How we protect you · Forthwith

How to read this page

Every line is marked. We do not describe unfinished work as done.

In place: This works in the live app today.
Not yet: We have not finished this. We list it so you know.

The short version

We do not sell your dataNot to advertisers, not to campaigns, not to anyone.
Private is private to the publicWhen you post Privately, other people see a generic author. Forthwith still knows who posted.
Our staff can do less than you might fearStaff review items in queues. No staff tool downloads member data or shows your exact home address.
We tell you what is not finishedSome protections are still being built. They are listed here, marked Not yet.

Protecting you from outside pressure and misuse

Anyone who wants to pressure people for what they believe may try to get data about them. These are the walls we build against that.

In placeWe do not sell your personal data.
In placePhotos of your government ID stay with our identity provider, Stripe. We keep the result of the check, not the photos.
In placeA Private post shows a generic author. Public pages and the data behind them do not show who is behind it.
In placePrivate does not mean anonymous to us. We know which account posted so we can stop abuse and answer valid legal orders.
In placeThere is no download or export of who took a position on something.
In placeWe do not give out who you are, where you live, or what you did on Forthwith because someone asks informally. That includes governments, employers, campaigns, and other companies. We need valid legal process.
In placeWe push back on legal demands that are too broad or look political. When the law allows it, we tell you before we hand anything over.
In placeWe keep less so there is less to hand over. Verification results, drafts, and contact history each have a time limit, listed in our Privacy Policy.
In placeWe use Google Tag Manager on the live site to measure how the site is used. Our Privacy Policy covers analytics.
Not yetSome cleanup jobs, like finishing account deletions and removing old drafts, still run by hand instead of on a schedule.
Not yetWe do not yet give you a way to opt out of site analytics.

Limiting what our own team can do

A promise that only says “trust us” is not enough. These are the limits built into the system, so the people who run it cannot easily abuse it.

In placeOnly two staff roles exist, Facilitator and Admin. Each is given by a named account, can expire, and can be taken away. Every grant is recorded.
In placeStaff tools check your role on our server and again in the database. Reaching a page is not enough. We test this automatically, including that a regular member is refused.
In placeStaff work from queues of items to review, like reports and appeals. No staff tool downloads member data.
In placeNo staff tool can show the exact home address you gave us.
In placeStaff review tools cannot change rankings or vote counts.
In placeA moderation decision cannot be edited afterward. A correction is a new record and the old one stays. Staff decisions are also written to an audit log that we keep for up to 7 years.
In placeDatabase keys that skip access rules live only on our servers, never in your browser.
Not yetStaff roles apply everywhere. A Facilitator can see review queues for every country, including identity and safety items. Today we rely on a small, trusted group and the audit log. Roles limited by country or language come later.
Not yetWe record what staff decide. We do not yet record every time staff open a sensitive item.
Not yetSensitive staff actions do not yet need a second person to approve them.
Not yetNo outside group audits these promises yet, and we have not published a report on legal requests and takedowns. We plan to publish that report.

What you control

You are not just protected. You are in charge of a lot of this.

In placeYou choose Public or Private each time you post or take a position.
In placeYou can block and mute other members.
In placeYou can report content and appeal moderation decisions.
In placeYou can delete your account in settings. A 14-day waiting period lets you change your mind. Some posts may stay under a “Deleted member” name so conversations still make sense.
Not yetYou cannot download your own data yourself yet. Email us and we will help.

How we keep this page honest

This page is reviewed whenever we change how we handle your data. When we finish something marked Not yet, we change the mark. If we ever weaken a protection listed here, we update this page first.

Our Terms of Service and Privacy Policy are the legal documents. This page explains how the system works in plain words.