What we know about you, which is almost nothing

This is the privacy policy, written the way the rest of the site is written: what is actually received, kept, deleted and shared, and who answers for it. The technical detail is on the anonymity page; this is the legal one, and the two say the same thing.

Last changed: 4 September 2026

Who is responsible

The controller, in the sense of the General Data Protection Regulation, is Albert Castell, Barcelona, Spain. You can reach him at info@yourtree.net. There is no company behind this site, nothing is sold, and nobody is paid for anything you write.

What we never collect

No account, no name, no email address, no phone number, no password. No cookies of any kind. No analytics, no advertising, no tracking pixel, nothing loaded from another company. The only way we ever learn an email address is if you write to us.

What is processed, why, and for how long

Five things, and the list is complete.

• 01

  Your IP address. Every connection carries one and we cannot avoid receiving it. It is never stored as it is: an IPv6 address is cut to its /64 prefix, then the address is passed through HMAC-SHA256 with a secret key that lives outside the database, and the result is a fingerprint. The fingerprint has one job — limiting how often one person can plant or report — and is erased two days after it was written. Legal basis: our legitimate interest in keeping the forest usable and not flooded (art. 6(1)(f) GDPR).

• 02

  What you plant. The text of your note, its position in the forest, when it was planted and how many times it has been reported. All of it is public to anyone who walks past, it stays for as long as the forest exists, and nothing links it to you. If you put personal data in a note — yours or somebody else's — it becomes public the moment you plant it, so think before you do. Legal basis: your decision to publish it (art. 6(1)(a)) and our legitimate interest in running the service.

• 03

  Reports. When you report a note we store a key derived from your address and that note's identifier together, so you cannot report the same note twice; it says nothing about any other note and it goes when the note goes. Separately, a row holding nothing but the time of a report is kept for the daily limit and erased after two days. A report also records whether it was flagged as naming someone or being illegal. Legal basis: legitimate interest in preventing abuse, and our legal duty to act on notices of illegal content (arts. 6 and 16 of the Digital Services Regulation).

• 04

  What your browser keeps. Four values in local storage, on your device only and never sent to us: whether you have seen the welcome card, your language, when your planting cooldown ends, and which notes you have reported. Clear them whenever you like.

• 05

  If you write to us. Your email address and what you wrote, kept for as long as it takes to deal with it. If it is a notice about a note, we keep the exchange for as long as the law requires us to show that we acted on it. Legal basis: legal obligation (Digital Services Regulation) and legitimate interest.

Who else sees anything

The site runs on Vercel and the database on Supabase. Both process data on our behalf; both see traffic in transit and keep their own operational logs, on their own terms and under the safeguards they publish, which may include processing outside the European Union. We do not see those logs and cannot edit them.

When a note is flagged as naming someone or being illegal, an alert reaches us through Telegram. It contains the note's text and identifier — which are already public — and nothing about who reported it.

That is the whole list. Nothing is sold, shared for advertising, or handed to anyone else unless the law obliges us to.

Your rights

Under the GDPR you can ask for access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest. Write to info@yourtree.net. You can also complain to the Spanish data protection authority, the AEPD (aepd.es), or to the authority where you live.

One honest limit: because nothing links a note to a person, we cannot verify that a note is yours, and so we cannot rectify or erase "your" notes on request. A request about a specific note is handled as a notice under the terms: if it names a person or is illegal, it comes down.

Age

This forest is made for adults. It is not aimed at minors, and if you are under eighteen we ask you not to plant. There is no age check, because a check would mean identifying you, and not identifying you is the point of the site.

Changes

The date at the top of this page changes when the text does. If what we do with data changes, this page, the anonymity page and the code change together.