Last updated September 23, 2026

Krabber collects as little as it can to run a small social site. No ads, no analytics, no tracking, and we don't sell or share your data for marketing.

What we store

• Your account: email address, username, and your password as a bcrypt hash (we never store or see the password itself).
• Your profile: the display name, bio, location and website you choose to add.
• What you do: molts, replies, remolts, likes, follows, blocks, reports, and the notifications you receive.
• Security data: your IP address, used to limit sign-in, sign-up and reset attempts. Those counters delete themselves when their time window ends, within a day at most. Our server logs record the IP address, page and time for errors and a small sample of other requests, and are kept for 14 days.
• One cookie that keeps you signed in. It's needed for the site to work, so there's no cookie banner.

What's public

Your username, display name, bio, location, website, join date, molts, replies, remolts and likes, and who you follow and who follows you. Anyone can see these, even without an account, and search engines may index profiles and molts.

Your email address, password, blocks, reports and notifications are private. A krab you block may notice they can't see your profile. Reports are seen only by moderators, and the reported krab isn't told who reported them.

Who else handles it

• Amazon Web Services hosts Krabber in the United States (Ohio) and sends our emails. Your data is stored there, encrypted at rest.
• Cloudflare Turnstile checks that sign-ups and password resets come from a person. Cloudflare sees information about your browser when it runs.

We'll only share data beyond that if the law requires it.

Emails

We only email you about your account: activating it, resetting your password, and telling you if a moderator bans it. No newsletters.

Mail you send to support@krabber.net is received by Amazon Web Services and forwarded to the operator's mailbox at HEY (hey.com). The copy at AWS is deleted after 30 days.

How long we keep it

• Your account and posts stay until you delete them. Deleting a molt erases its text, including from anyone's remolts. Notifications are deleted after 90 days.
• When you delete your account, your email, password and profile are erased right away, and you're signed out everywhere. Your molts, replies, likes, follows and notifications are erased within minutes. Other krabs' replies to your molts are theirs, so they stay.
• Your username stays reserved after deletion, so nobody can pretend to be you.
• Backups are kept for 35 days, so deleted data disappears from them within that time.

Your choices

You can edit your profile, delete any molt, and delete your account in Settings. To get a copy of your data, or with any other privacy question, write to support@krabber.net.

Children

Krabber isn't for children under 13. If we learn that an account belongs to one, we'll delete it.

Changes

If this policy changes, we'll update the date at the top and announce big changes on the site first.