Privacy Policy

Last updated: September 19, 2026

goppo is a personal notes and storytelling platform. This page explains, in plain language, what we collect, why we collect it, who can see it, and how you can control it.

We believe in calm tech: no ad tracking, no selling your data, no creepy profiling. This policy reflects that.

What we collect

Account information

When you create an account, we store:

Your username, display name, and email address
A hashed password (we never see your actual password)
Optional profile fields you choose to fill: bio, avatar image, public profile URL (e.g. goppo.xyz/@yourname)
A timestamp of when you registered and when you last signed in

Your content

Everything you create on goppo belongs to you. We store:

Notes — title, body, tags, folder, colour, pinned status, and timestamps
Note history — the last 20 versions of each note (so you can undo changes)
Attachments — images and files you upload or paste into a note
Templates — custom note templates you save
Series — public collections you group notes into
Bookmarks — posts from this site you’ve saved to read later

Community activity

If you use the community features, we store:

Comments you post on public notes
Reactions (hearts, stars, etc.) you leave
Chat messages — direct messages and group messages, including text, emoji reactions, voice notes, and attachments
Reputation points and badges earned through participation
Follows and profile views, if applicable

Technical information

We automatically log minimal technical data to keep the site running:

IP address — used for security (spam prevention, login attempts) and, briefly, for password reset emails
Browser and device type — for compatibility
Cookies and local storage — see below

We do not collect: location data, browsing history outside goppo, advertising identifiers, or any data from other websites you visit.

How we use your data

To create and secure your account
To store and display your notes, chats, and community content
To send you transactional emails (password reset, email verification)
To send you the weekly digest email — you can turn this off any time from your profile settings, or via the unsubscribe link in every digest
To prevent spam and abuse
To show aggregate, anonymous statistics on the site’s admin dashboard (e.g. total note count) — this data is visible only to the site owner, and is never personalised

We do not use your data for advertising, and we do not sell it to anyone.

What is public and what is private

By default, everything you create is private. Only you can see your notes, folders, chat messages, and bookmarks.

You control what becomes public:

Feature	Default	Who can see it when public
Notes	Private	Anyone with the link
Public profile (`/u/yourname/`)	Off	Anyone — shows only your public notes
Series	Private	Anyone with the link — shows the notes you’ve added
Comments	Public on public notes	Everyone
Reactions	Public on public notes	Everyone
Reputation and badges	Public on your profile	Anyone who visits your profile

Chat messages are never public. They are visible only to participants in that conversation.

If you set a note to “private”, any earlier public link to it will stop working immediately.

Cookies and local storage

We use the minimum necessary to keep you logged in and remember your preferences.

Cookies we set

wordpress_logged_in_* — keeps you logged in
wordpress_sec_* — security cookie for the admin area
wp-settings-* — your editor and interface preferences
comment_author_* — remembers your name and email if you comment

Local storage (in your browser, never sent to us)

noteshub_theme — remembers if you chose dark or light mode
Offline cache — if you install goppo as an app (PWA), your recent notes are cached locally on your device so you can write offline. Changes sync back when you’re online.

What we do NOT use

No advertising cookies
No cross-site tracking pixels
No social media tracking scripts
No Google Analytics or similar third-party analytics

You can clear cookies and local storage at any time from your browser settings. Doing so will log you out and reset your theme preference — but it will not delete your notes, which live on our servers.

Who we share your data with

Nobody, for marketing or commercial purposes. Ever.

We do share data with a small number of technical service providers whose job is to keep the site running:

Our web host — stores the database and files, as any host does
Email delivery service — receives your email address only, to deliver password resets and the weekly digest
Spam detection — comments and registrations may be checked against automated spam filters

If you request a password reset, your IP address is included in the reset email (this is standard WordPress behaviour, intended as a security measure so you can verify the request came from you).

We do not share your notes, chats, bookmarks, or any personal content with third parties.

Third-party embeds

Articles on this site may include embedded content (e.g. videos, images, social posts). Embedded content from other websites behaves exactly as if you had visited that website directly.

Those sites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with the embedded content — including tracking your interaction if you have an account and are logged in to that website.

goppo does not control what third-party embeds do. If you want to avoid this entirely, don’t click play on embedded content.

Fonts and video calls:

Our interface uses Google Fonts, which means your browser makes a request to Google’s servers when you load a page. This reveals your IP address to Google. No account or cookie is involved.
Video calls in chat are powered by Jitsi. When you start or join a call, Jitsi’s servers see your IP address and the call participants. goppo does not record calls.

How long we keep your data

Your account and content — retained until you delete them, or until you ask us to close your account
Notes you delete — moved to Trash for 30 days, then permanently erased
Note version history — last 20 versions kept, older ones rolled off automatically
Comments — kept indefinitely, so threads remain readable
Chat messages — kept until you or the other participant deletes them; group chats retain messages even after you leave
Weekly digest log — we record only the date the last digest was sent, to avoid duplicates
Password reset log — temporary, cleared after the reset is used or expires
Server access logs — kept for up to 30 days, then automatically rotated off

If you close your account, we delete your profile, notes, templates, series, bookmarks, and personal chat history within 30 days. Comments you’ve left on other people’s public notes remain, but are anonymised (“deleted user”).

Your rights over your data

You have the right to:

See what we have — your profile page shows everything tied to your account
Export it — download all your data as a JSON file or ZIP from your account settings
Correct it — edit your profile, notes, and content any time
Delete it — delete individual notes, empty your trash permanently, or close your account entirely
Turn off emails — the weekly digest has an unsubscribe link in every email, and a toggle in your profile settings
Make your content private — flip any public note, series, or profile setting back to private at any time

To request a full export or account deletion, use the tools in your account settings, or email us at the address below. We respond within 7 days.

One thing you cannot change: your username. It appears in public URLs, so we lock it after registration to prevent broken links.

Children

goppo is not directed at children under 13. If we learn that a child under 13 has created an account, we will delete it.

Security

We take reasonable steps to protect your data:

Passwords are hashed, never stored in plain text
All traffic is encrypted with HTTPS
Notes are only readable by their owner, unless the owner chooses to make them public
Admin access to the platform is restricted and audited

No online service can promise perfect security. If we ever discover a breach that affects your data, we will notify you by email within 72 hours.

Changes to this policy

If we change this policy in a way that affects you, we’ll notify you by email and post the updated date at the top of this page. Continued use of goppo after a change means you accept the new policy.

We will never quietly expand data collection — the whole point of goppo is calm, respectful tech.

Contact

Questions about your data, or want an export or deletion?

Email: privacy@goppo.xyz
Or: use the “Contact” link in your account settings.

We answer every message.