How UnterUns handles your data

Your username, display name, avatar and anything you choose to add to your profile. Your email, date of birth and apartment are never shown to other members. Your age is only shown if you turn it on.

Admins (not moderators) can see your email address, so they can decide on requests and help with account problems. Nobody sees your password.

People you chat with can see when you're online or were last active, and when you've read their messages. You can turn off either one in Settings → Privacy; like in other messengers, you then don't see theirs either.

When you post anonymously, other members (including moderators browsing the feed) don't see who wrote it. The system still privately records that the post is yours, so you can edit or delete it, so rate limits still apply, and so serious abuse can be dealt with. Blocking someone doesn't hide their anonymous posts, because otherwise anyone could unmask an anonymous author by blocking people one by one.

If an anonymous post is reported, an admin can reveal its author. That requires a written reason and is permanently recorded in the audit log. Anonymity here protects you from other members, not from the law.

Private messages are not end-to-end encrypted. They're encrypted on our server with a key the server holds (AES-256-GCM), so that a leaked database or backup alone doesn't expose them. Because the server holds the key, a person with full access to the server and its configuration could technically decrypt them.

The admin tools have no way to browse conversations. Moderators only see messages that a participant explicitly selects and attaches to a report, and every time a report is opened that access is logged.

Notifications on your lock screen show who wrote, but not what, unless you choose otherwise in Settings.

If you turn them on, notifications reach your phone through your phone maker's push service (Apple, Google or Mozilla). What we send them is encrypted for your device; they see only that a notification is being delivered. You can choose to hide even the sender's name, set quiet hours, or turn them off per device at any time.

We only email you about your account: confirming your address, the decision on your request, password resets and security notices. Never chat messages, never newsletters, and no tracking pixels or links. The email service that delivers them sees your address and the email itself. A record of each email (address, type, whether it was sent) is kept for 30 days so admins can see if something didn't arrive.

Every uploaded image is re-encoded on the server. This removes hidden metadata such as GPS location and camera details. Images are stored encrypted and served only to people allowed to see them.

Stories disappear for viewers after their expiry time and are then deleted. Anyone who can see a story can still take a screenshot or photo of their screen. Don't share anything in a story you wouldn't want saved.

Flirting features are off until you turn them on. A crush is never revealed to anyone unless it's mutual and both of you have opted in. A match is not consent to anything; either of you can withdraw at any time, and turning flirting off removes your crushes.

Sign-ins and security events are logged with a keyed hash of your IP address rather than the address itself. Passwords are stored with argon2id and are never readable by anyone.

You can download a copy of your data and delete your account at any time from Settings. Deleting your account removes your profile, posts, comments, stories, photos, contacts and sessions. Anonymous posts are removed at a random time within a week, so their disappearance can't be matched to your account being deleted. Messages you already sent stay in the recipients' conversations, shown as from a deleted account. Reports and moderation records are kept for the community's safety: they retain an internal account id and the evidence moderators already reviewed, but not your profile or email.

UnterUns is for adults only. You confirm your date of birth when you register and an admin approves every member, but we don't verify identity documents. If you believe someone underage has joined, please report them.