Privacy
UltraGuest is run as a labour of love, not a business, which makes a plain promise possible: no advertising, no tracking and no data sales, for owners and visitors alike. This is the short version; the privacy commitments and the Privacy Policy spell it out.
No ads, no tracking, no data sales
There is no advertising on this site or in any guestbook, no tracking cookies, no advertising pixels and no fingerprinting, and personal data has never been sold, rented or shared for marketing. If that ever had to change to keep the service running, the commitments page would say so first, and nothing would be switched on without your permission.
Only what a guestbook needs
A guestbook owner gives us an e-mail address and a password, stored hashed. A visitor who signs gives a name, a message and, if they wish, an e-mail address; we add the date and the posting address, which only the guestbook owner sees. People who merely read a guestbook are counted, never identified. Guestbook pages carry no analytics and set only the session cookie needed to post safely. Our own pages set strictly necessary cookies only, count visits without cookies and only if you allow it, and take a browser's Global Privacy Control or Do Not Track signal at its word.
Your data, in your hands
Account › Download My Data in the Control Panel gives you everything we hold, as JSON or CSV, the moment you click. Account › Delete Guestbook removes that guestbook, every message in it, its banned-IP list and its notification log at once - and your login too, when it was your last guestbook; backups expire within 30 days. Neither needs a request or a reason. If you signed somebody else's guestbook, the owner can remove your entry, or you can send us a privacy request and we act within 30 days.
The same rights for everyone
Wherever you live, you can ask what we hold about you, get a copy, have it corrected or deleted, and restrict or object to its use, with no downside for asking. That covers the GDPR in the EU/EEA, the UK GDPR, the Swiss FADP, California's CCPA/CPRA and other US state laws, Canada's PIPEDA, Australia's Privacy Act, New Zealand's Privacy Act 2020 and Brazil's LGPD. You may also complain to your data-protection authority; we would rather hear from you first.
Where the data lives
The servers are at DigitalOcean in New York, USA. Cloudflare handles delivery and the human check on forms, Resend sends the e-mail, support requests arrive in our Google Workspace mailbox, and AI moderation services (OpenAI; a second provider of the same kind would be named here first) read new texts for illegal content before they are published, each under its standard data-processing terms, including the EU standard contractual clauses for transfers from Europe. Beyond that, data is disclosed only where the law requires it.