Privacy policy

1.1Posts and replies

The text you write, the name you pick (or the random one we assign), the kind of post you chose, the company and topics, and the time it was posted, rounded to the minute. This is public. We don’t store who wrote it.

1.2Request data

When your browser loads a page, it sends standard information such as your IP address, browser type and the page requested. Our network provider, Cloudflare, uses it to deliver the page and block attacks. Before a request reaches our servers, your IP address is replaced with a coded value (see below), so our servers and hosting provider never receive it.

1.3Abuse prevention

To stop flooding and repeat abuse, your IP address is turned into a one-way coded value that changes every day. Only this code reaches our servers. It isn’t stored with your posts, and the counters that use it expire after about an hour.

1.4Data in your browser

Follows, saved discussions and your votes are stored in your browser’s local storage, not on our servers. When you open your watchlist, your browser sends that list to fetch the latest posts; we don’t keep it. Right after you post, your browser holds a code that lets you undo the post for 15 seconds (tap More time to extend it, up to 2 minutes in all); our servers keep only a scrambled copy of it, which deletes itself when the undo window closes.

1.5Messages to us

If you contact us or request a company, we keep what you send so we can act on it. An email address is optional and used only to reply to you. Contact messages, including any address, are deleted after 90 days, or sooner once we’ve dealt with them. Don’t include anything that identifies you unless you need to.

1.6Reports

When you report a post, we keep the reason and any details you add, only to review that post. Reports are deleted once a moderator decides on the post. If no moderator ever needs to, the details you wrote are erased after 90 days.

We don’t require accounts, verify employment, ask for real names, read your contacts, use your location (visit counts show countries only as totals), or track which posts you wrote. We don’t use data brokers, and we don’t currently use advertising cookies or tracking pixels (see Advertising below).

3.1Essential storage

We don’t currently use cookies. We use browser storage only for features you use, such as saves, follows, votes, the undo window, and which discussions you’ve already opened (so we can mark what’s new since your last visit). Clearing this site’s data in your browser removes all of it.

3.2Analytics

Our fonts are served from our own servers. To count visits we use Cloudflare Web Analytics, which doesn’t use cookies or other storage in your browser, doesn’t track you across sites, and doesn’t record what you type or search for. It gives us totals such as page views, popular pages, the sites that send visitors, and countries and browser types in aggregate. We don’t currently use advertising or social media scripts.

3.3Service providers

Cloudflare (network and security), Netlify (hosting), Supabase (database) and Upstash (short-lived data such as undo codes) process data on our behalf. Of the services that run the site, only Cloudflare receives your IP address. Their own policies govern what they log.

3.4Human check

When you post, reply or report, your browser runs Cloudflare Turnstile, a check that you’re a person rather than a bot. It runs in your browser, sets no cookies and sends signals about your browser and device directly to Cloudflare. We receive only a pass or fail result and don’t send Cloudflare your IP address ourselves.

3.5Newsletter

WorkHush Weekly by email is sent by Buttondown. If you subscribe, you give your email address to Buttondown on its own sign-up page, not to WorkHush’s posting system, and it isn’t linked to anything you read or post here. Open and click tracking are turned off, and every issue has a one-click unsubscribe link. Buttondown’s privacy policy covers what it stores.

To run the site, show discussions and updates, count replies, views and helpful scores, block content that breaks the rules, protect the service from attacks and spam, and answer messages.

5.1We never sell it

We don’t sell, rent or trade information about visitors, and we never give advertisers information about what anyone posted.

5.2Service providers

Companies that host or secure the site may process request data on our behalf, under contracts that limit what they can do with it.

5.3Legal requests

We disclose data only in response to a valid subpoena, court order or warrant, and we review each request. Because posts aren’t linked to people and security logs are short-lived, we usually have little or nothing to provide. Where the law allows, we will publish a yearly count of the requests we receive.

5.4Emergencies

We may share information if we believe in good faith that it is needed to prevent death or serious physical harm.

Posts stay up until they are removed for breaking the rules or WorkHush shuts down. When a post is removed, its text is kept privately for 30 days in case of appeals or legal obligations, then deleted, unless a legal hold requires longer. Undo codes: 15 seconds, up to 2 minutes with More time. Abuse-prevention counters: one hour. Messages to us, including any email address: up to 90 days. Cloudflare’s security logs are kept according to Cloudflare’s policy.

You can clear your browser storage to remove saves, follows, votes and the record of what you’ve read. Because we don’t know who wrote a post, we can’t verify that a post is yours after the undo window, so we can’t delete it on request. If a post shares your personal information, report it. If it includes contact details, the automatic check hides it right away. Otherwise a moderator reviews it once enough people report it, or you can ask for a review through the contact form. Depending on where you live, you may have other rights over personal data; contact us at hello@workhush.com to use them.

We use encrypted connections, limit who can access systems, and keep as little data as we can. No system is perfectly secure, which is why we avoid collecting what we don’t need.

WorkHush is for adults 18 and older. It isn’t directed at children, and we don’t knowingly collect information from anyone under 18. If you believe a child has sent us personal information, contact us and we will delete it.

WorkHush doesn’t show ads today. We may add advertising or sponsored content in the future to help pay for the site. If we do, we will update this policy and post a notice on the site before it starts, ask for your consent where the law requires it, and keep ads off the pages where you write posts. Advertising partners would receive only what any website they serve ads on receives, such as your IP address and the page being viewed. We will never give them information about what you posted, and we don’t have information that links posts to the people who wrote them.

If we change this policy, we will update the date at the top and, for significant changes, post a notice on the site before they take effect.

Questions about privacy: hello@workhush.com or the contact form.