Updated 21 September 2026

Privacy notice

How Think Step by Step handles information when you browse, sign in, and take part.

Who runs this community

Think Step by Step is operated by Martin. For privacy questions and requests, contact thinkstepbystep.lol@gmail.com.

Information we use

• Account and sign-in information. Your email, chosen username and display name, sign-in provider identifier, and the basic profile information supplied by Google or X when you sign in. Supabase manages email/password authentication. The portal uses the verified account identifier to connect you to your account; it does not need your Google or X password.
• Your contributions. Posts, comments, votes, reports, attribution, uploaded images, editable meme projects, translations, and moderation decisions.
• Session and security information. Authentication tokens are held on the server. The browser receives an essential session cookie. Request information is used for security and rate limiting; the application stores hashed rate-limit keys. Hosting and authentication providers also process technical request data needed to operate their services.
• Basic usage events. We store event identifiers, action types, post identifiers where relevant, language, sharing channel and timestamps for views, share clicks, copy-link actions, downloads and submission actions. These events do not contain passwords or the text of private contributions. A share click does not tell us whether you completed a share elsewhere.

Why we use it

We use this information to authenticate accounts, show the community feed, save and publish contributions, support discussion and votes, handle reports, protect the service, and understand which community features are used. We do not automatically post to your Google or X account.

What other people can see

Published posts, public profile names, attribution, comments and shared images can be seen and copied by people who can access the community. Draft, pending and rejected posts are restricted to their owner and authorized moderators. Hiding the author of a confession hides that identity in the public post; it does not hide ownership from administrators. Comments have their own visible author identity.

Cookies and browser storage

The portal uses an essential sign-in cookie and a short-lived cookie during social sign-in. It also stores your selected language in your browser. Clearing these settings or cookies can sign you out or reset your preference. During protected testing, Vercel may also use access-protection cookies. The application does not install advertising cookies. If the operator explicitly enables a time-limited product pilot, the portal also uses random first-party visitor and browser-session cookies to calculate aggregate use of the feed and submission flow. The database stores only one-way hashes of those random values, not the cookie values themselves.

Sponsored content

When sponsored content is enabled, we count served impressions, viewable impressions (at least half the card visible for one continuous second), and clicks. First-party counts are aggregated by UTC day, campaign, creative, placement, device class and language. Sponsorship measurement uses no advertising cookies and stores no personal data, IP addresses or user identifiers in its reporting records. Frequency limits use sessionStorage in your browser only; no viewer identifier is sent to the server for that purpose. Short-lived database records of random per-render nonces and event types reject duplicate events; temporary counters per render, campaign and request window filter bursts. These records identify a rendered slot, not a viewer, and expire automatically during sponsor requests, and reports include aggregate counts of filtered events. Advertisers receive private, read-only campaign reports with aggregate numbers. Following a sponsored link takes you to the advertiser's website, where its privacy practices apply.

Services involved

Supabase provides authentication, the database and private media storage. Vercel hosts the portal. Google and X process sign-in under their own services when you choose those options. If you follow a sharing link, the destination service receives the link and any text included in that action. Its privacy practices then apply.

Storage and removal

Signing out invalidates your portal session; it does not delete your account or contributions. Account, content, report and moderation-audit records do not currently have a scheduled automatic deletion period. When the product pilot is enabled, its random visitor cookie lasts seven days and usage-event records linked to its random identifiers are automatically removed after the configured retention period, which is 37 days by default and cannot exceed 90 days. Cleanup continues after pilot collection is disabled. Historical usage events collected before that pilot may not have a scheduled deletion period. Removing a comment clears its text while preserving a placeholder so replies still make sense. Copies already made by other people or external services are outside the portal's direct control.

Your controls and requests

You can edit available drafts, edit or delete your own comments, and remove your votes. The portal does not currently offer a self-service account deletion or password recovery screen. Email Martin to request access, correction, deletion or help with your account. Please identify the account or content involved without sending passwords or sign-in tokens; ownership may need to be verified before a request is acted on.

Your rights depend on the law that applies to you and may include access, correction, deletion, restriction, objection, portability or a complaint to a relevant privacy authority. Contact Martin with questions about a request.

Changes and contact

This notice describes the current service. Material changes will be reflected here. Contact: thinkstepbystep.lol@gmail.com.