Community privacy policy
Last updated: October 21, 2026. This covers the Dill community (accounts, forum and direct messages). The ebook has its own privacy page.
Who we are
The community is run by Elijah Ferguson, an individual based in Ohio, USA ("we", "us"). Contact: [email protected].
What we collect
- Account: your username, a one-way hash of your password (we never store or see the password itself), and the date you joined. We don't ask for your email address right now.
- What you post: forum posts and replies. These are public.
- Direct messages: the messages you send and receive, who they're between, when they were sent and whether they've been read.
- Activity: notifications, people you've blocked, and reports you file.
- Technical: your IP address, used only for rate limits (to stop spam and password guessing) and kept for at most one day, plus normal server logs from our host.
- One cookie: a login cookie (
dill_sess) that keeps you signed in for up to 30 days. No advertising or tracking cookies, and no analytics.
We don't collect payment details: the community is free. We don't ask for your real name.
How we use it
To run your account and show your posts, deliver direct messages, keep the community safe (rate limits, spam checks, moderation), and answer you when you contact us. We don't sell your information or use it for ads.
Direct messages
DMs can be seen only by the people in the conversation. If a message is reported, moderators can read that message to review it. Otherwise we don't read DMs, except when the law requires us to, or to investigate a serious safety problem. DMs are not end-to-end encrypted, so don't send passwords or other sensitive information.
Who else handles it
- Cloudflare, Inc. hosts the site and the database (cloudflare.com/privacypolicy).
We may share information if the law requires it, or to protect someone's safety.
How long we keep it
We keep your account data until you delete your account. Rate-limit records are kept for up to one day. Login sessions last up to 30 days. Moderation records (reports and the mod log) are kept to keep the community safe. Deleted data may stay in our host's backups for a short time.
Your choices
- Download your data: as a JSON file, from your account page.
- Delete your account: also on your account page. Your account, messages (both sides of each conversation), notifications and blocks are deleted. Your posts and replies stay in their threads so other people's replies make sense, but their text is wiped and your username is removed.
- Anything else: email [email protected].
Children
The community is for people 13 and older. We don't knowingly collect personal information from children under 13. If we learn an account belongs to a child under 13, we delete it. Parents can email [email protected] to have a child's account removed.
Security
Passwords are hashed with PBKDF2. Logins use a secure, HttpOnly cookie, and the site uses HTTPS. No system is perfectly secure. If something goes wrong, we'll tell affected users as the law requires.
Changes
We'll post updates here and change the date above. If the changes are significant, we'll post a notice in the community.
Contact
[email protected]. This policy is governed by the laws of Ohio, USA.