.
• Claim data: topic, claim text, confidence, deadline, participant names, optional context, sources, proposals, outcomes, events, and timestamps.
• Evidence: screenshots you attach to a claim, including the image file and its dimensions.
• Interest messages: if you use the contact or interest form, the message and any email address you choose to leave.
• Technical data: IP address, browser user agent, and request timestamps processed by our hosting and database providers for security and operation.

Some of this data comes from the other participant: they type your name and confidence when they accept a claim. We do not buy personal data or collect it from data brokers.

3. Why we process it

• To provide the service: create accounts, store claims, show them to the right people, send confirmation and reset emails, and let participants settle a claim. Legal basis: performance of a contract.
• To keep the service secure and prevent abuse: rate limits, access control, debugging, and fraud or spam prevention. Legal basis: our legitimate interests in a safe service.
• To answer you: replying to support, privacy, and legal requests. Legal basis: our legitimate interests and legal obligations.
• To send interest updates, if you ask for them: legal basis: consent, which you can withdraw at any time.

4. Cookies and local storage

The site does not use advertising or cross-site tracking cookies. The browser stores the session token, local-only calls, drafts, and a pending sign-in destination inlocalStorage so the app works and so a confirmation link returns to the right page. Clearing site data removes the local copy; an account's server data is not deleted by clearing the browser.

5. Who can see your claims and evidence

New claims are unlisted: anyone with the link can read the claim and its evidence. A private claim is limited to its participants while that option exists. A public claim may be listed in a public section when that feature is enabled.

Evidence files live in a storage bucket with an unguessable path; listing the bucket is disabled, but anyone who has the file URL can open it. Treat a link to a claim or a screenshot as a capability that can be forwarded. Do not upload sensitive material.

6. Service providers

• Supabase: database, authentication, file storage, and realtime updates.
• Cloudflare Pages: hosting and content delivery.
• Resend: transactional email for notifications and, when configured, account email. It receives the recipient address and the message content.

These providers process data on our behalf under their own terms and security measures. We do not sell personal data, and we do not share it for advertising. Data may be disclosed if required by law or to protect the service and its users.

7. International transfers

Our providers may process data in countries other than yours. Where required, they rely on standard contractual clauses or an equivalent safeguard for international transfers. You can ask us for more information about the safeguards used.

8. How long we keep it

• Account and claim data: until you delete the claim or your account.
• Deleted account: the profile, login, evidence, and unanswered invites are removed; claims stay with “Deleted account” in place of your name, and the username is retired.
• Backups: deleted data disappears from backups as the provider's backup window rolls over.
• Technical logs: kept by the hosting and database providers for a short operational period and then aged out.
• Interest messages: kept until handled or deleted.

9. Your rights

Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to processing, receive a portable copy, and withdraw consent. You can also lodge a complaint with your local data protection authority.

Account deletion is self-service in Settings. For anything else, email [email protected]. We may need to verify that the account is yours before acting.

10. Security

Passwords are hashed by the authentication provider. Database access is protected by row-level security and server-side functions; evidence uploads are limited to the creator of a claim. Traffic is encrypted in transit. No service is perfectly secure, so use a unique password and do not put secrets in a claim.

11. Children

The service is not directed at children under 16, or under the age required by local law to use an online service without parental consent. If you believe a child created an account, contact us and we will remove it.

12. Changes to this policy

This policy may change as the service changes. The effective date at the top will move. Material changes will be announced on the site or by email before they apply.

13. Contact

Privacy questions and requests: [email protected].