Privacy Policy
Version 2026-10-27. Last updated October 27, 2026.
This policy explains what information FLOORHOLLER collects, how it is used and shared, how long it is kept, and what choices you have. FLOORHOLLER is run by Michael Valentino, an individual doing business as FloorHoller. It was written to match how the site is built. Where something depends on settings or services outside our code, we say so, and where we have not set a rule (for example a retention period), we say that too.
1. The short version
- Your username, threads and replies are public, to everyone, with or without an account.
- Your Google name, email address and photo are not shown to other users and are not stored in our database.
- We do not run ads, we do not use advertising or analytics trackers, and we do not sell your personal information.
- There are no private messages. Nothing you post is private.
- Moderation records (including copies of reported or removed content) are private to the administrator and are not deleted automatically.
- There is not yet a self-service "delete my account" button. See section 11 for what you can do.
2. What we get when you sign in with Google
Sign-in is handled by Google through Firebase Authentication. When you sign in, Google gives our website a sign-in token that includes a unique account ID, and may include your name, email address, whether Google has verified that email, and your profile photo. Our server checks the token with Google. It uses the email address only to (a) make a one-way "fingerprint" (a salted hash) so that a ban or suspension cannot be avoided by creating a second account with the same Google email, and (b) recognize the administrator. Our database does not store your email address, name or photo.
Google itself keeps your profile details in the Firebase Authentication user list for this project, which the site operator can see in the Google/Firebase console. Your use of Google sign-in is also covered by Google's privacy policy.
3. What we store
| Information | Public? |
|---|---|
| Your username, and when you posted | Yes |
| Threads and replies you write (text, time, where in the conversation, and your chosen position on statements), and upvote totals | Yes |
| Your Google account ID and a one-way author key, stored with your account and your posts (not shown to others), and the date your username was created | No |
| The one-way fingerprint of your verified Google email (cannot be turned back into your email) | No |
| Which versions of the Terms, Privacy Policy and Guidelines you accepted, and when | No |
| Which items you upvoted, and which you reported with the reason you gave and the time. Also a running count of how many of your reports the administrator upheld or rejected | No |
| Moderation records: suspensions and bans with the reason; hidden, reported or removed content; reports and their reasons; automated-screening results; and the administrator's private history of decisions (section 8) | No |
| Abuse-prevention counters: how often an account posted recently, fingerprints of recent text (to catch repeats), and any automatic cooldown | No |
| Requests you send through the content and legal request form: your name, email, any phone or address you add, the web address, what you wrote, and for copyright notices the statements and typed signature | No |
The Service is text only. We do not collect precise location, contacts, payment information or uploaded files. Your username and posts can be copied, quoted, indexed by search engines and archived by others. Even if you delete a post, copies outside our control may remain.
4. IP addresses, logs and browser storage
- Our application does not store IP addresses in its database or with your posts, and its posting limits apply per account, not per IP address.
- Our hosting providers (Google Cloud Run and Firebase Hosting) and Google's sign-in service receive your IP address and browser details whenever your browser contacts them, and may keep request logs. How long those logs are kept is controlled by the project's Google Cloud logging settings. Google's default for standard logs is 30 days, but we have not confirmed or customized the setting, so treat that as Google's default, not a promise from us.
- Our own application log records error and operational events, with sign-in tokens and email addresses masked. It does not record what you post or request bodies.
- Firebase keeps your signed-in state in your browser's storage on your device. We do not set advertising or tracking cookies, and we do not use analytics.
- When pages load, your browser fetches fonts from Google Fonts and, if you sign in, Firebase scripts from Google's servers (gstatic.com). Those requests go to Google and include your IP address.
5. How we use information
- to run the discussion: show posts, count votes, let you reply and report;
- to keep the Service safe: limit spam, review reports, hide or remove content, restrict accounts, investigate threats, and keep records of what was decided;
- to respond to copyright, privacy and other legal requests, and to follow the law;
- to email the administrator alerts. These say that something happened and point to the dashboard; they do not contain the text of posts or of legal requests.
6. Who can see what
Only the site operator and the administrator account can see private information and moderation records, and only after signing in with an administrator Google account; the server checks this on every request. Reporters' identities are not shown to the people they report or to the public. Moderation tools show the administrator limited information about reporters (such as account age and an account key) to detect abuse of the report button.
7. Reports and what happens to them
When you report content, we store your report (your account ID, the reason you chose, and the time) so one account cannot report the same item repeatedly and so the administrator can judge it. If enough reports arrive, or a report is marked as a threat, the content can be hidden until the administrator decides. The person you report is not told who reported them.
8. Moderation records
When content is hidden or removed by moderation, we keep a private copy of it (with sensitive numbers such as card or Social Security numbers masked), the account ID of its author, who reported it and why, and what the administrator decided. The administrator's private moderation history also records every report that is dismissed, every removal and restriction decided by the administrator, and every approval of hidden content. For each, it keeps a masked copy of the reported text, the author's public username, whether it was a thread or reply, the thread title and address, the reasons for the reports, how many there were and when, and the decision, who made it and when. That history does not list who made the reports. If an author deletes their own post and it was not hidden or removed by moderation, no moderation copy is made. We keep these records so decisions can be reviewed, repeat problems can be spotted, and evidence exists if a threat or other serious matter is referred to the appropriate authorities. We may disclose information to law enforcement or others when we believe in good faith that the law requires it, or that it is necessary to prevent imminent harm or protect people or the Service.
9. Who else handles your information
- Google (Firebase Authentication, Firestore database, Cloud Run, Firebase Hosting, Google Fonts) runs the infrastructure. If you email us, the message is handled by Google's email service as well.
- Resend delivers the administrator's alert emails. It receives the administrator's email address and the alert text, which can include a username and counts but not the text of posts or legal requests.
- Search engines and the public can read everything that is public.
- We use no outside AI service. Posts are not sent to any AI provider; automated screening runs on our own server with fixed rules.
- We do not sell personal information and do not share it for advertising.
10. How long we keep information
We have not set fixed retention periods for most of our records, and our software does not delete them on a schedule. What actually happens today:
- Public threads and replies: stay until the author or the administrator removes them. Removing clears the text; a placeholder record without the text remains.
- Accounts, votes and reports: kept until deleted by hand. Nothing deletes them automatically.
- Moderation records, evidence and the moderation history: kept until the operator deletes them by hand. We have not set a time limit.
- Content and legal requests: kept in the database. Resolved requests are hidden from the administrator's working list but not deleted.
- Abuse-prevention counters and text fingerprints: marked to expire after roughly a day and ignored by the site after that. Deleting expired entries from the database relies on a database cleanup setting.
- Hosting and sign-in logs: controlled by Google, as described in section 4.
- Backups and exports: if we make copies of the database for safety, they are not changed when data is later deleted, and we have not set how long they are kept.
- Email: messages sent to us are kept in our mailbox until we delete them.
11. Your choices, requests and account deletion
- You can delete your own threads and replies at any time with the Delete button.
- There is no automated account deletion yet. To ask us to delete your account, to ask what we hold about you, or to ask us to correct it, use the content and legal request form or write to floorholler@gmail.com. We handle these requests by hand and will review each one. Depending on the request, we can remove the text of your posts and delete your sign-in record from Firebase Authentication. We may keep records we need for safety, to stop a restricted person from returning, or to meet legal obligations, including moderation records and the one-way fingerprint for an account that was restricted. We cannot promise a response time.
- Depending on where you live, privacy laws may give you rights to access, correct or delete your personal information. If you make such a request, we will consider it under the law that applies to it. We do not claim that any specific privacy law applies or does not apply to this site.
12. Security and incidents
The database cannot be read from visitors' browsers; only our server can reach it. Sign-in is checked with Google on every request, and moderation tools check administrator status on the server. Connections use HTTPS. No system is perfectly secure. If we learn of a security or privacy incident that affects personal information, we will investigate, take steps to contain it, assess who is affected, and notify affected people and authorities where the law requires.
13. Children
FLOORHOLLER is not for children under 13, and we do not knowingly collect information from them. We do not verify ages. If you believe a child under 13 has an account, contact us and we will review it.
14. Changes and contact
We may update this policy. For a material change we will ask you to accept the new version before you can post, reply, vote or report again. Contact:
floorholler@gmail.com
Michael Valentino, an individual doing business as FloorHoller
8212 Rebecca Creek Road, Spring Branch, TX 78070