YOUR INFORMATION
Privacy policy
Lay Off Stories is a community for sharing and discussing layoff experiences. It is operated by Varun Garg. For privacy questions, access requests, corrections, or account deletion, email varun.garg405@gmail.com.
You can read public stories without an account. Your account email is not displayed to other visitors. Your chosen public name and anything you publish can be visible to anyone, including search engines.
Information we collect and why
- Account information: your email, chosen display name, username, optional bio, verification status, and account timestamps. We use these to maintain your account and show your chosen identity on community contributions. When you set a password, we store a password hash, not the password itself.
- Community activity: stories, comments, replies, reactions, helpful votes, saved stories, notifications, and reports. We use these to operate discussions, provide your saved items and activity, and moderate abuse. Optional story details, such as employer, role, country, and severance, are public when submitted.
- Technical information: session records, request times, requested paths, errors, and IP addresses processed by our server and hosting/security providers. We use these to deliver the site, prevent abuse, and troubleshoot failures. Application rate-limit records use a keyed hash of identifying information.
- Support and account emails: messages you send us and delivery records for verification and password-recovery emails. We use these to respond to you and help protect or recover your account.
When you continue with Google
Google sign-in is optional. We request only the openid and email permissions. Google supplies an account identifier, email address, email-verification status, and, where applicable, a Workspace domain claim. We use this information to authenticate you, associate your Google account with your Lay Off Stories account, and determine whether further email verification is needed.
We store the Google account identifier linked to your local account and your account email. We do not import or publish your Google name or profile photo, and do not request access to your Gmail messages, contacts, Drive files, or calendar. New users choose their own public display name and username. Linking to an existing account requires confirmation of that account.
Google authorization codes and tokens are processed on our server. Google access, refresh, and ID tokens are not retained after verification. Temporary sign-in records expire after 10 minutes; their identity details are encrypted and browser-binding tokens are stored as hashes. Google sign-in data is used for authentication and account security, not advertising.
You can remove the app's access in your Google Account connections. This does not itself delete your Lay Off Stories account or public contributions. Contact us to request deletion of the local account and Google association.
What is public and what is private
Stories, comments, replies, submitted text, and their public author attribution can be read and copied by other people and indexed by search engines. A pseudonym does not guarantee anonymity: details in your writing may identify you or someone else. Avoid posting private contact details, confidential documents, or information about others that you do not have permission to share.
Your account email, saved stories, and moderation reports are not displayed publicly by the app. The operator and service providers can process private information as needed to run, secure, and support the service. Moderators can review reported content. We may disclose information when required by law or necessary to address abuse and protect people or the service.
Cookies and browser storage
We use essential cookies to keep you signed in and bind a Google sign-in attempt to your browser. Session cookies normally expire after seven days; the temporary Google cookie expires after 10 minutes. Logging out clears the current session. Blocking these cookies can prevent sign-in from working. Authentication credentials and Google tokens are not stored in browser local storage. When you choose light or dark mode, we save that display preference in this browser’s local storage so it persists across visits.
The app does not include advertising trackers or behavioural analytics scripts. Our hosting and security providers process technical request data to deliver and protect the website.
Service providers and international processing
Our service uses Render for application hosting, Neon for PostgreSQL database hosting, Cloudflare for domain/network services and protection, and Brevo for account emails. Google processes sign-in requests when you choose Google. These providers receive the information needed for their roles: for example, Brevo receives the destination email and account-email content, and hosting providers process stored data and web requests. Public source links, such as Reddit links, lead to services with their own privacy practices.
Data may be processed outside your country, including in the United States where our application and database are hosted. Provider logs, backups, and infrastructure are also subject to the providers' retention and security practices.
Retention and deletion
Account information and Google associations are retained while the account exists, unless removed through a verified deletion request. Public contributions remain until deleted by their author or removed by the operator. Deleting a story removes it from the active database along with its discussion. Deleting a comment clears its text and public attribution while preserving a placeholder and internal association so replies remain in order. Moderation-hidden content and moderation records may remain available internally.
Sign-in attempts expire after 10 minutes, verification links after 24 hours, and reset links after 30 minutes. Expired records cannot be used to authenticate. Maintenance removes expired authentication and rate-limit records, delivered email records older than seven days, and all queued email records older than 30 days. Successfully delivered email message bodies are cleared from the app's queue.
Deletion from the live service does not immediately remove copies in operational logs, backups, search-engine caches, or copies saved by other people. Provider retention periods and any necessary legal or security retention can apply. Contact us for details relevant to your request.
Your choices and requests
You can edit your public profile, delete your own stories and comments, remove saved stories, and log out through the app. For a copy of your account information, a correction you cannot make yourself, or account and associated-data deletion, email varun.garg405@gmail.com, preferably from your account email. We will verify account ownership before releasing or deleting private information. Do not send passwords, Google tokens, or identity documents in your initial request.
The app does not yet have a self-service account-deletion or export button. Requests are handled by the operator. Tell us whether your request also concerns public contributions. Any applicable legal rights remain available to you.
Changes to this policy
We will update this page and its effective date when our data practices change. Contact the operator at the address above with questions about this policy or your information.