Privacy policy

Last updated 22 September 2026

This policy explains what Exceptionerror (“we”, exceptionerror.com) collects, why, and the choices you have. We collect only what the site needs to run.

What we collect

• Account details. Your display name and email address. The email address is stored encrypted, plus a keyed one-way fingerprint used only to find your account when you sign in; it is never shown to other members. If you sign up with a password, we keep only a salted, peppered Argon2id hash of it — never the password itself.
• Sign in with Google. If you choose this, Google tells us your name and email address. We never see your Google password and receive no other Google data.
• What you post. Posts, comments, images, votes, and your friend, follow and group relationships. Photos have their location and camera details (EXIF metadata) removed when they are uploaded, so those are never stored or shown.
• The Android app. If you use our Android app, Google AdMob may collect device and advertising data to show ads (see “Ads in the app” below). We also keep, for each phone you sign in on: a sign-in token (stored encrypted on your phone; we keep only a one-way hash of it), the phone’s make and model so you can recognise it in your list of signed-in devices, and — only if you allow notifications — its Firebase Cloud Messaging device token (see “Mobile app and notifications” below).
• Messages. The private messages and pictures you send, who is in each conversation, when messages were read, and the people you have blocked (see “Messages” below).
• Reports. If you report a post, comment or message, we keep who reported it, what was reported, and any reason you give, so administrators can review it. We don’t tell the person you reported.
• Security records. Sign-in and account events are logged with a time and one-way hashes of your IP address and browser type. The IP hash includes the date, so it cannot be used to follow you across days. Our web server also keeps standard access logs (which include IP addresses) for security and troubleshooting, for a limited time.

Cookies and local storage

• A session cookie that keeps you signed in. It is essential, HTTP-only and not used for tracking.
• A short-lived cookie during Google sign-in to protect against forged requests.
• A random ID in your browser’s local storage, used by the voting feature while you are signed out.
• Advertising cookies set by Google and its partners (see “Advertising” below).

If you install the site as an app, it stores a single offline page so it can tell you when you have no connection. Nothing else is cached.

What is public

Posts in public groups and on profiles whose owner switched Public profile on can be read by anyone without an account and may be found by search engines. Private groups and private profiles are visible only to the people you allow. Public pages show your display name and posts — not your email address. Signed-in members also see this same public content gathered into an Explore feed — it does not make anything visible that wasn’t already public.

Messages

Direct and group messages are visible to the people in that conversation. They are stored on our server in readable form — they are not end-to-end encrypted, so our systems can technically access them. We do not read or browse them, and administrators have no screen for doing so. An administrator sees a message only if someone in the conversation reports it, together with a few messages before it for context.

Pictures sent in messages are kept in private storage and are shown only to people in that conversation. Deleting a message removes its text and pictures for everyone and leaves a “message removed” note. Someone who isn’t your friend can send you one message request, which you can accept, ignore or block. Ads are never shown in messages.

Mobile app and notifications

If you use the Android app and allow notifications, we store your phone’s Firebase Cloud Messaging token with your account so we can tell your phone that something new has arrived. Notifications travel through Google’s push service (Firebase Cloud Messaging). What we send through Google contains only internal identifiers — for example, that one particular conversation has something new — and never the text of a message, anyone’s name, or a picture. When your phone receives that, the app asks our server for the details using your own sign-in and builds the notification on your phone. Google can see that your device received a notification and when, but not what it was about.

We remove your device token when you sign out of the app, use “sign out everywhere”, or your sign-in ends, and we stop sending to a phone the moment that happens. You can also turn notifications off in your phone’s settings at any time. A message request from someone who isn’t your friend is announced without showing what it says.

Ads in the app

The Android app may show ads in the feed, provided by Google AdMob. Ads are never shown in private messages. To choose and show ads, Google may use your device’s advertising ID and information such as your IP address, device type and the ads you have seen or tapped. In the European Economic Area, the United Kingdom and other places that require it, the app asks for your consent before requesting ads and lets you review your choice later in Settings. You can also reset your advertising ID or opt out of ad personalisation in your phone’s Android settings. We do not share your account details, posts or messages with advertisers.

Advertising

We show ads provided by Google AdSense. Google and its advertising partners use cookies and similar identifiers to show and measure ads, and — where the law and your choices allow — to personalise them using your activity on this and other sites. Google may also read the content of the page you are viewing to pick relevant ads. In the EEA, the UK and Switzerland you will be asked for your consent before personalised ads are used, and you can change it at any time.

See how Google uses information from sites that use its services, and manage your ad preferences at adssettings.google.com. We do not give advertisers your email address, your name or your posts. Ads are labelled “Advertisement”.

Who we share data with

We do not sell your data. A few services process data on our behalf: our hosting provider (where the site and its database run); Resend, which delivers the verification and password-reset emails we send you; and Google, for sign-in, for ads as described above, and for delivering app notifications and ads as described in “Mobile app and notifications”.

Your choices

• Edit or delete your own posts and comments at any time.
• Keep your profile private, or make it public and switch it back whenever you like.
• Delete your account from the account menu (or the app’s Settings) — the steps are on the account deletion page. It is deactivated straight away and permanently erased after 30 days (sign in during that time to restore it). Erasing removes your email address and display name and cannot be undone. Posts, comments and messages you have not deleted may remain, shown as from “[deleted]” — delete them first if you want them gone.
• Delete any message you sent, and block anyone from messaging you, at any time.
• Depending on where you live you may have the right to ask for access to, correction of, or deletion of your data.

Children

The site is not intended for children under 13, and we do not knowingly collect their data.

Changes

If we change this policy we will update the date above. Material changes will be announced on the site.