Privacy Policy
Last updated November 8, 2026
The short version
- You can read and vote without giving us any personal information.
- We don't run ads, don't use tracking or analytics tools, and don't sell or share your personal information.
- We only use cookies that the site needs to work.
- Everything you post is public. You can delete your account at any time.
1. Who we are
This policy explains how notfiction ("we", "us") handles information when you use notfiction.com (the "Service"). For questions or requests, use the contact page.
2. What we collect
| Information | When | Why |
|---|---|---|
| Username | When you create an account | To show who posted or commented |
| Google account ID and email address | Only if you use Google sign-in or connect Google | To sign you in and let you recover your account. We never see your Google password. |
| Posts, comments, groups you start or join, and reports you file | When you use those features | To run the community features |
| Votes | When you vote Real or Fiction | To calculate people scores and show your own vote back to you. Votes are tied to a random browser ID, not your name. |
| A one-way scrambled ("hashed") version of your IP address | When you vote or use the contact form | To limit spam and vote manipulation. We don't store your IP address itself. |
| Name, email and message | Only if you send us a message | To answer you |
We don't ask for your real name, phone number, address, birthday or payment details, and we don't collect your precise location.
3. Cookies
We only use cookies that are strictly necessary for the Service to work. We don't use advertising, analytics or tracking cookies, so we don't show a cookie consent banner.
| Cookie | What it does | How long |
|---|---|---|
nfu | Keeps you signed in | 1 year, or until you sign out |
nfv | A random ID so you get one vote per story and can change it | 1 year |
nfs, nfg | Temporary security cookies during Google sign-in | Up to 30 minutes |
nfa | Keeps the site's administrator signed in to the admin page | 30 days |
The admin page also remembers which tab the administrator last viewed in their own browser's local storage.
4. How we use information
- to provide and run the Service, including showing your posts, comments and votes;
- to keep the Service safe: preventing spam, abuse, vote manipulation and ban evasion, and enforcing our Terms and Community Rules;
- to respond to your messages and legal requests;
- to comply with the law.
We don't use your information for advertising, and we don't build profiles of you. We don't make automated decisions about you that have legal or similarly significant effects. Where the GDPR or UK GDPR applies, our legal bases are: performing our agreement with you (running the Service), our legitimate interests (keeping it safe and working), your consent (Google sign-in, which you can disconnect), and legal obligations.
5. What's public
Your username, posts, comments, the groups you start, and when you posted are public and can be seen by anyone, including search engines. Vote totals are public. Who voted which way is not shown. Your Google email address is never shown publicly.
6. Who else handles information
We don't sell or share your personal information, including for cross-context behavioral advertising. A few service providers process information for us, or receive it directly from your browser, as part of running the Service:
- Cloudflare hosts the Service and our database. Like any web host, it processes your IP address and request details to deliver pages and protect against attacks. See Cloudflare's privacy policy.
- Google, only if you choose Google sign-in. Google's privacy policy applies to your Google account.
- News publishers. Preview images on news stories load directly from the publisher's servers, so your browser connects to them and they may see your IP address. Clicking a headline takes you to the publisher's site, where their privacy policy applies.
- Websites linked by users. These are only loaded if you click them.
We may also disclose information if the law requires it, to protect the rights, property or safety of notfiction, our users or the public, or as part of a merger or sale of the Service (in which case this policy will continue to apply to your information).
7. How long we keep information
- Account information, posts and comments: until you delete them or your account. When you delete a post, comment or your account, the text is erased, not just hidden.
- Votes: they stop counting after 14 days and may be deleted after that.
- Hashed IP addresses: kept with the vote or message they relate to.
- Messages to us: as long as needed to handle them and any follow-up or legal need.
- Content that moderators remove for breaking the rules is hidden from the site and kept so that mistakes can be reversed and so we can meet legal obligations.
8. Your choices and rights
- Delete your account at any time from your account menu. This deletes your sign-in, removes your posts, clears your comments, disconnects Google and removes your group memberships.
- Delete individual posts and comments at any time.
- Disconnect Google from your account menu (for accounts that also have a sign-in key).
- Depending on where you live (including California, other US states, the EU, the UK and elsewhere), you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict certain uses, and to withdraw consent. To make a request, use the contact page. We'll need to confirm the request comes from the account holder. We won't treat you differently for using these rights. You may also complain to your local data protection authority.
9. Children
The Service is not for children under 13, and we don't knowingly collect personal information from them. If you believe a child under 13 has created an account, tell us through the contact page and we'll delete it.
10. Security
We protect your information with reasonable measures. Connections are encrypted, sign-in keys and session tokens are stored only in scrambled (hashed) form, and access to the database is restricted. No system is perfectly secure, so we can't guarantee security.
11. International users
The Service is run from the United States and uses Cloudflare's global network. Your information may be processed in the United States and other countries whose data protection laws may differ from yours.
12. Changes
We may update this policy. We'll post the new version here with a new date and, for material changes, tell users on the site.
13. Contact
Use the contact page for any privacy question or request.