What we store, and who can see it
Written in plain language on purpose. If any of this is not true of the running system, that is a bug — please report it.
The short version
Other students see your username and your profile. Nothing else. The platform additionally holds an encrypted copy of your email address, which stays sealed unless someone reports you for abuse or illegal activity.Everything on the server
| What | How it is stored | Who can read it |
|---|---|---|
| Username | Plain text | Everyone on the platform |
| Profile (gender, preference, bio, interests) | Plain text | Other students who can see you in Discover or Search |
| Year of study | Stored as the intake year from your student number, not as something you typed. Your year is worked out from it each time it is shown. | Other students, on your profile |
| Password | Argon2id hash with a per-password salt and a server-side secret. Not reversible. | Nobody, including the administrator |
| Email address — searchable copy | HMAC-SHA256 fingerprint. One-way; it can confirm an address you already know but cannot be turned back into one. | Nobody |
| Email address — sealed copy | AES-256-GCM, under a per-user key that is itself encrypted with a master key kept outside the database. | The administrator, only through the break-glass flow described below |
| Messages | AES-256-GCM, encrypted at rest and tied to the conversation they belong to. | You and the person you are talking to |
| Messages captured on an abuse report | Copied at the moment a report is filed, encrypted the same way. | A moderator reviewing that report |
| Login sessions | Only a SHA-256 of the session token. A database leak cannot be replayed as a login. | Nobody |
| IP addresses | Never written to disk. Rate limiting uses a keyed fingerprint instead. | Nobody |
What we deliberately never ask for
Your real name. A photograph. Your phone number. Your faculty or programme — that one is deliberate: faculty plus year of study plus gender would narrow most students down to a handful of people, which would make the anonymity decorative. Year of study on its own is broad enough to be safe.
Being found
Other students can search for you by username, year of study, or gender. Those are exactly the three things shown on every profile — there is nothing you can be filtered by that is not already visible, because a filter matching on something hidden would let people work it out.
If you block someone, you stop existing as far as they are concerned: your profile returns the same “not found” page as a username that was never registered. They are not told they have been blocked, because being told is itself information.
Deleting a message
Unsending deletes the row from the database for both people. There is no hidden copy, no “deleted message” placeholder, and no column that could be flipped to bring it back — a tombstone would still reveal that something was said and withdrawn, which is most of what a deleted message gives away.
The one exception: if somebody had already reported that message, the copy attached to their report survives. Otherwise anyone could send something abusive, wait for the report, and delete the evidence — making the delete feature the thing that defeats moderation.
The break-glass flow
There is exactly one path from a username to a real identity, and these constraints are enforced by the software, not by policy:
- — It requires an administrator account.
- — It must reference a specific report against that specific person. There is no search-by-username, and no bulk export.
- — A written reason of at least twenty characters is required, and is stored word for word.
- — The log entry is written before the address is decrypted, so even a failed attempt is on record.
- — Every entry in that log is hash-chained to the one before it. Deleting or editing an entry afterwards breaks the chain, and the break is visible on the administrator’s own dashboard.
Why we tell you this
A service that promises anonymity while quietly keeping identity is worse than one that never promised, because you would calibrate what you say to a guarantee that was not real. Telling you costs us signups. We would rather have that than have your trust on false terms.
It also works better. People who know they can be identified for threatening someone mostly do not threaten people. Secret accountability catches abusers after the harm; disclosed accountability prevents some of it.