Privacy

What we collect

• Account information you give us at signup: username, email address, password (stored as a bcrypt hash; we cannot read it), and optionally your first/last name, location, date of birth, and profile blurb.
• Content you create: tabs you post, files you attach, favorites you mark, votes you cast, messages you send, comments, and the players you follow (your followers and following lists are visible to other members, the same as your favorites).
• Session data: a random opaque session ID stored in an HttpOnly cookie when you sign in, plus your IP address and User-Agent, so we can detect account abuse and show you a list of your active sessions.
• Activity logs on the server include your IP address, the page you requested, the page you came from, and a timestamp. These are standard web-server access logs.

What we don't collect

• No tracking, advertising, or analytics cookies.
• No third-party tracking pixels or fingerprinting libraries.
• No data sold or shared with advertisers — we have none.

Cookies

We set two cookies, both strictly necessary:

• harptabs_session — your sign-in session. Random, opaque, 30-day rolling expiry.HttpOnly, Secure, SameSite=Lax.
• harptabs_theme — remembers your light / dark / system theme choice.

Third-party processors

A short list — these are the only services that see any of your data:

• Cloudflare — terminates TLS and routes traffic to our origin via Cloudflare Tunnel. Their bot-detection sees your IP and User-Agent.
• Cloudflare Turnstile — the “not-a-bot” check on signup, password reset, and contact forms. Cookie-less by design.
• Our SMTP relay — handles the outbound emails we send (confirmation, password reset, message notifications). They see the destination address and message body.

How long we keep it

• Sessions: 30 days from last activity.
• Email-confirmation tokens: 7 days.
• Web-server access logs: 90 days.
• Account and content: until you delete your account.

Your rights

You can edit or remove most of your data yourself:

• Account settings — change name, email, password, profile blurb, location, date of birth, message-notification preference.
• Delete my account — scrubs your profile and signs you out permanently. Tabs you've posted stay as community content but lose attribution to your name.

To request a copy of all data we have on you, or to ask any other privacy question, use the contact form or email [email protected].

Children

Harptabs.com is open to everyone but we don't knowingly collect information from anyone under 13. If you believe a child has signed up, please contact us and we'll delete the account.

Changes

If we change this notice, the “last updated” date at the top will move forward. Substantive changes get a banner on the site for a week before they take effect.