What we collect, and what we deliberately don't.
Most privacy policies are written to protect the site from the reader. This one is written to tell you what actually happens, because a project built on evidence should not ask you to take its own conduct on faith.
The short version: we store no email addresses and no raw IP addresses. You can read this entire site, including every article and every corpus document, without an account and without giving us anything.
1. Who runs this site
Theories of Anything is an independent research project. It is not a company, and it does not sell your data to anyone, because it does not have the kind of data anyone would want to buy.
Data controller: Theories of Anything, United States. Under the UK and EU GDPR the controller is whoever decides why and how data is handled, and naming one is not optional even for a project this size. Every request reaches us through the contact page.
Why we are allowed to hold what we hold. For accounts and anything you post, the basis is the agreement you enter into by creating an account (Article 6(1)(b)). For spam control, moderation, and the aggregate page counters described in section 2, the basis is our legitimate interest in keeping the site working and honest (Article 6(1)(f)), which we consider proportionate precisely because none of it identifies you. For Google Analytics, the basis is your consent where the law asks for it first: in the EEA, the UK and Switzerland a banner asks before Google’s script loads at all. Elsewhere it loads with the page, and section 7 tells you how to say no anywhere, at any time.
For any privacy question, the contact route is on the contact page, and it is the same route used for the rights described in section 7. If you are in the UK or EEA and think we have got something wrong, you also have the right to complain to your national data protection authority.
2. If you only read
You do not need an account to read anything here. If you are only reading, two things measure your visit.
Our own analytics, which are deliberately anonymous
The site runs its own first-party page counter. It was built to answer one question — which pages people actually read — without building a profile of anyone. Its design constraints are not marketing language; they are enforced in the code:
- No cookie, no local storage, no persistent identifier. Nothing is written to your device by this system.
- Your IP address and browser string are hashed in memory and discarded. The raw values are never written to disk.
- The hashing salt rotates daily, and the previous day's salt is then deleted, so once rotation has happened yesterday's visitor hash cannot be recomputed or matched to today's, even by us. One honest caveat, because we would rather state it than round it off: rotation is triggered by the first page view of a new day, so on a quiet day there is a window after midnight UTC in which the previous salt still exists. We are fixing that to run on a timer instead.
- If your browser sends Do Not Track or Global Privacy Control, you are counted as an anonymous pageview only.
- Known bots are discarded before anything is written.
What it records: the page path, the referring site if there is one, roughly how long the page was open, and browser performance timings (how fast the page loaded and responded). What it keeps permanently: daily per-page counters. Numbers, not people.
Google Analytics, which is a third party and is not anonymous
We should be straightforward about this one. This site also runs Google Analytics 4 (property G-FH1H5SPXVX), on every page except this one. Unlike our own counter, Google Analytics sets cookies, and Google processes that data under its own privacy policy and for its own purposes as well as ours.
If you are in the European Economic Area, the United Kingdom or Switzerland, we ask first. A small banner asks whether we may count your visit, and Google’s script is not loaded at all until you say yes. We tell where you are from the time zone your device reports, and we err toward asking: every European time zone is asked, and so is a device that reports no time zone or plain UTC. Google’s own regional setting is a second layer: in those countries it keeps Google’s cookie off until a yes, even for a visitor the time zone missed. Everywhere else, we count from the first page.
Never counted: a browser that sends Do Not Track or Global Privacy Control loads nothing of Google’s here, anywhere in the world. Our own visits from our own machines are filtered out of the counts. Advertising storage, ad user data and ad personalisation are switched off for everyone, Google signals is off, no advertising account is linked, and Google’s option to use this data to improve its own products is switched off.
It is the only thing we put on this site that behaves like conventional web tracking — but it is not the only such thing on the page. Our web host injects a script of its own into every page it serves, and that one sets a year-long identifier. We did not add it and cannot remove it from our side; section 5 says exactly what it is. If you would rather neither of them ran, the browser controls in section 7 stop both.
Google Analytics collects the usual: pages viewed, approximate location derived from IP, device and browser type, and how you arrived. Google Analytics 4 does not store the IP address itself, and we see the results only as counts and charts, never as a record of any one person. Google's own description is at policies.google.com/privacy.
3. If you create an account
Accounts exist so you can post thoughts, propose theories, join topics, and take part in live discussion. Creating one is optional and reading never requires it.
What an account actually contains
There is no email field. Registration asks for a username and a password, and nothing else. We do not ask for your email address, we have nowhere to put it, and we cannot email you.
Because of that, password recovery does not work by email either. When you register you are shown three one-time recovery codes. Write them down. They are stored only as irreversible hashes, so if you lose them we cannot recover your account for you — nobody can.
The account record holds: your username, an irreversible hash of your password, when the account was created, roughly when it was last active, its standing (active, restricted, banned), participation counters used for trust levels, and any optional profile text you choose to add, such as a short bio or your favourite of the six questions.
What you post
Thoughts, replies, theories, topics, chat and debate messages, and echoes are stored with your user ID so they can be shown under your name. Posts made in public areas are public. Assume anything you post can be read by anyone, including people who are not signed in and search engines.
Posted content carries a hashed form of the IP address it came from, used for spam control and moderation. The raw address is not stored. Rate limiting and moderation records work the same way.
Moderation
Moderator actions are written to an internal audit log so that decisions can be reviewed. If you report a post, your report is linked to your account so the same post cannot be reported twice by one person.
4. Cookies and local storage
The complete list — ours and our host's alike. There are no advertising cookies on this site, because there is no advertising on this site. The last three rows are not ours: they are set by a script our web host adds to every page after our own file ends, described in section 5.
| Name | Set by | Purpose | Lifetime |
|---|---|---|---|
yt_sess | This site | The PHP session cookie. It carries no identity of its own, only a session handle, and is marked HttpOnly and SameSite Lax, and Secure over HTTPS. It is what keeps you signed in, but note that it is set on community pages whether or not you have an account, because the session is what the page checks in order to find out. It is strictly necessary for the site to function. | Until you close the browser |
yt_in | This site | A single flag reading 1 that tells the page you are signed in, so a signed-out visitor's browser never asks the server for member data at all. It contains no identity, only yes or no. |
Cleared on sign-out |
_ga, _ga_* | Google Analytics. Distinguishes visitors and sessions. Set only once you are counted: after a yes in the EEA, the UK and Switzerland, and never for Do Not Track or Global Privacy Control. | Up to 2 years | |
analytics-choice | Us, in your browser’s local storage (not a cookie) | Your answer to the analytics banner, yes or no, so we do not ask again. It never leaves your device. | Until you clear this site’s data, or change your answer |
_tccl_visitor | Our web host (GoDaddy) | Not ours. A random identifier that marks your browser so the host's performance monitoring can tell one visitor from another across visits. It is the longest-lived and the most identifying thing on this page, and it is the one we have least control over. See section 5. | 1 year |
_tccl_visit | Our web host (GoDaddy) | Not ours. The same identifier on a short clock, which is how that system decides where one visit ends and the next begins. | 30 minutes |
_scc_session | Our web host (GoDaddy) | Not ours. A count of pages seen in the current visit and the time of the last one. | 20 minutes |
The site also uses your browser's local and session storage for small pieces of interface state: whether you have dismissed a notice, whether a panel is open, cached unread counts, and whether you have acknowledged the discussion ground rules. These stay on your device, are never sent to us as identifiers, and clearing your browser data removes them.
Our own page counter, described in section 2, uses none of the above.
5. Third parties
The complete list of outside services your browser contacts while using this site. Two of them are ours. One of them is not, and we would rather explain it than leave it out.
- Google Analytics (Google LLC), on every page except this one, and in the EEA, the UK and Switzerland only after a yes. We added it. Covered in section 2.
- YouTube, only on pages that embed a video. We added it. These embeds use
youtube-nocookie.com, YouTube's privacy-enhanced mode, which does not set tracking cookies unless you actually play the video. If you play it, YouTube's own terms apply. - GoDaddy, the company we rent the server from, on every page. We did not add it and we cannot remove it. Explained immediately below.
The one we did not put here
Our web host appends its own tracking script to every page it serves, including this one. It is not in the files we upload. It is spliced into the response after the page we wrote has ended, on its way to you, and the first we can see of it is in what your browser receives.
It arrives as two pieces: a small block recording which server and data centre this site is served from, and a script called tccl.min.js, fetched from img1.wsimg.com — a host belonging to that same company. It sets the three cookies at the bottom of the table in section 4, one of which identifies your browser for a year.
Their own note, left inside the injected code, reads: "Monitoring performance to make your website faster. If you want to opt-out, please contact web hosting support." So opting out is a support request made by the site owner, not a setting either of us can toggle, and until that request is made and granted your browser fetches that file on every page here. The browser controls in section 7 stop it at your end in the meantime.
What this does to the sentence above. Everything this policy says about what we collect remains exactly true. But the question a reader is really asking is what runs in their browser and what lands on their device, and on this host the honest answer includes something we did not choose. We would rather write that down than let a cleaner sentence stand and be wrong about the only thing it was measuring.
With that named, the list is complete. In particular, the social icons in the footer are plain links. They are not embedded widgets or share SDKs, they load no third-party code, and they report nothing to Discord, Facebook, Instagram, X, Reddit or WhatsApp unless you click one and go there yourself.
We do not use advertising networks, data brokers, session recording, heatmaps, fingerprinting, or A/B testing services, and we have added nothing to this site beyond the first two entries above. We do not sell or share personal information, and we do not have the kind of records that would make that possible. What our host does with what it collects is governed by its own privacy policy, not by this one.
6. How long we keep things
| What | How long |
|---|---|
| Daily per-page view counters | Kept indefinitely. They are aggregate numbers with no personal data in them. |
| Anonymous visitor sessions (hashed, salted daily) | Short-lived, and unrecoverable once the daily salt rotates. |
| Your account | Until you delete it. |
| What you posted | Until you or a moderator removes it, or you delete your account. |
| Moderation and audit records | Retained for accountability, so that a moderation decision can be reviewed after the fact. |
| Google Analytics data | Fourteen months, then Google deletes it. What we read are counts and charts. |
7. Your rights, and how to actually use them
Depending on where you live, you may have rights under the UK and EU GDPR, the California Consumer Privacy Act, or similar laws: to know what is held about you, to get a copy, to correct it, to delete it, and to object to processing.
Here, most of those are simpler than usual, because there is so little to exercise them against.
Access and correction
Everything your account holds is visible to you on your own account page while signed in. Profile fields can be edited there.
Deletion
You can delete your account yourself from your account page. There is also a standing route on the data deletion page that works whether or not you can still sign in.
Stopping Google Analytics, and stopping our host's script
Because we do not hold an identifier for you, the practical controls are on this site and in your browser:
- Say no on the banner, or change your answer at any time: open the site with the choice showing. A no stops the counting in this browser and clears Google’s
_gacookies here. Your answer is kept in your browser’s own storage underanalytics-choiceand never leaves your device. - Install Google's official Analytics opt-out add-on.
- Or block third-party scripts and cookies for this site in your browser settings, or use a browser or extension that does so by default. This is also the only control you have over the host-injected script described in section 5, since that one is not ours to switch off. Nothing on this site breaks if you block either.
- Enabling Do Not Track or Global Privacy Control stops Google Analytics here entirely, and tells our own counter to record you as an anonymous pageview only. We have no way to make that signal reach our host's script.
Making a request
Write to us via the contact page. Because we hold no email address for you, we cannot verify a request by matching it to one; for anything account-specific, the reliable proof is doing it from inside the signed-in account.
8. Children
This site is not directed at children. Accounts are intended for people aged 16 or over, and we do not knowingly collect information from children under 13. If you believe a child has created an account, tell us through the contact page and we will remove it.
9. Security
The site is served over HTTPS. Passwords are stored only as irreversible hashes and are never recoverable in readable form, by us or by anyone. Recovery codes are stored the same way. Session cookies are HttpOnly and SameSite Lax. Form submissions carry cross-site request forgery tokens, and database access uses prepared statements throughout.
No system is perfectly secure, and we will not claim otherwise. The strongest protection here is structural rather than promised: the most sensitive thing a breach could expose is a username and a password hash, because your email address, your real name, and your IP address are not in the database to begin with.
10. Changes to this policy
If this policy changes materially — a new third party, a new category of data, a change in retention — the effective date at the top changes with it, and the change will be noted on the site. This page describes what the site does today, and it is checked against what this site actually serves you rather than written from memory — which is not the same as checking our own code, because our own code is not the only thing in the page your browser receives.
11. Contact
Privacy questions, data requests, and corrections all go to the same place: the contact page.
If you think something on this page is inaccurate about what the site actually does, we would genuinely like to know. Getting that wrong would be a worse failure here than on most sites.