Three rules, and they’re the whole list.
Everything else people usually write into a policy is downstream of these. What we do with your photo, your email and your messages is further down this page.
At the door we ask for a date of birth, check it against today’s date, and then we don’t keep the date. If this isn’t the right visit, we’ll say so and we won’t make the account.
Rule 1 — Be a person.
Use your own face and your own words. If someone can’t tell there’s a human on the other end, you’re in the wrong place.
Rule 2 — Don’t be a nuisance.
No selling, no recruiting, no sending the same opener to forty people. If they stop writing back, that was the answer.
Rule 3 — Be kind.
You don’t have to be interesting. You do have to be decent. Disagree all you like — just do it the way you would on a bench.
What happens to your face, your email and your words.
This isn’t a policy. It’s a description of what the code on this site does, written by reading it. It is short because the product does very little.
Your photo is checked on your own computer
The face check runs in your browser. The two models it uses and the runtime that runs them are files on this site — your browser downloads them from us and does the looking on your own machine. No part of the check is a request to us or to anyone else, and there is no third party involved in it at all.
A profile photo isn’t uploaded until it passes
If the check doesn’t find a face, the photo never leaves your computer — we never receive it, so there is nothing for us to delete. The extra photos you can add afterwards are different, and you should know it: those are not face-checked, so they upload straight away, the same as any other file upload.
Your email signs you in, and almost nothing else
The view of you that other people get is built without your email address in it: your name, your about, your photos, when you joined, when you were last here. Your email is added only to the copy of your profile that gets sent to you. It is not searchable and it is not shown on your profile. There is no newsletter. This site sends email only to you, and only for three reasons: the link that confirms your address, a link to set a new password if you have forgotten yours, and — only if you opted in — a short note when someone is waiting for a reply while you are away. That waiting note never includes the message itself.
Forgetting your password no longer costs you the account
Ask for a link and one is sent to the address on the account — only ever to that address, and only if there is an account, and the screen says the same thing either way so nobody can use the form to find out who has one. The link works once and stops working after 30 minutes. Asking again cancels the previous link. What is stored here is not the link but a one-way scramble of it, so a copy of our database contains no working links. And setting a new password signs the account out of everything, everywhere, at once: if a stranger got into your account, that is the thing that removes them.
But your email may have picked your name
When you sign up we guess a display name from the part of your address before the @ — “ada.lovelace@…” starts you off as “Ada Lovelace”. If the guess doesn’t look like a name we call you “Neighbour” instead. Either way it is the name strangers see, so if you’d rather they didn’t read your address off it, change it on your profile.
Your password is never stored as your password
It is put through scrypt with a random salt that belongs only to you, and only the result is saved. Nobody with the database can read your password out of it, and that includes us.
Your messages sit in a file on the server
Every message, profile and conversation on Plaza lives in one SQLite file on the machine running the server, and your photos as ordinary image files next to it. They are not encrypted, and anyone with the server can read them. Messages are not scanned, not analysed and not sold — there is no code here that does any of those things — but “private from other users” is not the same as “private from the server”, and only the first one is true.
Your photos are behind the sign-in, not just behind a hard address
Each photo is stored under an address made of sixteen random bytes, and that address is checked as well as being unguessable. Signed out, it gives you nothing. Signed in, it gives you a photo only if you are allowed to see the person in it - so if you block someone, the link to their face stops working for you the same second their profile does, even if you saved it first. A photo you are not allowed to see answers exactly the way a photo that was never there answers, so nobody can use it to work out who blocked them.
Your birthday is checked, then thrown away
The date of birth is read on the server, compared with today’s date, and not written down. What is saved is a single yes: this account has given a date of birth. An account from before that question is asked once, the next time it signs in, and then the same yes is all we keep.
One cookie, and one thing loaded from elsewhere
Signing in sets one cookie: a random session id, thirty days, unreadable by scripts and not sent from other people’s sites. If the door has already answered for this visit, the browser gets one more cookie for a short while. It does not contain a date of birth — it only means we already answered, so a different date in the same visit is not a new question. There are no analytics, no trackers and no advertising anywhere in this product. Nothing on this page is fetched from anybody else — the typeface used to come from Google, which meant Google’s servers saw that a browser at your address had asked for it. It is served from here now, so they do not.
Your IP address
Like most websites, Plaza uses Cloudflare to keep the site fast and safe, so Cloudflare briefly sees your connection’s IP address. Plaza never saves your IP address with your account. To slow down spam we keep a scrambled version in memory for up to two hours. A tab you leave open keeps its own scrambled version only while it is open, and that goes when you close it. Our server logs are cleared after 7 days.
There is a way to report someone: it’s on their profile, and in the header of the conversation you’re having with them. A person reads every one of those. Nothing happens to anybody automatically.
If you want to write to us, email ausecours@plazahangout.com. Someone will read it. This isn’t a ticket system — just an address.
Want to improve your experience? Let me know.
Back to the Plaza