Privacy

Last updated: 1 October 2026

A Stranger's Shelf is operated from the Philippines. For questions about this notice or your data, write to contact@astrangersshelf.com.

The short version

There are no accounts here. We do not ask for your name, your email address or your age. We do not use analytics, advertising or tracking cookies, and we do not sell or share anything for marketing.

What we hold is what you deliberately typed or uploaded, plus a small number of cookies that make the site work.

What we collect

If you only read, nothing is stored in our database about you. No account, no profile, no analytics identifier, no record of what you were shown.

Our hosting provider (Cloudflare) processes your request in order to deliver the page, and in doing so handles your IP address and browser user-agent at the network level, as any web host must. We do not record either of these in our own database, and we do not build a profile from them. To limit automated abuse, such as a script flooding submissions, some of our own request-handling code also reads your IP address briefly for rate-limiting — it is hashed before use, and only the hash is kept, for about a minute, as a short-lived counter that is then deleted. The address itself is never stored. See "Who else is involved" below.

If you leave something, we store the work itself and the fields you filled in:

• The work — text, or an uploaded image or PDF
• Title — optional
• A note to the finder — optional
• Attribution choice — anonymous, a first name, or a pen name, your choice
• Attribution name — only if you chose to give one. It does not have to be real
• Country — optional, and only a country, never a city or address
• Feeling — optional, one of six words you may choose for the work
• File name, size, page count, dimensions — technical facts about the upload
• Timestamps — when it was submitted and when it was reviewed

We do not collect your email address, your telephone number, your date of birth, your location, or any account credentials, because the site has none of these.

Photographs are stripped of embedded metadata before storage. For JPEG, PNG and WEBP uploads, we remove EXIF and similar metadata — which can include GPS coordinates, camera serial numbers, timestamps and editing history — and keep only what the format needs in order to display. The stripped version is what is stored; the original is not retained.

For PDFs, we strip the document's own identifying details — its title, author, producing software and creation/modification dates, and any embedded XMP data — before storage. We also reach inside the pages: a JPEG photograph embedded in a PDF has its EXIF and GPS removed too, so a photographed letter saved as a PDF gets the same protection as a photograph uploaded on its own. A PDF holding an embedded photograph we cannot clean safely, or one too large for us to process at all, is refused rather than stored unprocessed. PDFs are cleaned in your browser before upload and checked again by us before storage; with JavaScript off, most PDFs are refused.

Some rarer corners of the format are not covered. Among them: a photograph attached to a PDF as a separate file rather than shown on a page, colour-profile data stored alongside an image, and a name left behind in a comment or annotation by whoever marked the document up. If that cannot be ruled out and it matters to you, leaving the work as a plain image (JPEG, PNG or WEBP) is the most thoroughly stripped route we have.

If you report something, we store the reason you selected and any details you typed. We do not store who you are, because we do not know.

Cookies

We use no analytics, advertising or cross-site tracking cookies. Every cookie below exists to make the site function, and none is used to profile you.

• ss_current — remembers which creation you are currently looking at, so a reload does not replace it. Lasts the browsing session.
• ss_seen — remembers which creations you have already been shown, so you are not given the same one repeatedly. Lasts up to one year.
• ss_draft — keeps your in-progress submission as you move between steps. Lasts until submitted or expired.
• ss_submitted — records that a submission completed, so the confirmation page can be shown. Short-lived.
• ss_last_token — lets the confirmation page show your take-back link once. Short-lived.
• ss_submit_at — rate-limits submissions to prevent flooding. Lasts 10 minutes.
• ss_report_at — rate-limits reports to prevent abuse. Short-lived.
• ss_feeling — remembers the feeling you chose to pull, if you chose one, so the next pull follows it. Lasts the browsing session.
• ss_welcome_seen — kept in your browser’s own storage, not a cookie. Remembers that you have read the welcome note, so it is not shown again. It holds only the date of this privacy notice, and lasts until you clear this site’s data in your browser.

ss_current is cryptographically signed so it cannot be altered to select a particular creation. Signing does not identify you.

Because these are strictly necessary for the service you have asked for, they do not require consent under the ePrivacy Directive. We do not show a cookie banner because we do not set anything that would need one.

Why we are allowed to hold this, and on what basis

Under the EU/UK GDPR, where it applies to you:

• Your submission and its fields — Article 6(1)(b), performance of a contract: you asked us to display your work, and we cannot do that without storing it.
• Review and moderation, security, and rate-limiting — Article 6(1)(f), legitimate interests: keeping the site lawful and safe for the strangers who read it. We consider this proportionate because the data involved is minimal and you chose to provide it.
• Reports — Article 6(1)(f), legitimate interests in moderating unlawful or harmful content, and Article 6(1)(c) where a legal obligation applies.

Under the Philippine Data Privacy Act of 2012 (RA 10173), the operator is the Personal Information Controller, and processing is based on your consent given at submission and on legitimate interests under Section 12.

A note on what counts as personal data here: if you submit anonymously or under a pen name, what we hold may not identify you at all. If you choose to give a real first name, or if your work itself identifies you, then it does. That is your choice to make, and the site is built so that choosing anonymity costs you nothing.

Who else is involved

We keep the number of third parties deliberately small.

• Cloudflare, Inc. — hosting, content delivery, database (D1), file storage (R2), bot protection (Turnstile) and administrator access control. Your request necessarily passes through Cloudflare's network, which handles IP addresses and connection metadata to deliver the site and block attacks. Cloudflare acts as our processor. See cloudflare.com/privacypolicy.
• Cloudflare Turnstile — shown on the submission form to distinguish people from automated abuse. It is used in place of a CAPTCHA that profiles you.

There is no Google Analytics, no advertising network, no social media pixel, no email marketing platform, no customer support tool, and no data broker. We do not sell personal information, and we do not "share" it for cross-context behavioural advertising as those terms are used in the CCPA/CPRA.

Where data is held

Data is stored on Cloudflare infrastructure. The database is provisioned in the APAC region; files and cached content may be served from Cloudflare's global network, which means copies may be processed outside your country, including outside the EEA/UK. Where that involves a transfer from the EEA or the UK, it relies on Cloudflare's own transfer safeguards, including Standard Contractual Clauses.

How long we keep things

• An approved creation stays until you take it back, or until we take it off the Shelf under the Terms, the Submission Guidelines or a valid legal notice. There is no automatic expiry — the point of this place is that a thing stays findable.
• Taking a piece back, or our deleting one outright, erases the work and the stored file — not only its listing. What is left afterward is a minimal internal record (so the same take-back link can never be reused, and so our own counts stay accurate); it holds none of what you wrote or uploaded.
• A declined submission, or one we have taken off the Shelf without deleting it, is kept rather than automatically deleted, so we can recognise the same or a repeat abusive submission if it is sent again. It stays until we specifically delete it.
• An unfinished draft is deleted when it expires.
• Take-back links are stored only as a one-way hash, never in a usable form, and are marked used once redeemed.
• Reports are kept while the matter is open and for a reasonable period afterwards, so a repeat pattern can be recognised.

Your rights

Wherever you are, you can ask us to give you a copy of what we hold about you, correct it, or delete it. You can object to processing based on legitimate interests. Where processing is based on consent, you can withdraw it.

The practical route for most people is the take-back link, which removes your work yourself, immediately, without contacting anyone.

An honest limitation, stated rather than buried: because there are no accounts, we usually cannot verify that a person asking about a submission is the one who made it. If you submitted anonymously and no longer hold your take-back link, we may be unable to identify your work in order to act on a request — there is nothing linking it to you. This is a direct consequence of collecting so little, and it is a trade we made deliberately. Tell us as much as you can and we will do what we reasonably can.

If you are in the EEA or the UK you may complain to your local supervisory authority. In the Philippines you may complain to the National Privacy Commission (privacy.gov.ph). We would rather you told us first.

Younger visitors

We do not ask for your age. There is no date-of-birth field, nothing that displays how old you are, and you are not asked to prove anything in order to read or to leave something. That is deliberate: asking would mean collecting more about you, not less.

If you are under 18, we encourage you to involve a parent or guardian before leaving something here. If the law where you live requires their permission, you should have it before you submit.

Please do not include your age, school, address, contact details or location in what you leave, and please do not include anything that would identify another young person.

Because we do not ask, we cannot always know. We do not knowingly hold personal data from a child, and we may remove a submission if we believe it creates a privacy or safety concern involving someone under 18. If you believe a child has left something here, write to contact@astrangersshelf.com and we will remove it.

Changes

If this notice changes materially we will update the date above. Because we have no email addresses, we cannot notify you individually — another consequence of collecting so little.

Contact

contact@astrangersshelf.com — A Stranger's Shelf, operated from the Philippines.