WhatMakesMeHuman

Purpose of This Policy

WhatMakesMeHuman is a digital reflection platform designed to let anyone record a moment that made them feel human—without being observed, tracked, or profiled. We believe that privacy is not a feature; it is the foundation of the project.

This Privacy Policy explains what data we process, why we process it, and how your anonymity is protected by design.

1. Data We Do Not Collect

We deliberately do not collect or store:

• Your name
• Email address
• Passwords
• Account details
• Location data
• Device identifiers
• Browser fingerprints
• Cookies used for tracking or profiling
• Anything that could reasonably link a moment back to you

There are no user accounts. There is no login system. There is no profile associated with your submissions.
Your reflection stands alone.

2. Data We Temporarily Process

To protect the service from automated abuse, spam, or hostile activity, we create a temporary, irreversible hash of your IP address at the moment you submit a reflection.

This hash:

• Cannot identify you
• Is not stored alongside your reflection
• Exists solely to enforce a submission cooldown
• Is automatically deleted within six (6) hours

After deletion, no data remains that could associate you with any submitted content.
This approach aligns with Data Minimisation and Privacy by Design under the UK GDPR and EU GDPR Article 25.

3. Data We Store Permanently

When you submit a reflection, we store:

• The text you wrote
• The tone you selected (e.g., Joy / Struggle / Quiet / Light)
• Optional image content (if enabled)
• The date associated with the reflection
• A three-word identifier generated for you at submission time

This identifier is not linked to any personal data. If you lose the code, we cannot retrieve your moment. We have no way to know who wrote what.

4. Subject Access Requests (SAR)

Under data protection laws, individuals may request access to personal data held about them.

Because we do not store personal data:

• We cannot fulfil Subject Access Requests
• We cannot modify or delete content without the three-word identifier
• We cannot recover a moment if the code is lost

This is an intentional part of our architecture.

5. Image Uploads (When Enabled)

If and when image uploads are available:

• Uploaded files are stripped of metadata (such as GPS coordinates, device details, or timestamps)
• Users are responsible for removing identifying elements in the visible content
• We cannot remove faces, names, or personal information from the image itself

6. International Transfers

No personal data is transferred outside the UK or EU because none is collected.

7. Contact

Since we do not hold identifiable data, most privacy enquiries cannot be actioned. However, for general questions:

📩 [email protected]
(This address does not accept SAR requests.)

Summary

• We cannot track you
• We cannot identify you
• We cannot profile you
• We cannot retrieve your moment without your phrase
• Your reflection exists only as you wrote it, disconnected from you forever

Your humanity is your own.