Your information.
Your choices.

Who operates TellMeWhy

TellMeWhy is operated by 胖大海 (individual operator). This policy covers our website, browser app, Telegram Mini App and mobile shells. For support or a data question, use our contact page.

Information the service uses

• Your account: a verified email address if you choose email login, or your Telegram account ID and display name if you choose Telegram login; an internal account ID and registration time. Email and Telegram accounts are separate.
• What you submit: purchase requests, amounts and currencies, reasons, alternatives, topics, uploaded photos, opinions and votes, watching records, flowers, circles and membership, blocked people, feedback and any optional reply email you provide.
• Security and preferences: hashed one-time verification proofs, attempt/cooldown records, signed sessions, reminder preferences and delivery status. Codes expire after 10 minutes; we do not store the email code itself as plaintext in the application database.
• Technical information: requests pass through Cloudflare, which processes network information such as IP addresses and request metadata. The backend uses temporary rate limits and operational logs. Providers may keep their own security and delivery logs under their policies.

We use this information to sign you in, show requests to their intended audience, collect opinions, manage circles, prevent misuse, handle feedback, and operate the service. Operational metrics count real participation separately from labelled starter data. We do not connect to your bank, take payments, or place orders.

Who can see your content

Community requests are visible to signed-in members. Private circle requests are limited to their circle members. An author can separately enable a public preview of a community request; anyone with that link can read its description and photos without signing in, and link previews or search services may retain copies. Disable the preview to stop serving it. Do not include addresses, payment details or other sensitive information in requests or photos.

Reading request details does not enter watching mode. Other people’s votes and reasons remain hidden until you participate, confirm watching, or otherwise qualify under the request’s visibility rules. Confirmed watching prevents voting on that request. It is not a promise of anonymity from everyone who can legitimately view the discussion.

Email and service providers

Cloudflare Pages, Workers and D1 host the service and application data. Resend handles verification emails and optional first-reply reminders, including recipient addresses and message delivery metadata. Telegram handles its own platform and sends us signed login information when you use the Mini App. Their services may process data in other countries; this service does not promise storage in your country.

First-reply reminders are off by default. If you enable them on an email account, you can turn them off in You → Reply reminders or through the unsubscribe link in a reminder. This does not stop a verification email you explicitly request. Messages already sent or in flight cannot be recalled. We do not sell personal information or include advertising trackers in our application code.

Storage on your device

The browser stores your sign-in session, appearance, interests, currency and an unfinished text draft on your device. Photos are not saved in the draft. Mobile shells keep the login session in platform secure storage. Signing out clears the current session and draft; account deletion also clears account-related local preferences on the device used. Copies on other devices, screenshots and links already shared are not remotely erased.

Retention and deletion

Account and content records remain in the live service until removed through the service or account deletion. Expired verification codes cannot be used; cleanup of expired proof records also occurs during later authentication activity, so expiry does not imply immediate physical erasure of every record. Reminder jobs retain limited status information until account deletion; temporary email payloads are cleared when a job ends.

Delete your account from You → Delete account. On success, we remove your account identity, your requests and photos, your comment text and associated account records from the live service. Votes you gave on other people’s requests remain only as combined totals without your account ID or comment. Daily anonymous counts remain. Shared circles pass to another member, with a generic name and rotated invitation code.

Manual database exports have a maximum retention target of 7 days. A scoped local cleanup task removes managed exports, including their export logs. It runs hourly while the backup computer and user session are available and catches missed runs when available; the operator must clear expired copies before using or making new exports after downtime. Copies must not be kept elsewhere beyond the same limit. This is an operational backup policy, not a claim that offline disks can be remotely erased.

Cloudflare D1 also provides provider-managed point-in-time recovery: its documented window is 7 days on Workers Free or 30 days on Workers Paid. These backups are separate from manual exports and are not rewritten by an account deletion request. We do not currently offer deletion of an individual record from provider recovery snapshots. An old snapshot must not be restored to live service without reapplying subsequent deletions. See Cloudflare’s recovery documentation.

Questions and changes

Use Contact for access, correction or deletion questions and account access problems. We may ask for proof that the account is yours; never send your sign-in code or password. Updates to this policy will appear here with a revised effective date.