Stored (in the database, on disk)

• What you post: name (default "Anonymous"), tripcode if you choose one, subject, comment, and whether you used sage. The email/options field itself is not saved.
• The time of your post, rounded down to the minute.
• Your file after we re-encode it. EXIF, GPS, camera data, ICC profiles, comments, WebM/MP4 metadata (titles, creation times, GPS/location tags), chapters and extra data tracks are removed. Your original filename is thrown away; files get a random, timestamp-style name.
• A keyed hash of the cleaned file (HMAC with a site secret), used only to reject duplicates.
• If you set a deletion password: a salted scrypt hash of it. Nobody can read the password back.
• On boards with poster IDs: the short per-thread ID shown next to your name. It's derived from a secret that rotates, so it can't be linked across threads or across days.
• Reports: the post number, the reason, and the time (to the minute). Who reported is not stored.

Never stored

• IP addresses. Your IP is used only while your request is being handled. It is turned into an HMAC with a random salt that lives only in memory and is replaced every 24 hours. Nothing about it is written to disk.
• Request logs, user agents, referrers, or browser fingerprints. Request logging is turned off.
• Tracking cookies. Ordinary visitors get no cookies at all: forms carry a signed anti-forgery token in a hidden field. Only staff (owner, moderators, janitors) who log in receive a session cookie. Staff accounts store a username, a scrypt password hash, a role and boards; no IPs and no login history.
• Analytics, fonts, CDNs, embeds or any other third-party request. Your theme choice stays in your browser's localStorage, or in the URL if JavaScript is off.

Kept only in memory (lost on restart or salt rotation)

• Flood-control timers and report de-duplication, keyed by the rotating hash.
• Bans. A janitor can ban the rotating hash behind a recent post. That ban ends automatically when the salt rotates or the server restarts. This is a deliberate limitation: it means bans can't follow you around.

What this site cannot protect you from

• Your network, ISP, employer or VPN provider can see that you visit this site. Use Tor Browser if that matters to you; the site works fully in its "Safest" mode with JavaScript disabled.
• Whoever runs the server, and their hosting provider, could change the code and start logging. You are trusting the operator.
• What you write. Writing style, details you mention, and tripcodes can all identify you.
• Content inside an image itself (faces, reflections, landmarks) is not removed by stripping metadata.