Privacy Policy | Chirpper

Chirpper (“we,” “us,” or “our”) operates the Chirpper social network at chirpper.com. This Privacy Policy explains what information we collect, how we use it, and your choices. By using Chirpper you agree to the practices described here.

1. Information We Collect

Account data

When you accept an invite, we create a session token and generate a recovery keyphrase for your account. We store:

Your token identifier (a pseudonymous hex ID, not linked to your real name);
Your chosen display name / mask (pseudonymous by design);
Optionally: your email address, if you choose to add one for account recovery;
Optionally: a hashed password, if you choose to set one for login convenience.

We do not require or collect your real name, phone number, government ID, or payment information.

Content you post

Posts, comments, links, and uploaded media you publish on Chirpper are stored on our servers and are generally visible to other Chirpper users. Do not post content you wish to keep private.

Device fingerprint

To rate-limit anonymous actions (such as voting on posts before you have an account), we derive a short-lived device fingerprint from browser characteristics. This fingerprint is used solely for rate-limiting purposes and is not stored persistently or linked to advertising profiles.

Invite link opens

When an invite link (chirpper.com/i/…) is loaded, we record: the requesting IP address, browser user-agent string, and a device identifier derived server-side from stable browser headers (user-agent, accept-language, and browser client-hint headers where present). We also record whether the request was made by your logged-in Chirpper session. No client-side fingerprinting scripts are used.

This information is used to confirm invite delivery (for example, distinguishing a link that was opened in a chat preview from one the recipient actually visited) and for platform-integrity purposes (detecting non-human activity patterns). It is visible only to the person who sent the invite; it is never exposed on any public surface. These records are retained for 90 days and then automatically deleted.

Usage and analytics data

We use PostHog to understand how people use Chirpper. PostHog events are collected via a first-party proxy at p.chirpper.com to minimize third-party data exposure. PostHog may collect page URLs visited, click events, and browser/device type. IP addresses are anonymized before storage. See PostHog’s Privacy Policy for more detail.

2. How We Use Your Information

To provide and operate the Service (authentication, post storage, invite management);
To enforce our Terms of Service and prevent abuse;
To analyze usage patterns and improve the product;
To send you account-related communications if you have provided an email address.

We do not sell your personal information. We do not use your data for targeted advertising. We do not share your data with third parties except as described in Section 3.

3. Infrastructure and Third-Party Processors

Chirpper is built on Cloudflare infrastructure, including:

Cloudflare Pages — hosts the application and serves web traffic. Cloudflare may log request metadata (IP addresses, request paths) per their standard practices. See Cloudflare’s Privacy Policy.
Cloudflare D1 — our SQLite-based database where account data, posts, and invite records are stored.
Cloudflare R2 — object storage for uploaded images and videos.

Chirpper is not liable for Cloudflare’s independent data handling. Cloudflare is a data processor acting under our instructions for the purposes above.

4. Cookies and Local Storage

We use the following:

chirpper_session — a session authentication cookie. This is essential for you to remain logged in. It is an HTTP-only cookie set on chirpper.com and is not accessible to JavaScript.
PostHog analytics cookies / localStorage — PostHog sets a cookie or localStorage entry to identify returning visitors for analytics purposes. You can block this by disabling cookies in your browser; the Service will continue to function normally.

We do not serve advertising cookies or trackers from ad networks.

5. Data Retention

We retain your account data and posts for as long as your account exists. Device fingerprints used for rate-limiting expire within 30 days. Invite link open records (IP address, browser information, and derived device identifier) are retained for 90 days and then automatically deleted. If you request account deletion (see Section 6), we will delete your account data and disassociate your posts within 30 days, subject to legal obligations.

6. Your Rights and Choices

You may request access to, correction of, or deletion of your personal data by contacting us at privacy@chirpper.com. We will respond within 30 days.

If you are in the European Economic Area or the United Kingdom, you may also have rights under the GDPR or UK GDPR, including the right to data portability and the right to lodge a complaint with your local supervisory authority. Contact us at the address above to exercise these rights.

7. Children’s Privacy

Chirpper is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at privacy@chirpper.com and we will delete it promptly.

8. Security

We use industry-standard security practices including HTTPS, HTTP-only session cookies, and hashed password storage. No system is perfectly secure; we cannot guarantee absolute security of your data.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will post any changes on this page with an updated effective date. Material changes will also be noted in our changelog. Continued use of the Service after changes constitutes acceptance of the updated policy.

10. Contact

Questions or requests? Email privacy@chirpper.com.