What happens to your information here

InnieHub is a community for people living with agoraphobia and social anxiety. That shapes every decision on this page, because for this community the ordinary defaults of a social network are the problem rather than the starting point. An inbox any stranger can write to, a follower count on your profile, a green dot saying you are available: those are features somewhere else and costs here.

• You start closed. A new account only accepts messages, calls and mentions from people it has accepted. Nobody has to find a settings screen for that to be true.
• What you tell InnieCare, and what you record in your check-ins, is not used for anything else. It does not shape your feed, it is not read by moderators, and it does not leave our database.
• Every control we describe here is enforced by the server. If a switch exists on this platform, turning it off changes what other people can actually do.

That last one is a rule we adopted after finding it broken. Three privacy switches on the account screen were stored only in the browser: 'Allow direct messages' could be turned off and messages kept arriving. They are real now, and nothing gets shown here that the server does not enforce.

Everything below is a real setting on your account. Changes take effect immediately, and none of them notify anybody.

Three separate permissions, because they are three different intrusions. A message can wait. A call cannot, and refusing one means something. A mention pulls you into a conversation you did not choose to be in.

• Messages: your connections, anyone, or nobody. 'Nobody' stops every conversation, including ones already open, which is what makes it a way out rather than only a way in. It is checked on every message sent, not only when a conversation is created.
• Calls: your connections, or nobody. There is deliberately no 'anyone' here. The check runs before the phone rings, not when the call is answered, so a call you have not allowed never reaches you at all.
• Mentions: your connections, anyone, or nobody. Anyone can still type your username in what they write. This decides who can turn that into a notification. A refused mention changes nothing about their text, because rejecting the post would tell them who has restricted or blocked them.
• Profile: anyone, or your connections. People outside your choice still see your name and can ask to connect, and nothing else: no posts, no bio, no location, no counts.

A stranger has exactly one way to reach you: a connection request with one short line of introduction, written once. It cannot be edited or sent again. If you decline it, they cannot ask a second time, and the refusal they see does not distinguish 'they said no to you' from 'they have not answered' — a rejection that announces itself is a rejection people avoid making.

Nobody can add you to a group. You are invited and you accept, or you are not in it. Leaving a group posts nothing in the group.

All three are reachable from wherever the problem is: a post, a comment, a message thread, a profile, a card in InnieDate. You never have to go and find someone's profile in order to get away from them.

• Mute is the quiet one, and the one most people want. You stop seeing them everywhere. They lose nothing and are never told. In a community this small, blocking somebody from your own support group carries a social cost people will not pay, and without a quiet option the real choice was to put up with it.
• Block is mutual and complete. They disappear from your feed, comments, likes, notifications, search, member lists, shared groups, stories and InnieDate, and you disappear from theirs. They cannot message, call or mention you.
• Report goes to a moderator, with reasons written for this community rather than generic ones. It blocks the person in the same gesture unless you say otherwise, because nobody should have to do a second separate chore to get away from someone they just reported.

Who reported something is never shown to the person reported. You are told when a report has been reviewed, and deliberately not told what was decided: the outcome is not yours to be handed, and knowing it would invite either an argument or a visit.

• No public follower or connection count, unless you switch yours on. Nobody compares their number to anybody's.
• No last-seen time and no imposed green dot. Presence is something you offer, not something we detect and publish about you. It is off by default.
• Rooms show whether somebody is around, never how many or who. Walking into a quiet room does not expose the person who walked in.
• No streaks to break and no messages about not having posted. Coming back after a bad month has to cost the same as coming back the next day.
• Story viewer lists are reciprocal. Turn yours off and you stop appearing in everybody else's. Watching invisibly while still seeing your own audience is the arrangement that makes a viewer list feel like surveillance.

You can also hide specific connections from your stories without blocking, muting or telling them. From their side it is indistinguishable from you not having posted one.

You can post and comment anonymously, chosen at the moment of writing rather than as a mode to remember. You can also set it as your default.

• An anonymous post carries no author and no author id. Stripping the name alone was not enough: the underlying id was still in the response and was enough to identify the writer.
• Anonymous posts are excluded from search entirely.
• An anonymous post never generates mention notifications, because the notification would name its author.
• Replying underneath your own anonymous post comes out anonymous by default, whether or not you remember to ask. Answering 'thank you, that helped' by name under a post you published anonymously is the most common way people undo their own anonymity, because the reply feels like a different act from the post.

Where it stops: anonymity hides you from other members, not from us. Your account is still attached to the post in our database, because content that nobody can be accountable for is content we cannot moderate. Moderators see the author only when acting on a report, and that access is recorded.

Your check-ins, mood history, exposure plans, small wins, thought reframes, practice sessions and social battery entries are yours alone. Not the moderators', not the administrators', not any third party's.

• They do not shape your feed and they do not generate suggestions of people or groups.
• They are never sent to an analytics service, an error tracker, or any other outside company.
• They are not visible to anybody else on the platform, including staff, and there is no screen anywhere that shows them to another account.
• They are included in your data export, because an export that quietly omits the most sensitive part is not your data, it is the part we were comfortable handing back.

Merely belonging to this community says something about you. That is why nothing we send to an outside service ever carries your email, your name or your username: they receive an opaque identifier, and the join back to a real person happens only in our own database.

Generative AI is used in one place on this platform and nowhere else: the support assistant inside InnieCare. It does not write posts, it does not moderate, it does not rank your feed, and it does not decide anything about your account.

• The assistant runs on a model provided by Anthropic. When you write to it, the recent messages of that conversation are sent to Anthropic in order to produce a reply.
• It is available on every tier. Each tier has a daily allowance of model-backed replies; running out changes the assistant to a simpler keyword responder, and never blocks you.
• Crisis detection runs for everybody, before any model is involved, and is never subject to a tier, an allowance or a payment.
• You can clear the conversation at any time. Clearing it does not restore the day's allowance, which is counted separately for that reason.

It is a support assistant, not a therapist, not a diagnosis and not a substitute for care. The professionals listed in InnieCare are people; the assistant is not one, and it says so.

You are not in InnieDate unless you create a profile and add a photo, and it is for adults only: 18 years old, checked against your date of birth, with the age filter unable to go below it.

• Before a match, the person swiping does not get your identity: not your full name, not your username, not your city. They see the alias you chose, your age, and whatever you wrote. Without a username there is no route from a card back to your account.
• Photos are served blurred from the server, with the blur applied before the image leaves us and the URL signed. The original never reaches anyone's device until there is a match, so no inspector or screenshot recovers it.
• A like in one direction is never notified and never shown. Nobody knows you liked them until they like you back.
• You can undo a match. The photos re-blur, neither of you appears in the other's deck again, and nothing is announced.
• Your presence in InnieDate is not visible anywhere else on the platform: not on your profile, not in member lists, not in search, not as a badge.
• Leaving deletes your photos from storage, not just from view, along with your profile and your likes.

No InnieDate data is sent to any third party. Not an analytics event, not an identifier, not the fact that the module was opened.

• Crisis detection runs for every account, on every tier, before any model is called.
• Helplines work without a session, without a network connection, and without having finished signing up. They are carried in the app rather than fetched, because the moment somebody needs them is the moment a request is most likely to fail.
• Helplines are shown for the countries our members are actually in. Showing a single national number to everybody was a real bug here, not a hypothetical.
• When a moderator is alerted to a possible crisis, they receive the minimum needed to check in on somebody: that there is a signal, and who to write to. Not the conversation.

InnieHub is not an emergency service and cannot respond in an emergency. If you are in immediate danger, contact your local emergency number.

Images and video you upload are stored with Cloudinary, a media hosting provider. Ordinary images (avatars, covers, post images) are stored normally. InnieDate photos are stored as authenticated assets and only ever served through signed, expiring URLs.

• Leaving InnieDate destroys those photos at the provider, and the deletion is attempted before the database rows are removed so that nothing can be orphaned in storage with no record that it exists.
• If a photo cannot be deleted, you are told the number that remain rather than being shown a success message.
• GIFs in messages and posts come from Giphy and are searched from your browser, which means Giphy sees the search you type and your IP address. Nothing about your account is sent with it.

No third party receives anything from InnieCare, your health information, InnieDate, or anonymous content. What follows is everything else.

No analytics SDK starts before you have consented. Turning one off after it has initialised is not enough, because initialising already opens a connection and writes cookies, which is the thing the rule exists to prevent.

• Necessary: the session cookie that keeps you signed in, and the record of your consent choice. These cannot be turned off, because without them you cannot sign in and we cannot remember that you declined.
• Functional: preferences such as your language and appearance settings.
• Statistical: product analytics. Nothing in this category runs until you have said yes.

You can reopen the consent choices at any time from your privacy settings and change your mind in either direction.

• Passwords are stored hashed with bcrypt and are never recoverable, by us or anybody else.
• Sign-in, password reset, message sending, uploads and the InnieCare assistant are rate limited.
• The mobile app can be locked with Face ID or the device passcode, and re-locks after time away.
• Every request that reads or writes your data checks your session on the server. What the interface hides is also refused by the API.

The app lock covers the app; it is not encryption. Somebody with your unlocked device and your password has your account, and no in-app setting changes that.

You can download everything this account holds as a single file, at any time, without asking anybody. It contains your account details, your privacy settings, your posts and comments, the messages you sent, your groups and events, your connections, your InnieDate profile, your stories, your health check-ins and your InnieCare conversation.

It does not contain messages other people sent you. Those are their words, and handing one member of a conversation a transcript of everybody else is not something we will do.

Deleting your account starts a thirty day window. Signing back in during it cancels the deletion. After that the account and its content are removed.

Depending on where you live you may have specific rights: to know what we hold, to get a copy, to have mistakes corrected, to have it deleted, to restrict or object to certain uses, and to take your data elsewhere. The download and delete controls above exercise most of them directly. For the rest, write to us.

We do not sell personal information and we do not share it for cross-context behavioural advertising. There is no advertising on this platform, no Meta Pixel and no Google Analytics.

InnieHub is for adults. We ask for your date of birth in order to confirm you are 18 or over, and for InnieDate's age filtering if you ever turn it on. It is not shown to other members.

We do not knowingly collect information from anybody under 18. If you believe a minor has an account here, tell us and we will remove it.

When something here changes in a way that affects what happens to your information, we say so in the app rather than quietly editing the page and updating a date at the top.