Privacy Policy — draft

Our commitment and current scope.

FrontPorch does not sell personal data. This draft describes the current private-testing website. It is not a promise of absolute privacy or a claim of legal compliance. The legal operator's identity, privacy contact, launch regions and final retention schedule still need to be supplied.

Information you provide.

• Account details: username, display name, email address and a password hash, together with account status, verification and creation records. The normal signup flow does not currently collect a date of birth or an age declaration.
• Profiles and activity: profile details you supply, text posts, comments, reactions, photos and descriptions; accepted friendships and requests; your Personal Crowds and their membership; blocks; notification receipts and preferences; and timezone preferences.
• Account security: login session records and expiry times, verification and account-action token hashes, pending email-change details and security rate counters. If you enable 2FA, its authenticator secret is encrypted on the server and recovery codes are stored as hashes. Pending setup material expires for use after ten minutes; that is not a promise that every database copy is automatically erased then.
• Public support requests: the category, name and contact details you choose to provide, content location and description; removal-request signatures and declarations where supplied; request status, timing, staff review notes and requester-facing messages. A hashed tracking key protects status lookup. These requests are kept for restricted review; a final enforced retention schedule and automated fulfillment/deletion process are not yet in place.
• Reports: the reporting account, reported account, content location, chosen reason, details, a content snapshot and photo references, and moderation decisions and notes.

The database contains public-identity groundwork. A complete public-follow product, Town Hall, Main Street and Community Crowds are not currently open; their data practices must be reviewed before they launch.

Cookies, requests and security signals.

A first-party login cookie keeps you signed in. It is marked Secure, HttpOnly and SameSite=Lax; login sessions normally expire after 30 days unless ended earlier. Settings lets you see current sessions and end other sessions. Logging out ends the current session.

Your device and network send technical request information to the hosting infrastructure, including your connection address and browser/request metadata. The application uses the host's configured visitor-address signal for abuse limits and stores hashed rate-counter keys. These hashes are pseudonymous security records, not a claim that the data is anonymous. Host access/error logs and email systems may retain additional technical records; their exact retention and access settings have not yet been verified for a final policy.

The reviewed application does not install advertising or third-party analytics scripts. Device timezone detection uses the browser's timezone setting; an explicit timezone preference is stored with the account. We do not use that preference as precise location tracking.

How information is used and who can see it.

We use information to create and verify accounts, deliver posts and photos, manage connections and audiences, send account emails, display activity, prevent abuse and review reports.

My Porch posts are delivered only to their authorized audience of current accepted friends. Everyone means all accepted friends; Selected Crowds means friends belonging to at least one selected Crowd. Crowd membership is private to the organizer. Unfriending or blocking prevents subsequent authorized access to older personal content, but cannot erase a recipient's existing copies.

During current private testing, email verification automatically connects a new account with an active founder account when one exists. That account then counts as a friend for Everyone posts; the founder may organize that connection in a Personal Crowd. Review your connections before sharing. This automatic onboarding connection must be reviewed before public launch.

Your profile and username are visible to signed-in members through profile and connection features; a profile is not governed by a post's Crowd audience. Public follows and future community membership must never grant access to private posts.

Authorized platform reviewers can access report snapshots and relevant reported content through restricted review tools, including content a normal friendship audience would not expose to them. Reporter identities and internal review details are not made visible to reported users by those tools. Confidentiality is not an absolute guarantee against lawful disclosure.

Providers and other disclosures.

Namecheap supplies the current shared-hosting and configured email infrastructure. Hosting and database systems process stored accounts, content and technical requests; email systems process recipient addresses, delivery information and account messages. Mail also passes through recipients' email providers. Provider contract terms, locations, subprocessors and retention details still require review.

We may need to disclose limited information to comply with applicable legal duties or valid legal process, address serious safety concerns, investigate abuse or protect the service. Access should be limited to the purpose and authorized people. This draft does not authorize selling personal data or broad unrelated sharing.

Storage, security and retention.

The website uses HTTPS, password hashing, protected session cookies and server-side audience checks. Photos are processed into resized images and thumbnails and delivered through permission-checked routes. These safeguards do not mean all data is encrypted at rest or that content is end-to-end encrypted. No such general claim is made.

Some records have expiry limits for use: email verification links normally last 24 hours, password-reset links 30 minutes, email-change links one hour, registration form credentials 20 minutes, and staged unattached photo uploads one hour. Cleanup is partly opportunistic. Expiry of access or a link is not the same as deletion from all storage.

Deleting a post currently hides it and allows restoration; removed photos and moderation snapshots can remain stored. Security counters, pending records, reports, backups and logs do not yet have a complete enforced retention schedule. No fixed final deletion period is promised in this draft. A retention schedule, legal-hold rules and backup deletion process are required before launch.

Your choices, access and deletion.

You can choose your friends and post audiences, organize Crowds, block members, edit supported profile fields, change and verify your email, manage sessions, choose notification preferences and set a timezone. Optional 2FA adds another login step.

Signed-in members can use Account privacy to download a limited JSON copy of core account and personal text records, submit authenticated data-access requests, track replies and withdraw open reviewed requests. Members can also schedule account deletion with a seven-day cancellation window. These actions require the current password and an enabled second factor. Request records link the account and request type to a private support ticket and record submission and withdrawal times. The download excludes photo files, friendships, Crowd membership, managed identities, logs, support history and other records; it is not a complete data-access response. Scheduling deletion immediately hides the account and personal content and ends all sessions. Cancel at Cancel account deletion before the displayed seven-day deadline; normal login alone does not cancel. After the deadline, the worker permanently removes personal posts, photos, the full discussions on those posts, and the member's comments and reactions elsewhere. It also clears connections, account credentials and reviewed legacy database copies, and anonymizes remaining account references. Processing can be delayed by failures or preservation holds. Minimal deletion receipts and restricted support/security records may remain; external backups and host logs have separate retention that still needs final review. Reviewed complete data-access fulfillment remains incomplete. The public request form accepts privacy and data inquiries without login. Secure identity verification and request fulfillment remain incomplete; the selected support email is still pending verification. Depending on where you live and which laws apply, you may have rights to access, correct, receive or delete information, object or opt out of certain processing, or appeal a request decision. Missing tools do not remove applicable rights. Those requests need a working, secure process before public launch.

Children and policy changes.

The proposed minimum is 13, subject to higher local requirements and any legally required authorization. FrontPorch is not intended for children under 13. Age screening and a procedure for discovering and addressing underage accounts are not yet implemented. We must complete that work and review where the service may lawfully be offered before opening registration.

This policy will be updated as the implementation changes. An approved policy must show an effective date and provide notice of significant changes where required. Contact and unresolved operator details are listed on Support.