What we hold, and what we don’t

People write here about things that were hard to say. The least we owe them is a plain account of what that leaves on our side, who can see it, and how to make it go away.

What we hold

Only what the site needs to work.

Your email address: It is how you sign in — we send a six-digit code to it. It is never shown on the site, never attached to anything you publish, and we do not send anything else to it unless you ask us to.
The name you chose: Whatever you told us to call you. It can be your first name or something you invented; we never ask which, and there is no field anywhere that maps it back to a legal name.
What you write: Your folder, your entries, and your answers to the prompts. Drafts are readable by you and by nobody else — not by us, not by the review queue. An entry only becomes visible to a reviewer at the moment you submit it.
Replies you post: Held against your account so you can delete your own, and so the person whose entry it sits under can remove it.
A story you send us without an account: If you use the submission form, what you wrote and — only if you give it — an email address to reply to.
A bug report, if you send one: When a page breaks we offer a form. It shows you every line it would attach — the page you were on, your window size, the error's own code — and you can take any of them off before it goes. Nothing is attached that you have not been shown, and it carries no account unless you add one.

What we don’t

The things we deliberately never collect.

Your legal name. There is no column for it.
Your location, or anything that profiles you. The one exception is a bug report, and only the lines it showed you before you sent it.
Anything at all about who wrote which word on the front page — that table has no author, no session and no address.
Analytics of any kind. No tracking pixels, no advertising, no third-party scripts.

One, and only once you sign in.

Reading BoundaryLab sets no cookies at all. You can read every story, the glossary and the front page without anything being stored on your device.

When you sign in, our sign-in provider sets a session cookie so that you stay signed in as you move between pages. That is the only one, it is necessary for signing in to work, and it goes when you sign out.

There is no banner asking you to accept cookies because there is nothing here to accept — no analytics, no advertising, and nothing shared with anyone for their own purposes. If that ever changes, this page changes first and nothing non-essential will be set before you have said yes.

Who else sees it

Two companies, and no one else.

The site runs on Vercel, and the database and sign-in are Supabase. They hold this data on our behalf, under contract, and may not use it for anything of their own. Nobody else has access, and we have never sold or shared anything here with anyone.

Inside BoundaryLab, access is narrower than you might expect. The database itself refuses to show an unpublished draft to an administrator — not as a policy we follow, but as a rule written into the schema. The review queue only ever sees an entry once its author has submitted it.

What you can ask for

Any of it, at any time.

You can ask for a copy of everything we hold about you, ask us to correct it, or ask us to delete it. You can ask us to take a published story down — at any time, for any reason, and we will, without asking why. Deleting your account takes your folder and everything in it with it.

Email [email protected] and a person will answer. If we get it wrong, you can complain to the Information Commissioner’s Office at ico.org.uk.

you never have to explain why you want it gone

Written to describe what the site actually does. If anything here turns out not to match how it behaves, that is a bug in one of the two and we want to know — see the guidelines for what we promise about stories themselves.

BoundaryLab