SayHi privacy
Your displayed name, message and optional website or email contact become public when published. New posters require owner review. The site owner may separately trust a verified account to publish automatically; changed public contacts and suspicious content can still be held for review. Email verification proves access to a mailbox, not the identity behind a displayed name. Only enter an email in the public contact field if you want it visible to everyone. Keep passwords and private details out of messages.
When email sign-in is enabled, SayHi stores your sign-in email privately with account verification and trust settings. It never copies that address into the public contact field. Any email you deliberately supply as a public contact is visible to visitors and may be collected by them. It stores keyed hashes of short-lived verification codes, browser-bound challenge records, hashes of email-change or outstanding verification-link tokens, and hashes of poster-session tokens, and uses a necessary HttpOnly cookie for a session lasting up to seven days. Sign-in codes expire after ten minutes, are single-use, and work only in the browser that requested them. Five incorrect attempts lock that code challenge. Email-change or outstanding verification links also expire after ten minutes and require confirmation in the requesting browser. Sign out this device or all devices from the Account page. A completed email change resets trust and signs out existing sessions.
SayHi also uses a necessary session cookie to protect posting and owner sign-in. It stores a keyed network-address fingerprint to limit spam and block abuse. When the site operator runs its maintenance command, it removes message fingerprints older than seven days. Expired code challenges, verification links and sessions are cleaned up when sign-in requests are processed. Messages and accounts remain until removed; private recovery backups can retain earlier records. Hosting logs have separate retention settings.
When enabled, verification links are sent through the site’s configured mail service. The site owner can receive a limited alert that messages await review; alerts do not include your email or message text. Mail delivery and hosting logs follow the site operator’s service arrangements. There are no advertising trackers or third-party scripts. Use the private contact page to check contact availability; never post private contact details in SayHi.