what we keep, and why
Privacy policy
Last updated 12 November 2026
The short version: Unserious exists to keep your group's stuff private. We collect what we need to run it and nothing else. No ads, no tracking or analytics scripts, no selling or renting your data, no training AI on it. Only members of a group can see that group's content.
Who's responsible
Unserious is run by Sulav Maharjan, an individual based in Nepal, who is the controller of your personal data. Contact: hello@unserious.fyi.
What we collect
When you make an account
- Your email address, the name your friends see, and your password (stored only as a one-way hash).
- If you sign in with Google: your Google account ID and the email and name Google shares. We don't store Google passwords or access tokens, and we never read your Google data.
- An optional profile photo, and your settings (like your notebook style).
What you put in Unserious
- Groups, memories, photos, quotes, comments, hearts, polls and votes, nicknames, and invite links you make.
- Your private notebook notes and their photos. Only you can see these.
- Notifications the app makes for you, and when you last looked at each group.
Photos are checked, re-encoded and stripped of location (GPS) and camera data before we store them. They're stored privately and only shown to members of the group (or to you, for notes) through long, unguessable links. Anyone a member passes a link to can open that photo until it's deleted.
If you buy Plus
Dodo Payments collects your payment details and billing address to process the sale; we pass it your email and name so checkout starts filled in. We receive a Dodo Payments customer ID and the subscription's status and dates, so we know which group has Plus. We never see your card number. See Dodo Payments's privacy policy.
Automatically
- Two essential cookies: one that keeps you logged in (it lasts up to two weeks) and one that protects forms against cross-site attacks. No advertising or analytics cookies. Dodo Payments's checkout may set its own cookies when you open it.
- Server logs with your IP address, the page requested and the time, used for security and fixing problems.
- Crash reports, tagged with a random account ID rather than your name or email.
Why we use it
- To run the service you asked for (our contract with you): accounts, groups, showing content to members, notifications, Plus.
- To keep it safe and working (our legitimate interest): rate limits, preventing abuse, fixing crashes.
- To meet legal duties, like tax records (mostly handled by Dodo Payments).
We only email you about your account: verifying your email, resetting your password, and important changes to the service or these policies. No newsletters, no marketing.
Who helps us run it
These providers process data on our behalf, only to provide their part of the service. Some are outside your country (including in the US and EU); where the law requires it, transfers rely on safeguards such as standard contractual clauses.
| Provider | What for | What it sees |
|---|---|---|
| DigitalOcean | Runs our servers (the app and its short-term cache). | Everything the app handles passes through it. |
| Neon | Hosts our database. | Your account, groups and everything you post, except photo files. |
| Cloudinary | Stores and resizes photos. | Photo files (after we strip location and camera data). |
| Cloudflare | Domain, network protection and serving the website. | Your IP address and the pages you request. |
| Resend | Sends account emails. | Your email address and the email we send you. |
| Sentry | Tells us when the app crashes. | Error details and a random account ID. No email, no name, no posts. |
| Dodo Payments | Sells Plus and handles payments, as Merchant of Record. | What you give Dodo Payments at checkout. We send your email and name to start it, and get a customer ID and subscription status back. |
| Only if you choose “Continue with Google”. | Google tells us your email, name and Google account ID. |
Beyond these, we only share data if the law makes us (for example a valid court order), or to protect someone's safety.
How long we keep it
- Your account stays until you delete it.
- When you delete your account, we delete your profile, your notebook, your memories and quotes you added, your comments, hearts and votes, and your group memberships, and we destroy the stored photo files. Groups you own alone are deleted with you; if a group you own has other members, you hand it to one of them first.
- What other people posted stays in their group. That can include a quote with your name as the speaker, or a photo you're in. Use “request removal”, ask the owner, or email us.
- When something is deleted (a memory, photo, group), it's removed straight away. Copies can remain in database backups for up to 30 days before they're overwritten.
- Server logs and crash reports are kept for up to 90 days.
- Billing records are kept by Dodo Payments for as long as tax law requires.
Your rights
Depending on where you live (for example under the GDPR or UK GDPR), you can ask to see the data we hold about you, get a copy of it, correct it, delete it, or object to or restrict how we use it. Much of this you can do yourself in your account settings; for the rest, email hello@unserious.fyi and we'll reply within 30 days. We may need to confirm it's really you. You can also complain to your local data protection authority.
Children
Unserious is for people aged 16 and over. If we learn that someone younger has an account, we'll delete it. If you think that's happened, please tell us.
Security
Everything travels over HTTPS. Passwords are hashed, invite links are stored only as hashes, photos are private and only reachable through signed links, and every group page checks that you're a member. No system is perfect, but if something goes wrong that affects your data, we'll tell you and the authorities where the law requires it.
Changes
If we change this policy in a way that matters, we'll tell you by email or in the app before it takes effect. The date at the top shows when it last changed. See also our terms.