Privacy Policy

UltraGuest.com is a free guestbook hosting service operated as an independent, privately run project (the "operator"). This policy explains what we store about guestbook owners and about people who read or sign a guestbook, why, for how long, and what you can do about it. Contact for anything in this policy: the support form or support@ultraguest.com.

What we store

Guestbook owners (people who sign up): your e-mail address, a hashed version of your password (we never store the password itself), the settings and texts you enter in the Control Panel, the date you signed up and the date you last used the Control Panel, and when you accepted the Terms of Service and the Acceptable Use Policy at sign-up (confirming that you are 16 or older) and which version of them. Visitor-side counters of your guestbook (page views, unique visitors) are stored as totals. Owners who paid to remove advertising before 2026 still have that payment on their record; there is no paid tier today and no advertising is shown to anyone.

Guestbook visitors (people who sign a guestbook): the name, optional e-mail address, optional website address, optional location flag, message and custom-field texts you enter, the date and time, the IP address you posted from and the country that address belongs to, as Cloudflare (see below) reports it. Name, message and public fields are shown on the guestbook page to everyone; the e-mail address is shown only to the guestbook owner, who also sees the country but never the IP address. A private message is shown to the owner only. People who merely read a guestbook are counted, not identified: we keep a one-way hash of the address and browser for 60 days to tell repeat visits apart.

The IP address of a message is kept to prevent abuse (spam, floods, harassment: it lets us and the owner keep one person out) and to meet legal obligations, such as preserving evidence of child sexual abuse material for the authorities. It is deleted 12 months after you posted; the country stays with the message for as long as the message exists. An address stays longer only while it is evidence: while our moderation is still deciding about the message or its guestbook, or while a report about it or its guestbook to the National Center for Missing & Exploited Children must be preserved (one year after the report, as the law requires). If a guestbook owner blocks the writer of a message, that address goes on the guestbook's block list, still unseen by the owner, until the owner lifts the block or deletes the guestbook.

Abuse prevention: when a post is refused or removed by our content rules we keep the date, the guestbook, the name of the rule and the IP address, never the text, for 400 days. Web-server logs with IP addresses are kept for up to 30 days.

Replies by guestbook owners: with a reply an owner writes under a message we keep the date and the IP address it was written from. The address is shown to no one; it is kept to act on abuse and to meet legal obligations, such as reporting child sexual abuse material. It is deleted 12 months after the reply was written, or with the reply if that goes first, and stays longer only while it is evidence, as a message's address does: while our moderation is still deciding about the reply or its guestbook, or while a report about it or its guestbook to the National Center for Missing & Exploited Children must be preserved.

People who report a message: the reason you pick and what you write, kept with the report for 90 days; your e-mail address if you give one, used only to write to you about the report and deleted once the outcome has gone; and your IP address only as a one-way hash, to limit how many reports one address can send. The report itself (which message, when, what was decided) is kept for 400 days. The guestbook's owner is not told who reported a message.

Owners who contest a moderation decision: the explanation you write in the Control Panel is kept with the decision it is about, together with what the second review decided and why. It is read by the automated second review, an AI moderation service (OpenAI, see below), together with what was decided; it is shown to nobody but you, and it is deleted with the guestbook.

Why we store it and on what basis

To provide the guestbook you signed up for or signed (performance of a contract), to keep the service free of spam, fraud and illegal material and to protect owners, visitors and ourselves (legitimate interest), and to meet legal obligations, in particular the duty under United States law to report child sexual abuse material to the National Center for Missing & Exploited Children. We do not sell data and do not profile anyone. We may e-mail owners about their account or changes to the service; any optional newsletter or offer would require a separate opt-in.

How long

Messages stay until the guestbook owner deletes them or the guestbook is deleted; the IP address of a message is deleted 12 months after it was posted, as described above. Owners can delete any message and their whole guestbook in the Control Panel at any time; a deleted message waits in the owner's trash for 30 days, out of public view, so it can be restored, and is then deleted for good. We do not delete guestbooks for inactivity: a guestbook that holds messages stays until its owner deletes it or it is removed under the Acceptable Use Policy. Sign-ups that never confirmed their e-mail address and were never used - no message and nothing written in the guestbook - are deleted 90 days after sign-up. Backups are kept for 30 days. Material we are legally required to report is preserved for one year in a separate, access-restricted store and then destroyed.

Who else sees the data

Our servers are hosted by DigitalOcean in New York, USA. Cloudflare (USA) sits in front of the site for security and delivery and handles the human-verification challenge on forms and tells us which country a visitor's address belongs to. E-mail is sent through Resend (USA). Support requests arrive by e-mail in our support mailbox at Google Workspace (USA). Every message and guestbook text is checked for illegal and abusive content before it is published, and again when someone reports it, by our own rules and by AI moderation services (OpenAI, USA; if we add a second provider of the same kind we will name it here first), which receive the text only (with a report, also the reporter's own words; with a contest, the owner's explanation), never e-mail or IP addresses, and do not use it to train their models. These providers process data on our behalf under their standard data-processing terms, including the EU standard contractual clauses for transfers from Europe. Beyond that, data is disclosed only where the law requires it: to law enforcement on a valid request, and to the National Center for Missing & Exploited Children as described above.

Your choices

Our own pages set only strictly necessary cookies. Visit counting on our pages (Cloudflare Web Analytics, which sets no cookies) runs only if you allow it in the cookie notice, and you can change your answer any time with "Cookie settings" in the footer. If your browser sends the Global Privacy Control or Do Not Track signal we treat it as "only necessary" automatically and show you a confirmation. We do not sell or share personal data for advertising; should the service ever carry advertising, any related cookies would be off until you allow them. Guestbook owners can switch notification e-mails off in the Control Panel; the only other mail we send concerns your account.

Your data: export it or delete it yourself

Guestbook owners can download everything we hold (account, settings, all messages with their country but not the visitors' IP addresses, banned addresses, notification log, your acceptance of the terms and your contests of moderation decisions) as JSON or CSV under Download My Data in the Control Panel, and can delete a guestbook and everything in it under Delete Guestbook (deleting your last guestbook deletes your login as well). Both work instantly, without asking us. Deletion removes the live data at once; backups expire within 30 days. Visitors who signed a guestbook can remove their entry themselves with the private link shown to them once, right after signing; they can also ask the guestbook owner to remove it, or send us a privacy request; we may ask for the name or e-mail used so we can find the right entries.

Your rights, wherever you live

You can ask what we hold about you, obtain a copy, have it corrected or deleted, restrict or object to its use, and you will never be treated differently for doing so. We apply these rights to everyone and answer within 30 days. They are guaranteed to you by the GDPR (EU/EEA), the UK GDPR, the Swiss FADP, the CCPA/CPRA in California and similar laws in other US states (we do not sell or share personal information, and we honor Global Privacy Control as a valid opt-out), PIPEDA in Canada, the Privacy Act and the Australian Privacy Principles in Australia, the Privacy Act 2020 in New Zealand and the LGPD in Brazil. You may complain to your data-protection authority at any time; for the EU that is the authority of your country of residence. Requests go to the privacy request form.

Children

The service is not directed at children under 16 and we do not knowingly keep data about them. If you believe a child has signed up or posted, tell us and we will remove it.

Cookies and security

We use only the cookies needed to run the site; the details are in our Cookie Policy. All traffic is encrypted (TLS), passwords are stored hashed, and password resets and e-mail verification use single-use links.

This Privacy Policy was created on January 3, 2003. This version is effective from September 27, 2026 (what we keep when someone signs a guestbook, and for how long; the record of an owner's acceptance of the terms; an owner's contests of moderation decisions); the one before it dated from September 26, 2026. Changes are announced on this page.