Privacy

Smugstack is a satirical publication. Fictional contributors, discussions, and starting engagement figures are part of the publication, separate from real reader activity.

Signing in

The owner signs in through ChatGPT Sites. Sites provides verified identity to protect the editor and analytics. Email sign-in uses the same Auth0 tenant as MoreWrong, through its hosted email login. Smugstack validates the returned identity and keeps its own opaque HttpOnly session cookie. Session tokens are stored only as hashes, expire after 30 days, rotate daily, and are revoked on logout. Email addresses are retained with active sessions. Accounts and cookies remain separate between publications. Reader sign-in never grants editor access.

Subscribing

Email subscriptions are available only when email delivery is configured. Resend delivers confirmation and update emails using the existing sender account. Smugstack stores its own subscriber addresses, consent version, confirmation state and timestamps in its Site database. Signing in never subscribes you. Double opt-in is required; confirmation links expire after 24 hours. Unsubscribe links work without signing in and remove the delivery address. Unconfirmed delivery addresses are removed after their token has been expired for seven days when subscription maintenance next runs. Smugstack and MoreWrong consent and unsubscribe preferences are independent. Smugstack never sells email addresses.

Reactions and preferences

Likes and restacks are stored as aggregate counts. When you react, an opaque HttpOnly cookie lets the server remember that browser’s reaction and prevent duplicate increments. It lasts up to one year; the database stores a hash rather than the cookie value. This does not identify you by name or email. Clearing cookies removes that browser’s reaction identity. Saves and navigation preferences stay in browser storage. Fictional starting counts remain separate from reader reactions.

Traffic analytics

Smugstack records daily pageview totals and aggregate referring domains, plus the referring host or public page path and destination when your browser supplies them. Browsers often supply only a host or no referrer. We exclude query strings, fragments, credentials, sensitive account/authentication paths, and long identifiers. Raw IP addresses and visitor identifiers are not stored in analytics, and analytics uses no cookies. These counts are pageviews, not unique readers.

Only the owner can view analytics. Data is retained for 90 days. Owner visits, recognized automated clients, and requests carrying Do Not Track or Global Privacy Control are excluded. Short-lived hashed rate-limit keys help limit abuse; they are separate from analytics and retained for no longer than 24 hours. Like any website, the hosting provider may keep its own operational server logs.

Reader accounts and comments

When you choose a reader username, Smugstack stores your profile and a hash of your sign-in identity. Usernames are permanent and fictional contributor names are reserved. Comments, comment votes, and reports are stored to operate discussions and moderation. These are separate from traffic analytics. You can download your account data and delete your reader profile and contributions from the account page. Deleted profiles cannot post again with the same identity.

Owner editing

The editor can save a recovery copy in the current browser tab. This is device-local and separate from saved server revisions. Owner backups may include publication content, revisions, aggregate analytics and moderation settings; they exclude hosted secrets and sign-in tokens.