everyidea
English
中文English日本語
☰

PRIVACY

Privacy Policy

This policy explains how everyidea.cool handles information while providing accounts, project records, and realtime interactions.

  • We process only what the service needs
  • Sign-in sessions use secure cookies only
  • Ghost conversation records are restricted to admin review
  1. 01

    Scope

    This policy applies to information produced when you visit everyidea.cool, use Google sign-in, browse project records, express interest, perform crew assessments, or use live presence features.

  2. 02

    Google sign-in information

    When you sign in, Google OAuth provides a Google account identifier, verified email address, profile name, and avatar. These are stored in Cloudflare D1 to identify the account and synchronize basic profile details. Realtime interactions prefer your chosen public display name, then @handle, and otherwise use a safely normalized Google profile name. Your email, Google account identifier, and avatar are not shown to other visitors. The site never asks for, receives, or stores your Google password, requests verification codes or payment information, asks you to install software, or stores Google access tokens or refresh tokens.

  3. 03

    Project interaction data

    When interest or crew assessment features are used, the site records the related account, idea, selection or assessment, and update time. Public pages may show project content, progress, assessment results, and aggregated interest. Google account identifiers and email addresses are not displayed as public project information.

  4. 04

    Realtime presence data

    Realtime features process a random connection identifier, sign-in category, public display name, cursor position, presence state, whether someone is typing, send time, and either signed-in short text or an anonymous message's grapheme count. Typing presence is only a boolean state and never contains draft text. Anonymous text is not sent to the Worker; the browser sends only its normalized grapheme count for acknowledgement and hidden-message rendering, and anonymous messages do not trigger contextual responses. The room keeps the accurate anonymous connection total, while each client syncs at most six stably sampled remote anonymous identities. A signed-in user's public display name, cursor, and text are briefly broadcast to people on the same page. After a live cursor connection succeeds, the site uses an irreversible identity key to update the deduplicated historical count of real visitors; repeated connections by the same identity do not increase that count, and Ghost receives only the aggregate number. When a signed-in visitor interacts with Ghost in a one-person room, D1 also stores the public display name, site role, page room, sent text, and Ghost's final reply or silence outcome for administrator iteration review; if sensitive-content screening is triggered, only an omitted state is stored instead of the original text. The public realtime identity may be cached in Cloudflare Cache for up to 30 seconds under an irreversible key. The raw IP is used only at the Worker entry point to derive private abuse-control identifiers and is not forwarded into the realtime room, disclosed, or stored as business data. During a one-person interaction, the Durable Object may temporarily keep compressed room context and deletes it when Ghost leaves, another person enters, or the state resets. Signed-in users may separately be associated through an irreversible key with a cross-visit continuity summary that contains no original messages. Aggregate operational data excludes names, IP addresses, and message content.

  5. 05

    Cookies and technical information

    Sign-in uses a JWT cookie with a maximum lifetime of seven days. On HTTPS, cookies use HttpOnly, Secure, and SameSite=Lax attributes. Cloudflare may process IP addresses, request times, browser request headers, and error information while delivering requests, preventing abuse, and diagnosing failures.

  6. 06

    How information is used

    Information is used only to authenticate users, maintain accounts, present project records and aggregates, provide realtime interactions, secure the service, limit abuse, and diagnose operational issues. The site does not sell personal information or use it for cross-site advertising.

  7. 07

    Service providers and disclosure

    Google handles sign-in verification. Cloudflare Workers, D1, and Durable Objects host and process the site. Personal information is not disclosed to unrelated third parties except where necessary to provide these functions, comply with applicable law, or protect users and service security.

  8. 08

    Retention and security

    Account details, interest records, crew assessments, irreversible realtime visitor deduplication keys, and signed-in Ghost conversation turns remain in D1 for as long as needed to maintain accounts, historical visit counts, project records, feature iteration, and security operations. Ordinary realtime text is not retained as a chat record. Room-local short-term context is deleted when Ghost leaves, privacy mode begins, or the state resets; signed-in cross-visit interactions may also retain a compressed continuity summary without the original conversation. The site uses HTTPS, secure cookies, same-origin validation, and administrator access isolation, but no online service can guarantee absolute security.

  9. 09

    Your choices and policy updates

    You can choose not to sign in, sign out, or clear browser cookies. Realtime controls let you pause the connection, hide cursors, or mute messages. When this policy changes, the updated text will be published on this page and apply from publication.