Privacy

Short version: no accounts, no tracking, no ads, no cookies for analytics. We never store your IP address, and we never sell anything — neither your data nor the messages.

Controller

Marc Sala — contact@messagetoai.com

Messages

• Your message, optional alias, language and optional opening date. Published openly because that is the purpose of the service, at your request (GDPR art. 6.1.b). Do not include personal data: messages are public, permanent, and may be copied by others and used to train AI models.
• Publication consent (optional): if you tick the box, we store the date and the version of the text you accepted, to be able to prove it (art. 6.1.a and 7.1). You can withdraw it at any time with your private link, or by writing to us.
• Private link: we store only a cryptographic hash of it, so we cannot recover it for you.
• Previous versions: when you edit your message, the earlier text is kept privately (for moderation) together with the date. It is never published and is deleted with the message.
• Emailing your link (optional): the address you type is used to send that one email through our email provider and is not stored by us. We only count how many times the link was sent (at most twice).
• Approximate country (two-letter code) worked out by our hosting provider from the connection, used only for aggregate statistics. It is never shown next to a message nor included in the public dataset (legitimate interest, art. 6.1.f).

Abuse prevention

• A keyed hash of your IP address (HMAC-SHA256 with a secret key). The IP itself is only held in memory during the request and is never written to disk. The hash limits how many messages, reports and sign-ups one connection can send (art. 6.1.f). Rate-limit records are deleted after 24 hours; the hash attached to a message is deleted after 30 days.
• Reports (reason, optional comment, IP hash) to moderate content.
• Illegal-content notices (name and email if you give them) to handle the notice and reply, as required by the EU Digital Services Act (art. 6.1.c). Kept for up to 2 years.

News by email

Optional and unrelated to posting messages. If you sign up, we store your email address, the date and the version of the consent text (art. 6.1.a). We send a confirmation email first (double opt-in); addresses not confirmed within 7 days are deleted. Every email includes a one-click unsubscribe link, which deletes your address. We only write to announce news about the project, such as a book.

Donations

Donations are processed entirely by Stripe on its own pages; we never see card details and we don't store any donor information. We only read the monthly total to publish it on the support page. Donations are never linked to messages.

Visit statistics

We use Vercel Web Analytics to count visits in aggregate (pages viewed, referring site, country, device type). It uses no cookies and doesn't follow you across sites or over time: visitors are only told apart within a single day, using a hash that is discarded daily. We strip every query string and fragment from the addresses we send, and we never record private pages (your private link, subscription links, admin). Legal basis: legitimate interest in knowing whether the project reaches people (art. 6.1.f).

Service providers

• Vercel Inc. — hosting and aggregate visit statistics. May process data in the USA under the EU–US Data Privacy Framework.
• Neon (Databricks) — database, EU region.
• Cloudflare Inc. — Turnstile, a privacy-preserving anti-bot check. It does not use tracking cookies.
• Resend Inc. — sending of confirmation, news and private-link emails.
• Stripe Payments Europe Ltd. — donations (independent controller for payment data).

Cookies and storage

No tracking, advertising or analytics cookies. Only these, all strictly functional:

• After you post, a cookie mta_wrote (10 years) holds only the id of your message, and your browser's local storage holds that id and your private link. They exist only to apply the “one message per person” rule — showing you your message instead of the form — and to take you back to it. You can delete them at any time; deleting your message removes them too.
• Your day/night preference, in local storage. Never sent to us.

Your rights

You can request access, rectification, erasure, restriction or objection, and withdraw any consent, by writing to contact@messagetoai.com. Since messages are anonymous, we cannot always verify authorship; we will always remove a message that contains your personal data. You may also complain to the Spanish Data Protection Agency (aepd.es).