Privacy Policy
How Who We Are treats your information, in plain words. In force from 26 October 2026.
The short version: you can use most of this site without giving us anything. If you join the community, we keep as little as we can, we explain every item below, we never sell or share it for advertising, and you can see it, download it and delete it at any time.
1. Who we are
Who We Are (shiningforever.in) is a free website about LGBTQIA+ lives, with games, a helper chat called Chai and a community (chat rooms, a wall and an art corner). It is run by Reiner Endrios from India ("we", "us"). In the language of India's Digital Personal Data Protection Act, 2023 ("the DPDP Act"), we are the "Data Fiduciary" for information you give the community. In the language of the Information Technology Act, 2000, we are an "intermediary" for what members post.
This policy covers the community and the other parts of the site that handle personal information. The shorter Privacy and safety page has practical advice for staying private on a shared device. Read this policy together with our Terms of Use.
2. What we collect
Browsing the site, reading the wall and looking at the art corner need no account and give us nothing about you as a person. The site has no cookies, no advertising, no tracking pixels and no third-party analytics.
A simple visit count. So we know whether the site is reaching people, each page view adds one to a daily count for the page and for the country it came from (the country is a guess made from the connection by our host, Cloudflare). To count a returning visitor once a day, the server makes a one-way code from the day, a secret and the connection details, and deletes that code after two days. We do not store your internet address, we cannot turn the code back into it, and nothing is saved on your device. The counts are seen only by the site owner. If your browser sends Do Not Track or Global Privacy Control, the count is skipped.
If you join the community, there are two kinds of account. The table says exactly what each one holds.
| Information | Anonymous account (13+) | Email account (18+) |
|---|---|---|
| Nickname and picture | Yes. Shown to others. | Yes. Shown to others. |
| Pronouns and a short line about you | Only if you add them in your profile. Both are optional, shown to others beside your messages, and you can change or remove them at any time. Please leave your real name, school and city out. | |
| Email address | No | Yes. Kept encrypted. Never shown to anyone. |
| Password | No password. A secret login key, kept only as a scrambled hash. | Never received or stored. See "How it is protected". |
| Your agreement | The time you agreed and the version of these documents. | The same, plus your confirmation that you are 18 or older. |
| What you post | Chat messages and reactions (kept for 7 days at most), wall posts, art pictures with their titles and captions, hearts, and weekly game scores. | |
| Activity records | When you joined and last visited, a count of messages the filter stopped, any breaks or holds, and reports you made or that were made about you. | |
| Sign-in records | A random session code on your device. We keep a scrambled copy. | The same, plus a count of wrong passwords, and a short-lived record of any code we emailed you (10 minutes). |
What we do not collect: your real name, phone number, address, location, contacts, device identifiers, or anything from your phone. We do not store your internet (IP) address. For rate limits, the server briefly keeps a scrambled version of it in memory only, mixed with a random value that changes whenever the server restarts, so it cannot be traced back. Our hosting providers (see below) keep their own technical logs.
On your device, the community keeps a session code in your browser's storage (local storage if you chose to stay signed in, otherwise session storage), a small copy of your nickname, picture and pronouns (so your picture can show in the top bar on every page), a list of people you chose to hide, and your look settings (the scenery, text size and whether things move). The scenery is drawn by your browser from code on this site; no image is loaded from anywhere else. These are not cookies and are not sent to anyone else. You can remove them by logging out, or with the "Clear everything" button on the Privacy and safety page.
Pictures you upload are cleaned of hidden data such as location before they are saved. Please don't include faces of other people, names or anything private in a picture or a post.
Parts of what you write can identify you without a name, for example a school or a village. Please think before you share details, and never share other people's.
3. Why we use it
| Purpose | What it uses | On what basis |
|---|---|---|
| Run your account and the community | Nickname, picture, pronouns and short line (if you add them), what you post, session records | Your consent, given when you join |
| Send you a code to confirm your email or reset your password | Email address | Your consent |
| Keep the community safe and kind: filters, reports, moderators, breaks and holds | What you post, activity records | Your consent, and our duty to act on unlawful content under the IT Act and its Rules |
| Stop abuse of the service (floods, fake sign-ups, guessing passwords) | Short-lived scrambled network address, wrong-password counts | Our need to protect the service and its members |
| Reply when you write to Mochi the bot | Your message and the last few lines of the room | Your consent |
| Answer your requests and complaints, and keep proof that you agreed | Agreement record, what you send us | Your consent, and our legal duties |
| Meet a legal order or protect someone from serious harm | Whatever the order or the emergency needs | The law |
We do not use your information for advertising, marketing emails, profiling, or tracking what you do elsewhere. We do not sell it, rent it or trade it. The only emails we send are the codes you ask for. The one exception is a short note to an address that already has an account, if someone tries to sign up with it again.
Decisions about your account are made by people. The filter and the safety checks on Mochi's replies are automatic, and they only stop a message. They do not decide anything about you beyond the short breaks described in the Terms, and a moderator can undo any of it.
4. Who else handles it
We use a small number of services to run the community. They handle your information only to do their job. We have chosen services that say they do not use it for advertising.
| Service | What it does | What it sees |
|---|---|---|
| Cloudflare | Runs the community server and its database, delivers the site's traffic, and (if switched on) runs the Turnstile check and Workers AI | Everything the community stores, in encrypted form on its systems; the network address of every request |
| GitHub (Pages) | Hosts the website's pages | The network address of anyone who loads a page. See GitHub's own privacy statement. |
| Resend or Brevo | Delivers the code emails (email accounts only) | Your email address and the message that carries the code |
| Groq or Cloudflare Workers AI | Writes Mochi's replies | The message Mochi is replying to and the last few lines of that room, with the nicknames shown there. Both say they do not train on what they receive. |
| GIPHY | Supplies GIFs | The words you search for (from our server, not linked to your name), and the network address of your browser when it loads a GIF |
| YouTube (Google) | Plays the trailers and songs on the Watch, Anime and manga, Sound and Music pages, in its privacy-enhanced mode | Nothing, until you press play on one. Then the network address of your browser and what YouTube's player normally receives. The small preview picture on each item is loaded from YouTube's image server when the page opens. |
| Have I Been Pwned (Pwned Passwords) | Warns you if a password you are about to use has appeared in a data leak | Only the first five characters of a scrambled copy of the password, sent from your browser. The password itself is never shared. Used when you sign up, reset or change a password. |
| ntfy | Sends the moderators a short phone alert, such as "something is waiting for review" | No personal information and nothing you wrote |
These services run in several countries, so your information can be processed outside India. The DPDP Act allows this unless the government restricts a country. We will tell you here if that changes.
We share information with the police, a court or a government body only when the law requires it, or when we believe it is needed to protect someone from serious harm. Where we can, we will tell you first. We do not give moderators access to email addresses, and the moderator tools cannot show them.
Be honest with yourself about this too: the person who runs the service holds the keys that the service needs to send you a code, so in principle they could decrypt a stored email address. We only do that to send codes, or if the law requires it.
5. How it is protected
No system is perfectly safe, and we cannot promise it. This is what we do, and it is the same sort of protection large services use.
- Your password never reaches us. On your device it is stretched with PBKDF2 (600,000 rounds of SHA-256, the number recommended by OWASP), using your email as the salt, and only the result is sent. On the server that result is mixed with a random per-account value and a secret held outside the database (an HMAC), and only that is stored. If the database were copied, it would still not be enough to start guessing passwords.
- Your email address is encrypted with AES-256-GCM before it is saved. A separate keyed hash lets us find an account from an email without keeping the address readable. All keys come from one secret held as an encrypted Cloudflare secret.
- Codes are six digits, random, stored only as keyed hashes, valid for 10 minutes, with five tries, and each one works once.
- Wrong passwords lock the account for 15 minutes after five tries. Sign-ups, log-ins, codes and password resets are rate limited. Passwords found in public data leaks are refused. Changing or resetting a password logs every other device out.
- Everything travels over HTTPS. Cloudflare encrypts what the community stores on disk (AES-256).
- Sessions are random 192-bit codes, stored only as hashes, valid for 45 days, and can be ended by logging out.
- Less to steal. We keep chat for 7 days, hold no names, phone numbers or addresses, and erase accounts that have not been opened for about 18 months.
- Limited access. Moderators see nicknames and what members posted. They do not see emails, passwords or login keys. Moderator accounts are given only by the owner.
Please do your part: use a password you don't use anywhere else, keep your login key private, and log out on shared devices.
6. How long we keep it
| What | How long |
|---|---|
| Chat messages and reactions | 7 days at most, or until you delete them |
| Wall posts and art | Until you or a moderator delete them. A rejected picture is deleted straight away. |
| Account (nickname, picture, pronouns, short line, hashes, encrypted email, agreement record) | Until you delete your account, or about 18 months after your last visit |
| Sign-up in progress and one-time codes | 10 minutes, then removed within the hour |
| Sessions | 45 days, or until you log out |
| Reports and the snapshot of what was reported | Until handled, then 30 days |
| Moderator action log | 90 days |
| Weekly game scores | About 8 weeks |
| A banned account | A bare record of the ban stays, with no email and no way to log in |
When you delete your account, everything above that belongs to you is deleted at once from our database. Copies held in our hosting providers' systems can take a short while to disappear completely. Emails already delivered stay in your inbox. Where the law makes us keep something, we keep only that, only for as long as the law requires.
7. Your rights
Under the DPDP Act you have the following rights. We apply them to every member, and you do not need to wait for the Act's dates.
- To know what we hold. Choose Download my data in the community menu for a file with your account details (including your email), messages, posts and picture titles. You can also ask us for a summary of the processing and of who handles your information, which is the table above.
- To correct or update it. You can change your password in the menu. To correct anything else, write to us.
- To have it erased. Choose Delete my account in the menu. It takes effect immediately.
- To withdraw your consent. Deleting your account withdraws it. It is as easy as giving it. Anything done before then stays lawful.
- To complain. Write to the Grievance Officer below. We acknowledge within 24 hours and aim to resolve within 15 days, and in any case within the time the law allows. If you are not satisfied, you can complain to the Data Protection Board of India. The Act expects you to raise it with us first.
- To name someone to act for you if you die or cannot act for yourself. Write to us with the details.
You also have a duty under the Act not to give false information or file false complaints.
8. Young people
Email accounts are for people aged 18 and over, because Indian law needs a verified parent's consent before an app handles a child's personal data, and we cannot check a parent. You must confirm your age when you join. If we learn that an email account belongs to someone under 18, we will delete it.
Anonymous accounts are open from age 13. They keep no email, phone number or real name, so we hold no personal details about a teenager beyond a nickname, a picture and what they choose to post. We do not track, profile or target anyone, and we show no advertising. We still ask young people to keep personal details out of their posts, and the filter blocks phone numbers, links and requests to move to another app.
We cannot verify anyone's age, and we say so openly. If you are a parent or guardian and have a concern, write to us and we will act on it quickly.
9. If something goes wrong
If we find that personal information was lost, leaked or misused, we will act quickly to stop it, tell the people affected without delay in a clear message, and report it to the Data Protection Board and any other authority as the law requires.
10. Changes to this policy
The version and date are at the top. If we change what we collect or why, we will update this page, and the community will ask you to read and agree again before you carry on. We also remind members of our documents at least once a year.
11. Contact and complaints
Grievance Officer and contact for privacy questions: Reiner Endrios
Email: shiningforevr@gmail.com
Please write "Privacy" or "Complaint" in the subject so it reaches the top of the pile, and never send your password, login key or a code.
We acknowledge every message within 24 hours. Complaints about private or intimate images, nudity or impersonation get priority, and we aim to act on them within 24 hours.
This policy is written to follow the Digital Personal Data Protection Act, 2023 and Rules, 2025 (whose main duties begin in 2027) and the Information Technology Act, 2000 with the Intermediary Guidelines Rules, 2021. It is a plain-language document and not legal advice.