A sign on a sidewalk in Portland with a QR code on it. One person runs it. It is not a company.
Your IP address is never stored. Every per-person limit on this site is keyed to a one-way mathematical scramble (an HMAC) of your network prefix, not to you directly. Photos have their metadata stripped before publication, including any location the camera recorded. Microphone audio is never recorded or transmitted. Location is never transmitted — see below.
| What | How long |
|---|---|
| Unpublished photos and your email address | 30 days |
| Daily submission limits | 48 hours |
| A temporary block to prevent abuse | 24 hours |
| Published photos and the submitter's address | While published |
| Account deletion cooldowns | 48 hours |
| Abuse prevention (permanent blocks) | Indefinitely |
| Reported photos (kept for review) | Indefinitely |
| Deletion receipts (no identifiers) | Indefinitely |
| Anonymous metrics/counts | Indefinitely |
| Site visitor metrics (no PII) | Indefinitely |
Only collected if you sign in with Google to leave a photo or take a story turn. Kept alongside a published photo so it can be taken down on request. Not used for marketing, never sold, never shared.
You can manage your data at the account management page. When you delete your account, your published photos and review queue photos go away. Your link to any stories you participated in is severed. Your account goes, requiring a 48-hour cooldown before you can sign in again (to stop people from bypassing daily limits by deleting and recreating accounts).
What stays: Copies already downloaded by other visitors are out of our control. Photos that were reported to the operator, and your address block record stay. Story prose in the public archive stays (it contains no identifier). Anonymised analytics stay.
For the blob's walks: your browser is asked for your position, the coordinates are held in your own browser only, and the only thing that ever reaches the server is a distance in metres and a duration in seconds. No coordinates, no route, no start or end point.
For Scream Into the Void: the browser's audio is analysed in the page and discarded frame by frame. Nothing is recorded, nothing is uploaded. The only thing sent is a loudness number and how long it lasted.
For the Useless Time Calculator: the question you picked, the number or date you typed, and the answer generated, kept with a date and time and no identifier of any kind. The questions only ever accept a number, a date or a choice — never free text — so there is nothing there to identify you with. One question asks your birth date; only your age in days is stored, never the date itself.
GA4, with ad signals and ad personalisation switched off and IP anonymisation on.
If the self-service page won't do it, or if you need to ask for something to be removed, contact: hello@thanksforwalkingby.com