NeverConfessed
Back to the site

Contacts/Privacy

Last updated: September 17, 2026

1. Contacts

NeverConfessed is operated by Alfredo Maria Carraturo, responsible for the processing of the service's personal data.

For information about the site, collaborations, commercial enquiries or proposals concerning NeverConfessed, write to info@neverconfessed.com.

For requests exclusively concerning privacy and personal data, write to privacy@neverconfessed.com.

2. Data processed and how the service works

NeverConfessed is an anonymous confession service that does not require a public profile with your real name. The service processes content you choose to submit, such as confessions, ratings, private messages and reports, together with the technical and pseudonymous identifiers needed to operate the service.

These identifiers may include the public anonymous ID, private tokens and invite codes, technical authentication identifiers and session identifiers. Infrastructure providers may also process connection and security data, such as IP address, user-agent and other technical signals, when needed to deliver and protect their services.

Internal analytics may include usage events, pseudonymous identifiers, session ID, page path and language, traffic source, device type and approximate geographic origin. NeverConfessed does not store IP addresses, search text or full user-agent strings in its own analytics data.

If you contact us by email, the sender's email address and the content of the correspondence are also processed.

Do not submit full names, addresses, phone numbers, email addresses, tax identifiers, bank details or other information that could identify you or another person. NeverConfessed does not request special-category data under Article 9 GDPR; if a confession concerns personal or sensitive topics, avoid details that can link them to an identified or identifiable person.

3. Purposes and legal bases

Data is processed to provide the features requested by the user, including creating and publishing confessions, ratings, private messages, invitations and the personal page. The legal basis is performance of the service requested by the user under Article 6(1)(b) GDPR.

Preventing spam, bots, fraud and abuse, protecting the service, moderating content, handling reports, and measuring pseudonymous and aggregated usage are based on the controller's legitimate interest in keeping NeverConfessed secure, functional and improvable under Article 6(1)(f) GDPR.

Google Analytics is activated only after the user makes a positive choice. The legal basis for this processing is consent under Article 6(1)(a) GDPR, which can be withdrawn at any time through the “Cookies” control in the site footer.

Where processing is necessary to comply with legal obligations or lawful requests from authorities, the legal basis is Article 6(1)(c) GDPR. Messages voluntarily sent to the contact addresses are processed to answer the request and, where relevant, to take pre-contractual steps or on the basis of the legitimate interest in managing correspondence.

4. Cookies, browser storage and technical tools

The site uses browser local and session storage and other technical tools required to maintain sessions, anonymous identity, the personal link, preferences and feature state. Some information remains in the browser until the user clears it; session storage may be removed when the browser session ends.

NeverConfessed uses strictly technical cookies and browser storage, including a first-party cookie to remember the selected language and a technical cookie that stores the analytics-cookie choice for about 180 days. Internal statistics remain separate and are collected in pseudonymous and aggregated form; IP addresses, search text and full user-agent strings are not stored in NeverConfessed's internal analytics data.

Google Analytics 4 (measurement ID G-JZND034EW5) is loaded only after consent to measure page views, scrolls, outbound clicks, video engagement and file downloads. Site-search measurement and form-interaction measurement are disabled. If the user rejects or closes the banner, the Google Analytics tag is not loaded. The choice can be changed at any time through the “Cookies” control in the footer. NeverConfessed does not use Meta Pixel or AdSense.

Cloudflare Turnstile is used in invisible mode to distinguish real users from bots and protect new anonymous sessions and administrator sign-ins. During the check, Cloudflare may process technical signals such as IP address, user-agent, TLS information, site key and site origin.

5. Providers and recipients

To provide and protect the service, technical providers may process data on behalf of NeverConfessed or within their own services:

For more information, see the providers' privacy information: Supabase, Vercel, OpenAI, Cloudflare, Google and Register.it.

6. Automated moderation and OpenAI

Confessions are automatically analysed before publication to detect dangerous content, spam, meaningless text and obvious personal data. NeverConfessed uses OpenAI services for this purpose and sends the confession text only to the extent needed to perform the check.

Automated moderation only determines whether content may be published on the service and does not produce legal or similarly significant effects on the person. If you believe content was handled incorrectly, you can write to info@neverconfessed.com.

7. International transfers

Some providers may process data outside the European Economic Area. Where a transfer of personal data to a third country is subject to the GDPR, the transfer mechanisms required by Chapter V GDPR and applicable to the relevant provider are used, such as adequacy decisions or Standard Contractual Clauses, according to that provider's documentation and agreements.

8. Retention

Published confessions, ratings and private messages are kept for as long as needed to provide the service or until they are removed; there is currently no fixed automatic deletion period for this content. Confessions rejected by moderation are deleted.

Internal analytics and temporary technical data are kept only for as long as necessary for the operation and security of the service and are deleted according to predefined retention periods. Reports and data relating to moderation, audit and security may be kept for longer where necessary to handle abuse, disputes or applicable obligations.

Technical providers may apply their own retention periods to logs and data processed in their systems under their respective terms and privacy notices.

9. Data-subject rights and complaints

Where data can actually be linked to you, you may exercise, where provided by the GDPR, the rights of access, rectification, erasure, restriction, objection and portability by writing to privacy@neverconfessed.com. Where processing is based on consent, you may also withdraw that consent at any time without affecting the lawfulness of earlier processing.

Because NeverConfessed is designed to minimise identifying data, it may not always be technically possible to link a piece of content to a person without sufficient information supplied by the requester, such as the personal link or other information showing the connection with the content.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).

10. Security and anonymity

NeverConfessed does not publicly display your real name and uses pseudonymous identifiers. This reduces public exposure, but it does not mean every technical processing operation is fully anonymous: infrastructure providers may process connection data required to deliver and protect the service.

The personal link contains a private token and should be kept confidential: anyone who obtains it may be able to use it to access the related personal page.

11. Changes to this notice

This notice may be updated when site features, technical providers, retention periods or processing methods change. The latest update date appears at the top of this page.