Privacy
A world map you can leave a short anonymous voice on (280 characters), pinned to a point, and see that similar thoughts sit nearby. A voice speaks to a place, not to a person. Ages 18+.
Privacy by design
- No accounts, names, phone numbers, or device identifiers: there is nowhere to keep them.
- Every voice carries a one-day author tag. The app sends a random token that lives only on your device; the server hashes it with a key of the current day and keeps only that short hash next to the voice, never the token. It lets readers block an author for the day and lets the operator eject one. Tomorrow the tag is different, and Erase local data replaces the token.
- IP addresses are written neither to the database nor to the logs. They exist only in memory, as salted hashes, for exactly as long as an anti-spam limit needs them.
- The service never reads your location. You aim a voice on the map by hand, anywhere in the world; that point is decoupled from where you are.
- A voice has a view counter. The page reports which voices it showed, the server adds one to the voice's own counter and forgets: no “this address read this voice” link is kept anywhere, not even in memory. Repeats are filtered out inside your browser.
- Publication time is coarsened to the minute, and ids are random.
- Text is checked for threats and personal data locally in the browser before it is sent; the hints go nowhere.
Rules about procedure, not about views
- Not allowed: threats of violence, doxxing, publishing someone else's personal data, illegal content, spam floods.
- Do not write about third parties or “suspicious people”: a voice is about yourself, not a report on someone.
- Do not publish details that deanonymize you (phone, address, links): keep your anonymity.
Moderation
Reader reports hide nothing automatically: a human reads them. A hidden voice keeps answering at its permalink with the reason for removal. The only reaction is a heart. No replies, no downvotes, no ranking by engagement.
What lives on your device (and only there)
Interface language, map position, settings, hearts, the list of voices already seen (it lives until the tab closes and exists so one voice is not counted twice; the list itself is never sent anywhere), the shell cache for working offline, and up to 5 unsent voices (no longer than a day, sent when the network returns). Once per local day the device may send a single aggregate return category, with no dates and no identifier.
Erase everything local
The button clears the storages, caches, cookies, queue, and service worker the site can reach, then opens a page without JavaScript that does not recreate them. How much of the ordinary HTTP cache can be cleared depends on the browser; the site cannot delete the tile cache of another origin. In Tor Browser the offline part is disabled by the browser itself; everything else works as usual.
Map tiles
On the clearnet your browser fetches the map straight from tiles.openfreemap.org. That provider sees the network IP and the tile numbers, which is the rough area being viewed. Over onion the tiles go through a same-origin proxy, and the provider sees the server's address, not the reader's.
Rules and reports
Full rules, moderation, and the form for reporting illegal content: /rules