LOUDERR

Controlled-test privacy draft · formal legal and privacy review required

Privacy

LOUDERR stores account and profile details; public Drops and media; private saves, direct messages, notifications, and recipient-scoped events; moderation and security evidence; and first-party product events used to evaluate the controlled test. If a member leaves the registration handle blank, LOUDERR creates a random handle that is not derived from the submitted name or email.

Some data never reaches LOUDERR at all. The Studio editor keeps unpublished drafts in your own browser's storage on the device you are using, so an unfinished edit survives a reload without being uploaded. Those drafts are not sent to the service and are not included in an account export. Signing out or deleting your account removes the drafts made while signed in from that browser; a browser where you did neither, for example because your session expired while it was closed, may keep them until you next sign out there or clear its site data for LOUDERR. Publishing a draft is what sends it.

Google and Apple sign-in

When configured, Google or Apple authenticates the member and sends LOUDERR a signed identity response. LOUDERR validates that response and stores the provider name, the provider’s stable account subject, a verified email address, optional display name, and local sign-in timestamps. LOUDERR does not retain the provider access token, refresh token, authorization code, or ID token. The short-lived browser state, nonce, and Google code-verifier material are used only to complete or reject the sign-in attempt.

A verified provider email never silently merges accounts. If that email already belongs to a LOUDERR account, the member must sign in to that account and explicitly connect the provider in Security. Apple may supply a private relay email rather than the member’s ordinary address. Google and Apple process sign-in data under their own terms and privacy practices. Local disconnection is not currently offered; local account deletion removes the stored provider link but does not delete the Google or Apple account or prove provider-side erasure.

Language and translation

Automatic translation is currently disabled: no new translation jobs are created and no content is sent to a translation provider. Existing language preferences and cached derivatives are retained, while member-facing content is shown in its original language. If explicitly enabled later, public Drops, Chat messages, questions, responses, and polls can be sent to a configured translation provider and stored as labeled language derivatives. Original text remains the source of record. An English derivative can support shared search and staff review, but automated translation can be inaccurate and is not the sole authority for moderation.

Direct and group messages are stored by LOUDERR and are not currently end-to-end encrypted. Automated abuse checks can prevent delivery, and authorized staff can review reported or held messages. Editing a message retains earlier versions, available to people who can access the message and authorized report reviewers. Deleted or removed messages and their earlier versions are hidden from conversation search and participant history views.

Voice and video calls and live video are for members aged 18 or over with a verified email address. The audio and video travel through LOUDERR's own media server, encrypted between your device and that server; they are not end-to-end encrypted and are not recorded or stored. Other people in a call or a live connect to our server, not to your device, so they do not see your network address. The media server sees it while you are connected, and its short technical logs, which can contain it, are overwritten as they rotate. A conversation keeps its call history (who was called, who took part and from which signed-in session, when, and how the call ended) for as long as the conversation exists. The separate record of each call connection (your account, session and times) is deleted seven days after it ends. When you go live, your followers who are adults are told, and any adult who may see your profile can watch (for a private profile, only your approved followers); people watching are hidden from each other, and you see how many are watching, not who. Comments on a live are shown only to the host and the people connected to it, and never to someone who has blocked or muted the author or whom the author has blocked; the author or the host can remove them. Anyone who connected to a live can report it, and moderators can read a live's record and comments and end any live. The record of a live (its title, times and highest number of viewers), who connected to it, and its comments are deleted seven days after it ends, unless a report keeps them for that case.

A conversation can turn on disappearing messages for 24 hours, 7 days or 90 days. The timer applies to messages sent after it is set: when the time passes, the message is hidden from everyone in the conversation, including in account exports, and the message and any attached document are then deleted from our systems. Attached photos and voice messages stop being available to the conversation at the same time; the stored upload follows the media retention rules, which are not final yet (see below). A message that was reported, or that a moderator acted on, is kept for that safety record and stays hidden from the conversation. LOUDERR cannot stop anyone from copying or taking a screenshot of a message before it disappears.

Stories posted straight to Stories are visible for 24 hours to the people allowed to see your profile, or only to your Close Friends list if you choose that. After that they stay in your private Story archive, and in any Highlight you add them to, until you delete them or your account. While a Story is live you see who viewed it and how each person voted in a Story poll; viewers never see each other. The record of who opened a Story is deleted seven days after the Story expires, so a viewer can still report it in that time. Poll votes stay with the Story until it is deleted, so its totals stay right. Nobody is told when you add them to your Close Friends list or take them off it, but the people on it see a Close Friends mark on those Stories. If you delete a Story, or your account, a Story that someone reported stays as a hidden record for that case. A reply to a Story is a direct message and follows the rules above.

Time controls are optional. If you set a daily limit, break reminders or quiet hours, LOUDERR counts the minutes the site is open and in front on your devices, one day at a time, and holds push notifications during quiet hours. We keep these daily totals so the limit and your weekly overview work, and delete them with your account.

An account holder aged 16 or 17 can invite an adult to supervise their account. A supervising adult sees the daily minutes for the last seven days and can set a daily limit and quiet hours. Blocking each other ends supervision at once, without a notice. They cannot see messages, posts, Stories, comments, followers, following or searches. Both people are told when supervision starts, when limits change and when it ends, and either person can end it at any time. Supervision ends by itself when the account holder turns 18.

People choose whether to accept a group invitation. Group messages are available only to their sender and the members who had joined when they were sent. Leaving or removal closes access to the conversation, while account export and reporting remain available for previously received messages. Rejoining restores those messages but does not reveal messages sent during an absence. Group owners and administrators can manage invitations and membership.

Private-message text is eligible for external translation only when the operator has enabled private translation and the active sender and every original recipient have opted in. In groups, they must also remain joined. Withdrawing a preference or leaving a group clears the affected cached translations in LOUDERR. It does not undo provider processing or prove provider-side erasure. Provider retention, training use, subprocessors, transfer locations, and deletion terms require formal operator and privacy review before this feature is enabled beyond controlled testing.

Opening a Story made from a Drop records that you opened it. The record is your account and the time you first opened it, it is readable only by the Story's author, it is not updated if you look again, and it is deleted with the Story it belongs to, which is at most about a day. Re-publishing the same Drop as a new Story starts an empty record rather than carrying the previous audience forward. A person you have blocked, or who has blocked you, is counted in the total but is not named to the author. Voice messages are recorded on your device and then uploaded, stored and moderated exactly as any other message attachment; recording requires your browser's microphone permission, and nothing is captured before you press record or after you stop.

World and connected data

World and connected data

Connected features can store Mic entries and slots, questions, polls and votes, collaborations, integrity classifications, and lifecycle provenance. Mic entries retain integrity classifications and weights. Current Mic slots and bounded completed or removed slot history can be public with holder, Drop, timing, selection-reason, and aggregate-metric data; Mic queue entries are not publicly listed. Public structured question detail can include a capped, deterministic set of active, integrity-valid, full-weight response bodies from active verified users and their public profiles, with block and mute filtering. Member-specific viewer-response state, including the viewer’s own body, integrity, and counted state whether or not it is in the public eligible set, and collaboration-interest text are handled separately as participant-scoped data. Public status, Board history, Winner archives, and Time Capsules retain bounded records and provenance so shared results are not silently rewritten.

The World map uses an explicit, removable consent record for a user-provided coarse country and optional region or city label. A member can add, edit, or remove that record. Public local lenses are thresholded aggregates; LOUDERR does not claim to collect GPS or precise location for this feature.

Commerce and providers

When commerce is enabled, LOUDERR stores creator-account state and owned offers, including private fulfillment configuration; buyer purchases and entitlements; creator-sale snapshots; sponsor campaigns and exposures; and non-secret provider customer, connected-account, Checkout-session, payment-intent, and subscription identifiers. Those provider-issued IDs are non-credential identifiers but remain account-linked and are not public by default. Provider-hosted Checkout, billing, and payout onboarding send the member to the configured payment provider.

Configured identity providers receive data only as needed for sign-in. Configured payment, anti-bot, and safety providers receive data only as needed for payment or payout processing, anti-abuse checks, or safety evaluation. A configured translation provider receives only text and language metadata needed for the enabled public or consented-private translation contract. LOUDERR does not store payment-card data or raw webhook bodies; signed webhook events are represented by provider identifiers, state, and a payload digest.

Measurement and identifiers

Contextual advertising and Premium

The separately gated native-ad feature uses the current page topic, campaign budgets and first-party frequency controls, not a behavioral interest profile or private messages. Ad delivery and qualification records can be linked to the signed-in member for billing integrity and abuse prevention; advertisers receive campaign totals, not viewer identities. No third-party advertising pixel is added by this feature. Contextual delivery and first-party measurement still require formal privacy review before rollout.

Advertising preferences record an optional adult self-declaration. This is not verified age assurance or consent to behavioral advertising. Unknown-age accounts and guests receive no native ads in this version. You can retract the declaration without losing free organic participation. Premium records include checkout, subscription, paid-period and refund/dispute state needed to provide ad-free access and safely stop billing. Account export includes your own new billing and advertising state; deletion removes the age preference while restricted financial and abuse evidence can remain under the retention policy.

Measured events can include sessions, registration, login, qualified viewport impressions, dwell time, media progress, outbound clicks, account signals, reports, blocks, mutes, commerce interactions, and return sessions. API responses alone are not counted as impressions, and no invasive third-party tracker is enabled by default.

Sessions use opaque server-side records and HttpOnly cookies. Analytics use random first-party identifiers and server-hashed session keys. Stored session and security network values use keyed-pseudonymous hashes rather than raw IP addresses or raw user agents. One value is stored in the clear and is not a session or security network value: a web-push subscription records the browser user agent it was created from, so a member can recognise which device a notification permission belongs to. It is deleted with the subscription and with the account.

When a configured anti-bot check is invoked, its provider may receive the raw remote IP address with the challenge response for anti-abuse verification. That external disclosure is distinct from LOUDERR’s keyed-pseudonymous stored network values.

Export, deletion, and retention limits

A recently reauthenticated member can export account, profile, content, relationship, message, connected-feature, and commerce data. Commerce export can include owned offers with private fulfillment configuration, buyer purchases, creator-sale snapshots without buyer identity, and owned sponsor campaigns and exposures. It is minimized so another party’s private billing identifiers are not disclosed.

Account deletion revokes sessions, deletes local Google/Apple identity links and pending sign-in attempts, removes or replaces direct account identifiers, and retires the public account and its profile authority. It removes advertising-frequency records and unbilled advertising deliveries that are not linked to a safety report. Billed deliveries and reported advertising evidence can remain for financial reconciliation or safety handling. Financial, entitlement, audit, moderation, security, and sponsor-exposure evidence can remain pseudonymized under the stable internal user ID; that stable link remains inside the service.

Deletion also removes the member’s coarse-region consent record, retires public and connected authority, and scrubs question-response bodies and collaboration-interest text where supported. Provider Checkout and subscription state must first be safely reconciled or retired; if that cannot be confirmed, deletion fails closed instead of reporting a partial deletion.

Authored content can remain nonpublic for moderation or dispute handling. Stable-ID-linked participation, integrity classifications, financial and entitlement records, sponsor exposure evidence, moderation evidence, security events, and audit history can also be retained.

A monitored public privacy or legal contact channel is not configured for this controlled test. The exact retention, erasure, legal-hold, controller, operator, service-address, and contact rules are not finalized and require professional review before broader launch.

This draft does not establish compliance with any jurisdiction. Formal legal and privacy review is required before broader launch.