Privacy Policy

01 Scope of This Policy

This Privacy Policy covers whisperaboutit.party, including the public site, member registration and sign-in, Whisper HQ ("the Living Deck"), Whisper Network (chat and discussions), member profiles, the Community Supporter program, and the website-services order flow. It does not cover third-party sites we link to, or services operated independently of Whisper About It, such as external game sites linked from Whisper Arcade or social platforms we post to.

"Whisper About It," "we," "us" and "our" refer to Brandon Milar, an individual operating this platform as Whisper About It — this is not presently a registered business entity (no corporation or LLC). "You" refers to anyone who visits the site or creates a member account.

02 Information We Collect

Account & registration information

When you create a member account, we collect the email address you register with and a password, which we never store in plain text — it is run through a one-way hashing algorithm (scrypt) before it ever touches our database, so even we cannot read your actual password back out. We also record whether and when your email was verified, your account status, and basic session metadata (a browser user-agent string and session timestamps) needed to keep you signed in securely.

Public display name and profile

You may set a display name and a short bio on your member profile. If you don't set a display name, other members see a generic placeholder (like "Member-ab12cd") instead of your email — your email address is never shown to other members. Your profile also shows activity-derived information: your level and XP (participation score), message and discussion counts, and your Community Supporter badge if you're a supporter and haven't opted out of recognition.

Posts, discussions, messages and other content

Whisper Network does not have private messaging. Every channel message, discussion post, and reply you submit is visible to every other signed-in member — it is not sent only to specific people, and it is not private between you and anyone else. We store the content you post, the time you posted it, which channel or discussion it's in, and your member ID as its author. See Section 5 for more on how public this content really is.

Payment and subscription information

Checkout for website services and the $9.99/month Community Supporter subscription is handled by Stripe, a PCI-compliant payment processor. We never see or store your full card number, CVV, or bank details — those go directly to Stripe. What we store on our side is limited to: your Stripe customer and subscription IDs, subscription status (active, past due, canceled, etc.), billing period dates, and for service orders, the contact and project details you submit on the order form (name, business name, email, phone, project description, and similar fields you choose to provide).

Community Supporter recognition preferences

If you become a Community Supporter, we track your subscription status, your consecutive-qualifying-month streak toward the annual thank-you reward, and your recognition preference (whether your supporter badge is shown publicly or hidden). We do not store or display your billing name, card details, or payment amount to anyone, including other members.

Email communications and consent

We send transactional email (account verification, password reset, and order/payment confirmations) through our email provider, Resend. We do not currently operate a marketing or newsletter email list. If supporter email updates are introduced in the future, they will require your separate opt-in — see Section 13 for the status of that feature.

Cookies, sessions and security logs

We use one essential cookie (wap_session) to keep you signed in. It is a random token, not a tracking identifier shared with any advertiser; it's marked HttpOnly (not readable by page scripts), SameSite=Lax, and Secure in production (sent only over HTTPS). We do not currently use third-party analytics, advertising, or tracking cookies of any kind. If that ever changes, this policy will be updated first.

To prevent abuse (like password-guessing or spam registrations), we log a short-lived record of login/registration/password-reset attempts, tied to either an IP address or an email address for a given attempt — never both together in the same record.

IP addresses and technical information

Our hosting and security provider, Cloudflare, processes IP addresses and standard request metadata (browser type, request timing) as part of serving the site and protecting it from abuse — this is largely outside our direct control and governed by Cloudflare's own privacy practices. Within our own systems, we only persist an IP address in the rate-limiting log described above.

Third-party integrations

We use Stripe (payments), Resend (transactional email), and Cloudflare (hosting, database, security) as described throughout this section. Each is a service provider processing data on our behalf under their own privacy and security practices, not an independent data owner reselling your information.

03 How We Use Information

• To create and secure your account, verify your email, and let you sign in.
• To operate Whisper Network — display your posts to other members, track reply threads, and apply moderation decisions.
• To process service orders and Community Supporter subscriptions, and to keep your subscription status accurate.
• To send transactional emails you'd reasonably expect (verification links, password resets, payment confirmations).
• To detect and limit abuse — spam registrations, credential-stuffing attempts, and similar automated misuse.
• To display your Community Supporter badge publicly, unless you've opted out of recognition.
• To respond to support requests, content reports, and legal or safety inquiries.

We do not sell your personal information. We do not use your content or account data to build advertising profiles, because we don't run advertising on this platform.

04 How Information Is Shared

We share information only as needed to operate the platform:

• Stripe — to process payments and manage subscriptions. Stripe's own privacy policy governs the payment data it collects directly from you at checkout.
• Resend — to deliver transactional email on our behalf.
• Cloudflare — hosting, our database (D1), and network security.
• Law enforcement or legal process — if we're required to by valid legal process, or if we believe in good faith that disclosure is necessary to protect the safety of a member or the public, investigate fraud, or enforce these policies.
• A future change of ownership — if Whisper About It is ever acquired, merged, or its assets transferred, member information may transfer as part of that transaction, subject to this policy or a successor policy you'd be notified of.

We do not share your private account information (email, billing details, IP logs) with other members. Other members only ever see what you choose to make public: your display name, profile bio, posts, and supporter badge if applicable.

05 Public Visibility of Community Content

Everything you post in Whisper Network — channel messages, discussions, and replies — is visible to every other signed-in member of the community. There is currently no private messaging feature. Treat anything you post here the way you'd treat a public forum post, not a private conversation.

Because this content is public to a signed-in audience, it can be copied, screenshotted, quoted, or otherwise shared by other members outside of Whisper About It's control, the same as any public online discussion. We cannot guarantee that content you post stays within the platform once another member has seen it, even if you later delete or a moderator hides your post.

When content is hidden by moderation, it is marked hidden, not erased — it stops being shown to ordinary members, but the underlying record is preserved so a hide decision can be reviewed or reversed. It is not instantly and permanently destroyed the moment it's hidden.

06 Data Retention

We keep account, profile and content data for as long as your account is active, plus a reasonable period afterward for security, dispute-resolution, and legal purposes. Specifically, as implemented today:

• Posts, discussions and replies are retained indefinitely unless deleted by you (where that capability exists) or hidden/removed by moderation — hidden content is retained, not erased, as explained above.
• Login/registration/password-reset abuse-prevention logs (IP or email, tied to an attempt) do not currently have an automated expiration — they are retained until manually purged. Owner decision needed: we'd recommend setting and documenting an explicit retention window (e.g., 90 days) for this log; none is enforced today.
• Stripe retains payment and billing records under its own retention practices and applicable financial record-keeping law, independent of our own database.

07 Account Deletion & Your Choices

Honest limitation: Whisper About It does not yet have a fully automated, self-service "delete my account" button. If you want your account disabled or your personal data removed, contact us (Section 13) and we will handle the request manually. An administrator can disable an account (which immediately signs it out everywhere and blocks sign-in), and we will work with you on removing personal data where we're able to, consistent with applicable law and our own legitimate need to keep certain records (like payment history, which Stripe retains independently, or moderation records relevant to platform safety).

You can always update your display name and bio yourself from your profile, and — if you're a Community Supporter — toggle public recognition of your supporter status on or off from Settings at any time.

08 Security — What We Do, and Its Limits

We take reasonable, concrete steps to protect your information: passwords are hashed with scrypt (never stored in plain text or reversibly encrypted), session tokens are stored as hashes rather than raw values, authentication cookies are HttpOnly/SameSite/Secure, payment data is handled by Stripe rather than passing through our own servers, and administrative access to the orders console and member-administration tools requires authentication.

No system is perfectly secure. We do not claim absolute security, unbreakable encryption, or guaranteed protection against every possible attack. If we become aware of a security incident affecting your personal information, we will take reasonable steps to notify affected members and respond appropriately, including as required by applicable law.

09 Children's Privacy & Minimum Age

Interim published policy, while this is finalized: Whisper About It is intended for adults 18 and older. We have not yet built the age-verification and minor-protection framework that would be needed to safely and lawfully support a lower age minimum, so we're not inviting younger members in the meantime. Our longer-term intent is 13+ with real protections in place for minors — see below for why we aren't publishing that yet.

Why this needed real research, not a default "13+" line

Florida's Online Protections for Minors Act (HB 3, codified at Fla. Stat. § 501.1736) prohibits covered "social media platforms" from creating accounts for users under 14, and requires verifiable parental consent for users 14–15. On October 14, 2026, the Eleventh Circuit Court of Appeals stayed the preliminary injunction that had been blocking enforcement, so the law is now actively enforceable in Florida while the underlying constitutional challenge (brought by NetChoice and CCIA) continues through the courts — this is not a final ruling on the merits, but enforcement is live now, not hypothetical.

Whether Whisper Network is a "social media platform" under this law

The statute only covers a platform that meets all four of the following (conjunctive, not "any one"):

1. Lets users upload content or view other users' content/activity;
2. At least 10% of its daily active users under 16 average two or more hours per day on it;
3. Uses algorithms that analyze user data to select content for users; and
4. Has at least one listed "addictive design feature" — infinite scrolling, push notifications, personal interactive metrics (reaction/share counts), auto-play video, or live-streaming.

Checking Whisper Network's actual, as-built code against each:

• (1) Content upload/viewing — met. Channel messages, discussions and replies are core features.
• (2) 10% of under-16 DAU averaging 2+ hrs/day — unknown, likely not met, but unverifiable. We collect no age data at all today, so we cannot affirmatively prove we're under this threshold even though the platform's small, direct-community scale makes it unlikely in practice. The statute itself doesn't say what happens when usage is simply unmeasured, which is itself a risk, not a safe harbor.
• (3) Algorithmic content selection — not met, verified in code. We checked: channel messages display in plain chronological order, and discussions sort by pinned-then-most-recent-activity — identical for every viewer. There is no personalization, ranking, or recommendation logic anywhere in the codebase that selects or orders content differently per user.
• (4) Addictive design features — mostly not met, one ambiguous point. There's no infinite scroll (chat/discussion history loads via an explicit "Load more" button, not automatic continuous loading), no push notifications (the notification bell is an acknowledged visual placeholder, wired to nothing), no auto-play video, and no live-streaming. Emoji reactions on messages do show a count, which arguably resembles the statute's "personal interactive metrics (e.g., reaction counts)" example — this is the one point where a reasonable reading could go either way.

Because criterion (3) is not met — and this is the one we can verify with confidence directly from the code, not from assumptions about usage — Whisper Network likely falls outside this statute's "social media platform" definition as currently built. That conclusion would need to be revisited if personalized content ranking or recommendation features are ever added.

If and when registration opens to minors

Before lowering the minimum age below 18, we'd recommend having in place, at minimum: an age-assurance method at registration (self-attestation is weak evidence and the statute's dissent noted the law may effectively require more robust verification — we have not evaluated or selected a specific third-party provider, and won't add one without your approval); a path for a parent/guardian to request a minor's account be restricted or removed; a block/mute tool (this doesn't exist yet for any member, minor or not — see the Community Guidelines for how reporting works today instead); and a clear decision on whether minors may subscribe to Community Supporter at all, since no mechanism currently restricts payment flows by age.

Some things we already do today that help, regardless of age: no private messaging exists in Whisper Network at all (every "contact" between members happens in public, moderator-visible channels, not a private DM a predatory actor could exploit); your email is never shown publicly; your display name defaults to an anonymized placeholder rather than any part of your real identity; and reporting routes every flagged interaction to a moderator.

What's still missing, regardless of age: a self-service "block this member" tool, a self-service account-deletion flow (Section 7), and any technical mechanism at all to restrict Community Supporter checkout by age.

10 International Visitors & Regional Privacy Laws

Whisper About It operates from Florida, United States, and our infrastructure providers (Cloudflare, Stripe, Resend) operate globally but are U.S.-headquartered companies. If you access the service from outside the United States, your information will be processed in the United States and possibly other countries where our providers operate, which may have different data protection laws than your home country.

CCPA/CPRA (California): California's law applies to businesses that cross specific thresholds — generally over $25 million in annual gross revenue, or buying/selling/sharing the personal information of 100,000+ California consumers or households a year, or deriving 50%+ of revenue from selling personal information. At Whisper About It's actual current scale (a small community, no advertising, no data sales), we do not believe any of these thresholds are met, so CCPA/CPRA likely does not formally apply today. We extend the core access/correction/deletion rights in Section 11 to everyone regardless, as a matter of policy, not because CCPA requires it of us right now.

GDPR (EU/UK): GDPR's applicability turns on whether you're offering goods/services to people in the EU/UK or monitoring their behavior, not on revenue size. We don't block or geographically restrict EU/UK visitors, so if an EU/UK resident creates an account, GDPR could technically apply to that relationship. We have not conducted a formal GDPR compliance review (lawful-basis documentation, an EU representative if required, cross-border transfer mechanisms). Owner decision needed: given the realistic scale of international usage today, decide whether to proactively restrict registration to the U.S. for now, or accept the (currently low, but non-zero) GDPR exposure until a fuller review is done.

11 Your Privacy Rights

Regardless of exactly which law applies to you, we'll honor reasonable requests to:

• Access — ask what personal information we hold about you.
• Correct — fix inaccurate account or profile information (much of this you can already edit yourself).
• Delete — request deletion of your account and associated personal data, subject to the limitations in Section 7.
• Object / opt out — stop public recognition of Community Supporter status, or stop receiving non-essential communications (we don't currently send marketing email at all).

To exercise any of these, contact us using the information in Section 13. We may need to verify your identity (e.g., confirm you control the email on the account) before acting on a request.

12 Changes to This Policy

We may update this Privacy Policy as the platform changes — for example, if we add new features, a new payment method, or a formal email-notification system. We'll update the "Last updated" date above when we do. For material changes that meaningfully reduce your privacy protections, we'll make a reasonable effort to provide more visible notice, such as a site banner or an email to members, rather than relying on the date change alone.

13 Contact & Open Items

For privacy questions, access/deletion requests, or to report a concern about how your information is handled, contact: [email protected].

This page is a careful, platform-specific draft — not a substitute for review by a qualified attorney familiar with Florida and applicable U.S. internet/privacy law before it's treated as finalized legal protection.