Your Privacy Matters
Last updated: January 2025 · Governed by UK Law
🕯️ In plain English first: We collect as little as possible. Your confession is anonymous. We never sell your data. We never will. This policy explains the small amount of data we do handle and exactly what we do with it.
Karma Confessions (karmaconfessions.com) is operated by an individual based in the United Kingdom. As a UK-based data controller, we are subject to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Our website is hosted on servers operated by Bluehost Inc., located in the United States. Where your data is transferred to or processed on US-based servers, this is done under appropriate safeguards in accordance with UK GDPR Article 46.
For any privacy enquiries, please contact us at: Email Us
Under UK GDPR, we must have a lawful basis for processing your data. Our bases are:
| Data | Legal Basis |
|---|---|
| Confession text & country | Contract — necessary to provide the service you have paid for |
| Payment transaction ID | Legal obligation — financial record keeping |
| IP address (moderation) | Legitimate interest — preventing abuse and protecting other users |
| IP address (karma voting) | Legitimate interest — maintaining integrity of the platform |
| Analytics cookies | Consent — only if you accept analytics cookies |
Your confession is anonymous by design. We do not ask for your name, email address, or any identifying information. Your confession is published with only your chosen country shown. No account is created. No profile is stored.
We do retain your IP address in our server logs for a period of 90 days for security and fraud prevention purposes. This is never published, shared with other users, or used to identify you publicly in any way.
In the extremely unlikely event we were required by law to identify a user — for example, in connection with serious criminal activity — we would comply with any valid court order. We would always seek legal advice before doing so.
All payments are processed by PayPal. When you pay to submit a confession, you are directed to PayPal's secure platform. We never handle, see, or store your payment card details at any point.
PayPal's own privacy policy governs how they process your data. You can read it at paypal.com/uk/legalhub/privacy-full.
We retain PayPal transaction reference numbers and amounts for 7 years in accordance with UK financial record-keeping obligations under HMRC guidelines.
Our website is hosted by Bluehost Inc. in the United States. This means some of your data — specifically server logs containing IP addresses — may be processed on US servers.
Bluehost participates in data transfer frameworks that provide appropriate safeguards for transfers from the UK. We have assessed this transfer and are satisfied it meets UK GDPR requirements under Article 46.
PayPal also operates internationally. Please refer to their privacy policy for details of their international data transfers.
As a UK resident (or where UK GDPR applies), you have the following rights:
| Right | What It Means |
|---|---|
| Right of Access | Request a copy of all personal data we hold about you |
| Right to Rectification | Ask us to correct inaccurate data |
| Right to Erasure | Ask us to delete your confession and associated data |
| Right to Restriction | Ask us to limit how we use your data |
| Right to Object | Object to processing based on legitimate interest |
| Right to Portability | Receive your data in a portable format |
Because confessions are anonymous, exercising some rights may require you to provide enough context for us to locate your data — for example, the approximate date of submission and your country.
To exercise any right, contact us at Email Here. We will respond within 30 days as required by law.
If you are unhappy with how we handle your request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
⚠️ In the event of a data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours and affected users as soon as reasonably possible, as required by UK GDPR Article 33.
We do not sell, rent, or trade your personal data to any third party, ever.
We may update this Privacy Policy from time to time. When we do, we will update the date at the top of this page. For significant changes we will add a notice to the homepage. Continued use of the site after changes constitutes acceptance of the updated policy.
🕯️ If you have any questions about this Privacy Policy or how your data is handled, please write to us at Email Us. We are a small, human-run operation and we take your trust seriously.