Privacy Policy

• Your account: when you register we store your email, display name, and (if you set them) your bio, location, and avatar.
• What you do here: when you write, comment, react, follow, or report, we store those actions.
• Google sign-in: if you sign in with Google, we store the link to your Google account — never your Google password.

Only to run the site: to show your posts, build your reading feed, send the emails you ask for (password reset, login codes), and keep the platform safe from abuse. We do not sell your data.

We use only what the site needs to work:

• nb_rt: keeps you signed in. HttpOnly, about 30 days.
• nb_session: tells the page you’re signed in. It holds no credential. Same lifetime.
• nb_td: only if you tick “remember this device”, so you can skip the login code. 30 days.
• nb_oauth_state: protects Google sign-in. 10 minutes.

Your browser also stores your theme (nb_theme), your saved-post list (nb_saves) and private draft backups of posts you’re writing (nb:draft:*). These stay on your device. Cloudflare’s bot check at signup and embedded YouTube videos can set their own storage.

Not Bagel does not show ads right now. If we add them later, we’ll update this policy first and ask for your choice where the law requires it, before any advertising cookies are set.

A small set of service providers that make the site work. Each provider receives only what its job needs.

• Hosting and database: our hosting and database providers.
• Email: our transactional email sender.
• Google: if you choose Google sign-in.
• AI features: optional AI features (semantic recommendations) send post text to an embeddings provider at publish time. If a search has no keyword matches, its normalized query may be sent to OpenAI’s embeddings service even when you are signed out; the resulting vector is cached under a hashed query key for one day to avoid repeat calls.

• Edit your profile at any time.
• Delete your account in Settings. This removes your account, posts and media from the live site and our storage. Copies in our database backups age out when those backups expire. Newsletter emails already sent can’t be recalled.

Questions about your data? Email contact@notbagel.com and we’ll answer.