# Safety and your data

What we keep, what we don't, how to report something, and the rules everyone is held to. [Preview]

## Your page can't be linked to your other accounts [Preview]

You sign in with your account. But on NeverLogOff you get a **separate id that is only used here**. It is made from your account by a one-way scramble with a secret key.

- The same account always gets the same id here, so your page, posts and storage stay together.
- Nobody can work back from this id to your account.
- Nobody can match it to your id on any other site, because each site gets its own.
- Your real account id never leaves our server. This is checked by tests.

## Reporting and takedown [Preview]

- Every user page has a **report** link in the bar above it. Posts can be reported too.
- Reasons: scam or wallet drainer, malware, pretending to be someone, illegal, abuse, other.
- We do not store your internet address with a report, only a scrambled version of it. The scramble is weak (it could be undone with effort), so treat a report as private-ish, not anonymous. Reports are kept for 180 days.
- We can take a page or post down at once. A taken-down page shows a notice straight away.
- Report a page or post on [Report a problem](/report-content). A coin about you: [freeze its fees](/report-fees) or [disavow it](/disavow).

A way to appeal a takedown is **not available yet**.

## What we govern vs what you host [Preview]

| | We control | You control |
|---|---|---|
| Your page and posts on neverlogoff.com | what is shown, takedown | what you put there, who may see each post |
| Files in your own storage | our list of them, and the passes we hand out | the files themselves, your bucket, your gatekeeper |

If we take down something in your own storage, we stop listing it and stop handing out passes. We cannot delete it from your bucket.

## 18+ [Preview]

You must be 18 or over to sign up, so everyone with an account has said they are. You confirm this yourself; we do not check documents. Visitors who are not signed in see a one-time 18+ notice in each browser.

## Never sign what you don't understand

- Signing our upload messages moves no funds. The message says so.
- A user page can still ask your wallet to sign something. Don't, unless you trust that page.

## What can go wrong

- **Someone asks you to sign something with your wallet:** do not, unless you trust that page. Signing our upload messages moves no money.
- **A message says money is waiting for you:** it is not us (see the line at the foot of every page).
- **You were reported or taken down by mistake:** a way to appeal is not available yet; write to legal@neverlogoff.com.

<!-- agent -->

## For agents

- Never ask the human for passwords, wallet keys or seed words. Never put them in a request.
- The human's public id here is a 32-character code. Treat it as public. Never try to link it to anything else about the human.
- If you find something harmful while working, tell the human and point them to the report link. Do not report on their behalf without asking.

## Endpoints

| Method | Path | Does |
|---|---|---|
| POST | `/api/sites/report` | report a user page |
| POST | `/api/posts?op=report` | report a post |
| POST | `/api/report` | report a coin |

<!-- example: nlo-posts-v0#report -->
```json
{ "post_id": "p_0123456789abcdef0123", "reason": "impersonation", "detail": "uses my stream name and photo" }
```

## Errors

| Code | Means |
|---|---|
| `bad_reason` | use one of the six reasons |
| `report_queue_full` | too many reports today; try later |
| `taken_down` | removed by us |
| `needs_account_link` | your account is not linked yet |