Privacy

The short version

aliinuka works by putting what you said you would do in front of other people. Most of what it stores is content you wrote and chose to share. Beyond that it collects the least it can: a name, a way to reach you, and a password it never stores in readable form.

There is no advertising, there are no tracking pixels, and nothing here follows you to another site. Nothing you do here is sold to anyone, ever.

One measurement script runs, and this is it. Pages report how quickly they loaded and responded — the standard web performance figures — to Vercel, who host this site. It sets no cookie, it does not identify you, and it never sees anything you wrote: the payload is timings, which page you were on, and coarse information about your device and connection. It is there so that a page that has become slow for real people can be found and fixed, and for nothing else. The detail is below.

What you post publicly is public. A goal is public unless you choose otherwise when you post it, and public includes a miss. Search engines are asked not to list goals or profiles, but anybody with the link can read them, and what somebody has read they can copy, screenshot, share and keep. See what that means.

This page describes the code as it stands, and it is re-checked whenever the site changes.

Who is responsible

This site is operated by the operator of this site. If you want to know what is held about you, correct it, or have it deleted, write to the contact address.

What is collected

To have an account at all

The contact you give is not verified and nothing is sent to it — there is no email or SMS on this site at present. It exists so that an account can be recovered and so that you can be reached if something is wrong.

Your streak, and the timezone behind it

Checking in records the day, and your account keeps four numbers counted from those days: your current run, your longest, how many times a run has ended, and the last day you checked in.

These are public. Your profile shows your current run as the largest thing on the page, your longest run and your number of breaks beside it, and a grid of the last 28 days marking which ones you checked in on — which also shows which ones you did not. It is four weeks, one mark a day: no times, no moods, and never anything you wrote. If you would rather not publish that, do not check in; nothing else on the site depends on it.

Streaks together. Your desk shows, for each of your connections, how many days in a row you have both checked in, and whether each of you has today. Your connections see the same about you on theirs. Nothing new is stored for it: it is worked out from the same days the public grid already shows.

Streak freezes. Opening the daily quest chest banks a freeze, two at most, and we keep how many you hold. If exactly one day goes by without a check-in and you have one, it is spent on that day and your run carries on. The day is stored as a check-in marked “covered”, with how long the run it saved was (so your notice can say “your 12-day streak”), and the public grid shows covered days as ice, so anybody reading it can tell a day you checked in from a day a freeze covered. How many freezes you hold is shown only to you. We also note on each chest whether it banked a freeze, so undoing one takes back only what it gave.

Your league division. Each week your XP moves you between seven divisions, from the Alley to the Moon. We keep which division you are in, which week was last counted, and whether that week moved you up or down. Only you see it. It is worked out from your own XP and replaced each week, so there is no history of it.

To count days at all we store the timezone your browser already reports — a zone name like Europe/London, not a location or a coordinate. It is read when you check in, and whenever you are signed in and your browser reports a different zone from the one we have. You are never asked for it, and there is no setting for it. A streak is made of calendar days, and without knowing when your next day starts there is no way to tell a missed day from a day that has not happened yet, to show you today’s date and today’s steps, to print times on your own clock, or to end a deadline or a league week at your midnight. It is never shown to anyone.

Your reminders

A reminder you set is kept as what you wrote and the time you picked, with when it went off and when you closed it, so it goes off once. Only you see it. It shows on the site at that time, and, if you have turned notifications on, is sent to your browser then — so what you wrote can show on your lock screen. A closed reminder stays on your list for a week; you can remove any of them, and they go with the account. If you mute your reminders, we keep the time they come back on, and none is shown or sent until then.

Your XP and rank

Doing things here earns XP: checking in, finishing a step, signing somebody’s goal, and above all a goal a witness confirmed you kept. Each reward is one row — what kind of thing it was for, which one, the points, and the day. Every row points at something already described on this page, so it records nothing new about you; it is the same history, counted.

Your total XP and the rank it makes are public, on your profile. The list of what earned it is shown only to you. Your daily quests are worked out from that same list and are shown only to you. The XP you earned this week is shown to everybody signed in here, with your name and picture, in the weekly league, which ranks everyone who earned XP that week. If you turn the game off in settings, you are left out of everybody else’s league. Your browser also keeps the last total it showed you, so it knows when to celebrate; that stays on your device and is described on the cookies page.

XP sent to you. The people who run aliinuka can send somebody XP, with a short note if they like. We keep how much, the note, who sent it, when, and when it reached you: it waits until you next open your desk, which pays it and shows it to you. Only you and the people who run the site see it, and it goes with either account.

If your account is stopped

An administrator can lock an account — for spam, for a breach of the terms, or because you asked for it. Locking records when it happened, who did it, and a short reason on your account row. While it is locked you are signed out everywhere and neither your passphrase nor a recovery code will let you back in. Locking does not take your goals off the record; that is a separate act, and it is done to individual goals rather than to a person. It can be undone, and undoing it erases all three of those fields.

If you choose to add it

A display name, a short bio, and a profile picture. All three are optional and all three are public. The picture is resized in your own browser before it is sent and is stored with your account.

What you write in the product

Goals and their deadlines, the steps under them, notes, signatures you give and receive, nudges, private messages, daily check-ins including the mood you pick, written reflections, groups you join, team goals and their daily checks and chat, forfeits, and any focus sessions from before the focus timer was retired. Who can see each goal is your choice at the time you make it: anyone, only people you are connected to, or nobody.

The steps on your path are separate and are never public: what you are doing today, the cue you tied it to, any note you keep with it, your estimate and what it actually took, the time of day it is for, the times you set for finishing one of them or the whole day’s list, and the names of any sections you file them under (“Work”, “School”). For a routine we also keep how often it comes back (every day, weekdays, the days you picked, or a number of times a week), whether you have paused it, and the days its step went undone, which your goal shows as missed. A step has no visibility setting because it has no audience but you.

Your goals are private on the same terms. For each goal you set we keep the part of your life it is about, what you wrote for where you want to go and for the daily step, when you started it and when you set it aside, and the days you marked the step done. Nobody else can see any of it: not your connections, not a witness, not your profile’s visitors, and not an administrator’s ledger. It is used for one thing, showing it back to you, and it is in your data download. The one exception is yours to make: in Ask Chester you can switch on “Use my goals”, and then they go with your questions to OpenAI, as Ask Chester says. If you rated the parts of your life on the compass before it was retired, we still keep those scores (1 to 5 for each of eight parts, and the day you rated them), on the same private terms; nothing new is asked or written, they are no longer shown on any page, they are in your data download, and they are deleted with your account.

Your desk is private on the same terms. For each step you add we keep what it is, the day, the part of your life it is for and the goal it belongs to, if any; for each goal, how many days a week it aims for and whether you picked that by hand or left it to its steps, and, if you gave it a number (12 books, 5 km), the number, its unit and how much you have logged; and a pace setting (gentle, steady or all-in), which is no longer shown or used. If you answered the desk’s question of the day before it was retired, we still keep the question, your answer and the day; nothing new is asked or written, and the answers are no longer shown on any page. Nobody else can read any of it, it is in your data download, and it is deleted with your account.

The daily check-in is private too. The first time you open your desk each day it asks how you are, on five points from “Rough” to “Great”, and we keep the answer and the day. It is not shown on your desk and does not change it. It is used to draw “Your days” on your own profile: how your check-ins have gone, week by week and month by month, so you can see whether things are getting better. Nobody else can see your moods or that trend: not your connections, not your profile’s visitors, and not an administrator’s ledger. The public streak grid shows only that a day was checked in, never how you said it was. Your moods are in your data download and are deleted with your account.

The questions Chester asks before you join are private on the same terms. While you answer them nothing is sent to us: the answers are kept in your own browser tab (see the cookies page) and come with the join form when you tap “Join the club”. Then we keep, with your account: the name you gave Chester (as your display name), today’s check-in, the part of your life you picked and the goal you picked or typed in your own words (as your first goal), and the first step you settled on, which you do there and then (as today’s step, done). Your pace starts as gentle. The answers are used to write your first path and today’s step. Nobody else sees them: not your connections, not your profile’s visitors, not an administrator’s ledger. They are in your data download and are deleted with your account. Before your desk opens the first time you sign a pledge, by drawing: we keep the drawing and when you signed, show it back to you, and show it to nobody else. It is in your data download and is deleted with your account. An account made before these questions keeps what it answered then: what brought you here and the parts of life you said matter most; one that answered an earlier version of them keeps those answers too (how each part of life was going, the goals picked and why the first mattered, what gets in the way, a normal day, pace, how Chester talks and whether Learn about me is on), and with “Use my goals” on, what gets in the way goes to OpenAI with your question. When you clear your notices we keep the moment you did, so the list knows what to leave off.

Whether an administrator has enabled the lockdown and the wheel for your account (they are off for everybody else), and whether you have turned lockdown on, are stored with your account and shown to nobody but you and an administrator. If you miss a goal under it and your account is frozen, we keep what the two wheels landed on — the forfeit, who wrote it if a connection did, and how many days you were given — and the proof you hand in: what you wrote and one photo, resized in your own browser before it is sent. The proof is private to you. Nobody else can read it, and it is deleted with your account.

The face tab is off for everybody unless an administrator enables it for your account (administrators have it), and even then it is hidden until you show it in settings. If you use it, your photos -- the front and each side -- are read in your own browser, where the shape of your face is measured. When you save, small copies of the photos are sent to OpenAI, whose model rates them out of ten, writes a few notes on them and suggests haircuts that would suit your face; nothing else about you is sent with them, not your name or your account, and OpenAI is asked not to keep them. What is stored, one row a day: that rating and its notes and haircuts, with the name of the model that gave it; the measurements (ratios and angles, such as how symmetric your face is, how far apart your eyes are, the angles of your profile, which way each feature sits or leans, and an estimate of how dark the skin under your eyes is against your cheeks), what the front photo showed of your skin (where each red spot or dark mark is on the photo, the patches redder than your usual tone, and how even, textured and shiny it looked -- numbers, never a copy of the photo), how the front photo was taken (how far your head was turned, how close the camera was, how evenly it was lit, how sharp it was and whether you were smiling, so days can be compared), whether you asked for it to be rated as a man’s or a woman’s face, and, unless you untick it, a small copy of each of the three photos. The under-eye estimate and the skin reading are readings of the photo’s light and colour, not a health measurement or a diagnosis. They are private to you: nobody else can see them, administrators included. Measurements of a face can count as biometric data, so they are used for nothing but rating them and showing them to you: never to recognise or identify anybody, and shared with nobody but OpenAI, for the rating. You can delete any day, or all of it, on the tab itself; they are in your download, and deleted with your account.

If you join a team goal in one of your groups, your part of it is an ordinary goal, and everybody on that team can see it, your daily answer to “did you work on your part today?” with any line you add, and the last fourteen days of those answers — whatever the part’s own visibility, and whether or not they are your connections. You are told this before you join. The team chat is readable by the team and nobody else. If the team has a checklist, the team sees which items on it you have ticked. Leaving the group takes you off its teams; deleting the group deletes the team goal and its chat, but never your part.

If you are in a group chat, everybody in it can read what you say there and see that you are in it, whether or not they are your connections — you can only be added by somebody you are connected to. We keep who is in each chat, when each of you last read it, its name if it has one, and what was said. Leaving says so in the chat; what you wrote stays for the people still in it until your account is deleted.

In a private thread, a group chat or a team chat, anybody in it can put one emoji on a message, and everybody in it sees who put which. Under the last thing you sent, the people you wrote to see whether it has been delivered — which means you have opened a page on this site since — and whether you have read it, which means you opened the thread. In a group chat that says who has read it, by name. Read receipts are on unless you turn them off in settings, and they work both ways: turn them off and nobody sees when you read, and you stop seeing when they do. “Delivered” is always shown. While you type in a thread, the people in it see that you are typing: we note it for five seconds at a time and delete it when you send. What you have typed is not sent until you send it.

Your statistics — the numbers on your Profile: your streak and check-ins, how many steps you have taken, how many goals you have and how many are on pace, your goals, your XP and rank, and your badges — are shown only to you. If you choose “Show on my public page” in settings they are shown on your public page too, as numbers only: never what a goal or a step says, and never how your days have gone. That choice is stored with your account and is off until you make it.

Which day your week starts on (Monday, unless you choose Sunday in settings) is stored with your account. It only decides where your weeks begin; nobody else sees it.

Whether you have turned the game off in settings (XP, ranks, the streak, quests, the league and the board) is stored with your account. It only changes what you are shown; it is not shown to anybody else, and nothing stops being counted.

Anybody who can see one of your goals can cheer it, and you can cheer theirs. We keep who cheered what and when. Anybody who can see the goal sees how many cheers it has and who the latest three came from; you are told who cheered. A cheer can be taken back, and takes its name off the goal with it.

Which pages you keep in your dock is stored with your account, so it follows you to any device, and is shown to nobody.

If you sent an idea for improving this before ideas were retired in October 2026, it is still stored with your username and any answer it was given. It is no longer shown anywhere on the site, the Admin Panel included; it is in your download, and deleted with your account.

If you report a goal or a person, the report is stored with your username, what you reported, the reason you picked and any detail you wrote, and when. Only an admin can read it, together with which admin closed it and when. The person you reported is not told who reported them. If you delete your account, your name comes off the report and the report stays; if the thing you reported is deleted, the report goes with it.

Please do not write health, financial or other sensitive details into a goal, a reflection, a direction or a check-in. These fields are free text and are stored as you typed them. They are not analysed, but they are not the right place for information you would not want a witness to read. If you rated parts of your life such as sleep, mind and money on the compass before it was retired, each number from 1 to 5 you chose is still stored, shown to nobody, and deleted with your account.

If you set up account recovery

Only a one-way digest of each recovery code is kept. The codes themselves are shown once, when you make them, and stored nowhere — which is why nothing here can show them to you again, and why nobody operating this site can read them either.

Technical records

A session record — a random token and an expiry date — so you stay signed in, and the date you last signed in: one timestamp, replaced each time, which only an administrator sees. It is not a record of your visits; nothing here keeps one. After five wrong passphrases in a row, signing in to your account is paused for fifteen minutes: for that, the account holds a count of wrong passphrases and when the pause ends, both cleared the next time you get in. Nothing about who typed them is kept. The one exception was the editor’s journal, a private page only two accounts could open, now retired: for those two, the site still holdswhen they last opened it and where its “new” began — two timestamps, no longer written or shown anywhere. The site itself keeps no logs of IP addresses, no device fingerprint, and no location data. The companies that host the site and the database handle network information such as your IP address in the ordinary course of serving a request; that is described below.

An operator’s log. When an administrator acts — takes a goal off the record, locks or deletes an account, closes a report, or opens the admin page, which shows every account’s contact — a line records who did it, what, and when. So do the things you do to your own account: signing out your other browsers, downloading your data, and deleting the account. So does every connection an agent makes, each thing it does (which action, and whether it worked; never what it wrote), each time it reads the account, and its end. Each line holds internal ids and a time, never a name, a title or a contact, and is never edited. Only administrators read it; your download includes the lines about you. It is how somebody can check what was done to an account, and by whom.

What is deliberately not collected

• No analytics about you. Nothing counts your visits, builds a profile, or records what you looked at. The one measurement script is described under how page speed is measured, and it reports how fast a page was, not who was on it.
• No advertising, and no advertising identifiers.
• No tracking cookies. See the cookie policy.
• No embeds, iframes or tracking pixels.
• Nothing that follows you to another website. No third party here sees you anywhere but here.
• No fonts fetched from another company while you browse. The typefaces are downloaded when the site is built and served from the same place as the site, so your browser never contacts a font provider.
• No payment details. Nothing on this site takes money.
• No data bought from or sold to anyone. There is no sale or sharing of personal information as those terms are used in US state privacy laws.

How page speed is measured

This site uses Vercel Speed Insights. Vercel already host the site, so they already receive every request your browser makes; this reports something they would not otherwise see, which is how the page actually behaved once it reached you.

What is sent:

• Standard web performance timings — how long the largest thing on the page took to appear, how quickly it responded when you interacted with it, and how much the layout moved while loading.
• Which page you were on, and where you arrived from if that was another page here.
• Coarse information about the browser, the kind of device, and the speed of the connection.

What is not sent:

• Nothing you wrote. No goal, note, message, reflection, step or idea, and no part of one.
• No account identifier. Signed in or signed out, the report is the same and does not say who you are.
• No cookie and no browser storage. It stores nothing on your device, which is why this did not add a consent banner.

It cannot follow you to another website, and the figures are only ever looked at in aggregate — the point of them is to notice that a page has become slow, not to look at a visit. If you would rather send nothing at all, blocking the request in your browser or an extension costs you nothing here; the site works identically without it.

Notifications

Off unless you turn them on, in settings, for one browser at a time. On an iPhone or iPad they only work once aliinuka is on your Home Screen (Share, then Add to Home Screen); adding it is done in Safari and stores nothing about you here. Turning them on asks your browser for permission, and we keep what your browser’s push service needs to reach it: an address at that service and two keys. With it we send three things — at 8pm where you are, if your streak is running and you have not checked in (“Your 12-day streak”); when somebody writes to you while you are not on the site: their name and what they wrote, cut to a line or two; and a reminder you set, at the time you set it, with what you wrote in it. That means a message can show on your lock screen, so leave notifications off on a device other people see. We also note the day the streak reminder last went, so it goes once.

A notification travels through the push service run by your browser’s maker (Google for Chrome, Mozilla for Firefox, Apple for Safari), encrypted to your browser, which is the only way a browser can be reached when the site is not open. Turning notifications off removes the subscription, and so does deleting the account. Blocking them in your browser ends it at your browser’s end, and we forget it the next time the push service says it is gone.

Agents

An AI agent can act on this site only as an administrator or as a testing session (a throwaway account) an administrator started, never as your account. It gets in with a private code that only administrators can see and that changes every thirty minutes, and it gets one hour. When the hour is up, or an administrator ends it sooner, it is put out. What it created, changed or deleted stays, as anything that account did would, until the administrator deletes the testing session, which deletes its account and everything on it. Nothing a testing session posts is ever public: at most its connections can see it, and its profile page is shown only to itself and administrators.

While it runs we keep which account it acts as, when its hour ends, a one-way digest of its token, and a list of the rows it created, to count them. That list is deleted when the agent ends, and we note why it ended (its hour was over, the code was changed, an administrator ended it), which is what the agent is told if it tries its token again. The rest of the record, the digest and that reason included, goes when its hour would have, because it is also what stops the code that let it in from being used again.

Ask Chester

Ask Chester is an AI assistant with the raccoon as its face. The answers are written by a model from OpenAI, and when it needs to look something up it searches the web with Brave Search. It is only used when you open it and ask something. If you connect your own API key in Settings, under “AI integrations”, the answers come from that company instead — OpenAI or Anthropic — and everything below that says “to OpenAI” goes to them, under your own account with them.

• To OpenAI: what you type and Chester’s earlier answers in the same conversation, and the results of his searches. Only if you switch on “Use my goals” beside the box, also what brought you here, the parts of life you said matter most, your live directions with their daily steps and why they matter to you, what you said gets in the way, and your open steps for the coming week (what each says and which day it is on), so he can move or finish one when you ask. Not your name, username, email or phone. We ask OpenAI not to store the conversation for later use (store: false); what it keeps, and for how long, is then set by OpenAI’s own terms for its API.
• “Suggest with Chester” on a new goal: only the goal you are setting — its name, part of life, number and date — goes to OpenAI (or your own key’s company), to suggest steps for it. Nothing else about you. It counts as one question toward the daily limit, and his ideas are not kept unless you add them.
• Your own API key: if you connect one, we check it with its company, then store it encrypted, readable only by this site’s servers and only to send your questions to that company. It is never shown again, to you or anyone: the page shows its last four characters. We also keep which company it is, the model you picked, when it was last checked, and the time of each check (to limit checks). That company bills you for every answer under its own terms; aliinuka never sees the bill. “Disconnect” deletes the key here, and deleting your account deletes it too; to stop it working altogether, delete it on the company’s own site.
• To Brave: only the search words Chester writes, which he is told never to fill with anything personal about you. Not who is asking.
• Never sent anywhere: the simple commands — “add gym at 7 tomorrow”, “move my CV step to Friday”, “done with the walk”. They are understood on this site, without the AI, and do not count toward the daily limit.
• What he can change: when you ask, Chester adds, moves or finishes your steps and sets reminders, and each change shows as a card with an Undo. Anything he only suggests changes nothing until you tap it. Those steps and reminders are kept like any you add yourself.
• Quick chats are not kept. A quick chat lives in your open page and ends when you leave it or start over. We keep only the time of each question, which AI answered it (aliinuka’s or your own key, and the model) and how many tokens it took, to count the daily limit and watch what Chester costs; that is in your data download.
• Focuses are kept. A focus is a chat you choose to keep (“New focus”, or “Keep as focus” on a quick chat): we store its name, the part of life it is about, and every message in it, yours and Chester’s, with the cards he showed, so you can come back to it and he remembers it. Only you can open a focus. Delete one from its menu and everything in it is gone; they are all in your data download and are deleted with your account. A focus’s earlier messages go to OpenAI with each new question, as a quick chat’s do.
• How he talks: the style and answer length you choose in his panel are kept with your account and change the instructions he is given; nothing else.
• Learn about me is off until you turn it on. While it is on (in Chester’s panel, or on “What Chester knows about you”), Chester keeps short notes from your chats, quick chats and focuses alike — about your life, what matters to you, your goals, what gets in the way, what helps and what hasn’t, and similar topics — and a few lines he calls his read on you. Each note says whether you told him, it is a pattern he has seen in more than one chat, or it is his guess; which focus it came from; and when. He keeps nothing about your physical or mental health unless he asks first and you say yes. Only you can see them, on “What Chester knows about you”, where you can correct, confirm or delete any of them, a whole topic, or all at once. We keep at most 200; past that the one least worth keeping goes (an unconfirmed guess first, never before something you told him). While it is on, with each question you ask him the notes that bear on it (at most 18) and his read go to OpenAI, whether or not “Use my goals” is on, so his answers fit you. Turning off “Let Chester guess” deletes his guesses, patterns and read and stops him making more; turning off Learn about me stops him keeping notes and deletes every note and his read at once. They are in your data download and are deleted with your account.

Chester is an AI and can be wrong. He is not a doctor, a therapist or an emergency service: if you are in danger, contact your local emergency number.

Who else touches it

Two kinds of company, both because the site cannot run without them, and neither is permitted to use your information for their own purposes:

• The hosting provider, which runs the site, receives each request your browser makes, including your IP address, and receives the speed measurements described above.
• The database provider, which stores everything described above.

Only if you use Ask Chester, OpenAI and Brave, which receive what Ask Chester says and nothing else — or, if you connect your own Anthropic key, Anthropic in OpenAI’s place, under your own account with them. And only if you have and use the face tab, OpenAI, which receives the photos to rate, as the face tab says.

And, only if you turn notifications on, your browser’s push service, which carries each notification to your browser. It receives the notification’s title, one line and the page it opens, encrypted so that only your browser can read them.

Nobody else. Information may also be disclosed if the law requires it, or to deal with a safety problem or a serious breach of the terms.

How long it is kept

For as long as the account exists. Sessions expire on their own. You cannot delete a goal yourself. An administrator can take one off the record, or delete it permanently, if you ask at the contact address below.

You can delete your whole account yourself, in settings under “Delete your account”. It asks for your username and your passphrase, typed, and then deletes the account and everything attached to it at once. If you cannot get in, ask at the contact address and it will be done for you.

What you can ask for

These are offered to everyone who uses the site, wherever you live, rather than only to people a particular law happens to cover:

• A copy of what is held about you. You can download it yourself, as one file, in settings under “Your data”. It leaves out your passphrase hash, session ids, recovery-code digests and push keys, which are keys rather than information about you.
• Correction of anything that is wrong — most of it you can edit yourself in settings.
• Deletion of your account and its contents.
• An explanation of anything in this document that is unclear.

Write to the contact address. There is no charge and you will not be asked why.

Deletion is real and it is permanent. It removes your account, every goal you posted, your steps, check-ins, reflections, compass readings, directions, the steps on your path, reminders, ideas, XP sent to you and recovery codes — and it also removes the things you put on other people’s pages: signatures you gave, notes you left, nudges you sent, forfeits you wrote for someone’s wheel, and your messages. There is no copy and nothing is kept back, except one line in the operator’s log (below) saying that an account was deleted and when, under an internal id that no longer points at anything — not your username, not your contact.

Two limits worth being straight about. A goal somebody else posted stays theirs: if you confirmed it for them, it stays confirmed and simply loses your name from it — their kept goal is not yours to undo. And deleting your account cannot rewrite other people’s memory of having witnessed something.

Security

Passwords are hashed with argon2id. Sessions are random 256-bit tokens in a cookie that JavaScript cannot read, and which is sent only over HTTPS in production. Only a one-way digest of each token is stored, so a copy of the database could not be used to sign in as anybody. Whether a given goal is visible to a given person is checked in the database query itself rather than by hiding it in the page, so a private goal is not merely unshown — it is not sent.

No system is perfectly secure, and this one is built and run by one person. If you find a problem, please write to the contact address before telling anyone else.

What we are not responsible for when you post publicly

Choosing who can see a goal is yours to do, and so is what you write in it. Once something is public, aliinuka cannot control what other people do with it. To the fullest extent the law allows, we are not responsible for:

• anybody copying, screenshotting, sharing, archiving or quoting what you made public, here or anywhere else;
• embarrassment, or harm to your reputation, relationships, schooling or work, from a goal, a miss, a note or a profile you made public;
• people you did not expect seeing it — family, classmates, an employer, a stranger — or what they do about it;
• search engines, archives or link previews that keep a copy despite being asked not to;
• personal or sensitive details (health, location, other people) that you chose to put in something public;
• what other users write about you or to you, and any forfeit, dare or stake you agree to with them.

If you are unsure, post it as visible to your connections or to just you. Visibility can be widened later; it cannot be narrowed. If something public puts you or somebody else at risk, report it and an administrator can take it off the record.

Children

You must be at least 18 years old to hold an account. Accounts are not knowingly created for anyone younger, and if one comes to light it will be deleted. If you believe somebody under 18 has an account here, please say so at the contact address, or use the Report link on their profile and choose “A child’s safety” — those reports are read first.

The minimum age may be lowered in the future. If it is, this page will say so before the change takes effect, and will set out what is different for younger users — what they can post, who can see it, and how a parent or guardian can ask for an account to be deleted — before any younger person can sign up.

Where the data is

The site and its database are hosted in the United States. If you use aliinuka from outside the United States, what you write is stored there.

Changes

The date at the top changes when this document changes in substance. It is reviewed whenever the site is changed in a way that affects what is collected. If a change materially affects you, it will be said on the site rather than slipped in.