Privacy Policy

What To Do Next? is a community question-and-answer platform. This policy explains what we do with the personal information you give us when you browse the site, create an account or post content. Wherever this policy says "we", it means the team that operates this site.

Information you give us

• Account details — username, email address and password (stored only as a one-way hash).
• Profile details — anything you choose to add, such as a display name, short bio, location, website or avatar.
• Content — questions, answers, comments, votes, polls and group membership.
• Messages — what you send us through the contact form or by email.

Information collected automatically

• IP address, browser type and operating system, recorded in server logs.
• Pages viewed and approximate time spent, used to produce aggregate statistics.
• Cookies and similar technologies — see our Cookie Policy.

• To create and secure your account and let you sign in.
• To publish the content you choose to post and attribute it to your profile.
• To send service email you have asked for — password resets, notifications you enabled.
• To detect spam, abuse and automated attacks, and to enforce our terms.
• To understand which parts of the site are used, in aggregate form.

We do not sell your personal information, and we do not share it with advertisers for their own purposes.

Anything you post publicly — questions, answers, comments, votes, your username and profile — is visible to anyone who visits the site and can be indexed by search engines. Please do not include personal details in public posts that you would not want to be read by strangers.

We rely on a small number of providers to run the site: web hosting, email delivery, and analytics and advertising services where enabled. These providers process data only on our instructions, except for advertising and analytics partners who act as independent controllers under their own policies. Where we use Google services, Google's handling of data is described in the Google Privacy Policy.

• Account data — for as long as your account is open.
• Public content — normally kept after account deletion, anonymised, so that discussions remain readable. You can ask us to remove specific posts.
• Server and security logs — up to 12 months.
• Contact messages — up to 24 months.

Connections are encrypted with HTTPS. Passwords are hashed with bcrypt and never stored in readable form. Forms are protected against cross-site request forgery, uploads are validated and cannot be executed on the server, and administrative areas require authentication. No system is perfectly secure, but we take these measures seriously and review them regularly.

Depending on where you live, you may have the right to access a copy of your data, correct it, delete it, restrict or object to certain processing, and receive it in a portable format. You can edit most details yourself in account settings, or write to legal@whattodonext.org. We answer requests within 30 days.

This site is not intended for children under 13, and we do not knowingly collect their personal information. If you believe a child has created an account, contact us and we will remove it.

We may update this policy as the site changes. The date at the top of this page always reflects the current version, and significant changes will be announced on the site.