Privacy.

You sign in with your ClackID account. chastity.report holds:

• your ClackID id and email address, to know it is you (as ClackID moves each app to an id of its own, we also keep the new id it gives us for you on this site until we switch to it), and the username you choose, if you choose one. It is for your profile link and profile page, which stay off until you switch them on;
• your journal: for each day you log, whether you were caged and, if not, why, what you ticked as happening and who with (as a category such as partner, never a name), whether you came, how and why, any scores and your private note;
• your agreements, if you create or join one: chosen names, clauses, structured manual and journal weekly goals, limits, dates, revision fingerprints, typed names and drawn signature strokes, acceptance times, pauses, endings and visibility approvals. They are private to both parties. External links need both parties’ approval and show either current status or all clauses and schedules; signatures and PDF downloads stay private. Either party may revoke external access immediately. Invitations use the email address you supply or a link you make, and expire after fourteen days; a link has no address and lets the first other account that joins with it become the other party. Neutral invitation and update emails contain a secure link, never the contract wording. Agreements and their history are deleted if either party deletes their account; download a signed copy beforehand if you want to keep it. If you separately enable manual commitment tracking, we also keep dated completion, exemption, correction and acknowledgement records, visible only to the two participants. These records do not appear in external verification or signed PDFs. Turning tracking off stops new records from your account while keeping the private history. If you opt in to personal reminders, we keep your chosen daily or weekly cadence, time and quiet hours. Reminder emails contain a secure link without clause text. You may separately enable a one-time email for the contract’s agreed review date, which stores your delivery time and quiet hours and works without commitment tracking. It contains a secure link with no private terms or progress counts. If you voluntarily save a review-date check-in, its option, optional note and save time are shared with the other participant independently of commitment tracking. You can edit or delete your own entry. Check-ins do not renew consent or change terms and are excluded from public verification, PDFs and emails. My agreement reminders brings all three schedules together and allows you to turn them all off without disabling tracking or other sharing. You can also stop a single schedule and apply shared timing without changing opt-ins. Private branded email previews send no email and change no settings. Its bounded delivery history is private to the recipient and contains no note text or raw provider errors. Your own reminder delivery status and recorded send time are visible only to you; a sent status means email-service acceptance, not receipt or review. It sends only while the agreement is live, may arrive later after a pause or delivery delay, and is disabled separately under My review date reminder. Turning tracking off does not disable this independent reminder. You may separately enable a weekly review email, which stores your delivery time and quiet hours and contains a link to the previous week without clauses, notes or progress counts. Turning tracking off also disables your commitment reminders and weekly review emails without automatically resubscribing you later. If you enable tracking, weekly summaries use those records. A weekly reflection you choose to save, including its optional note, is shared with the other participant; you can edit or delete your own reflection. Personal participation milestones are off by default, visible only to you, and use your existing tracking and reflection records. Reflections and milestones are excluded from external verification, PDFs and emails. Signing an agreement does not enable journal sharing or automatic app tracking. A clause may identify journal entry dates as its source. If you separately opt in after signing, we store your agreement-specific date-sharing permission, its start day and timezone. Only journal entry dates and counts from that start day are visible to the other participant while both tracking permissions and the agreement are live; entry contents are not read. If both participants sign a structured journal goal, eligible complete weeks show the agreed target beside the count. Partial weeks, weeks affected by an agreement pause, and periods without permission are not compared. These counts do not establish compliance or generate penalties or rewards. You can separately enable personal journal participation markers, visible only to you, for entries in the selected week and an eligible completed week’s agreed target. We store only this preference; markers are calculated from your permitted dates and may change with backfills or deletion. Withdrawing journal permission or disabling personal tracking disables the preference, without automatically restoring it later. These markers never appear to your partner, in external verification, PDFs or emails. Counts are calculated on request, never copied into tracking records, PDFs, external verification or emails. You can withdraw permission at any time; disabling personal tracking also withdraws it, and enabling tracking again does not restore it. Permission and the agreement cascade on account deletion;
• your lock sessions: start and end dates, a planned end and the device name if you give them. A break you record on a lock (the days and a reason from a fixed list) is kept with the lock and shown to anyone who sees your lock;
• your tracks, if you add any: each one's name, its target and details, and the amount or tick and details you logged on each day. They are shown only to you, and to anybody you share them with;
• your training packages, if you start any: their name, which tracks are in them, and a list of who changed what and when. If you build one with somebody you share with, they see the package and its tracks, and you see their changes; neither sees what you logged unless you share Tracks too;
• your settings, including your timezone and your reminder time, whether you set aside the card on Today that offers the reminder after your first log, and your sign-in sessions, stored as hashes. When you dismiss the invitation to CageWatchr, we note the date on your account so it stays dismissed on every device;
• drafts: while you write a day you have not logged yet, or a task or note to somebody you hold the key for, what you have written so far, so nothing is lost if the page closes. A draft is never a log or a message, is shown to nobody, and goes when you log or send it, when you press Discard, after 30 days untouched, or with your account. If your connection drops, a copy waits on your device until it reaches us. When a final journal save is not confirmed, its recovery copy stays until confirmation or Discard. Device copies are also removed when you sign out;
• your CageWatchr check photos, only if you pay for Plus and switch on keeping them: from then on, each new photo CageWatchr decided, the watermarked copy, with the day and times of its check and whether it was kept. Each is encrypted with its own key, under a key we can rotate without losing your photos, and kept only for the period you chose (30 days to a year). They are deleted when that runs out, straight away when you shorten it or switch keeping off, 14 days after your paid Plus ends unless it comes back (hidden until then), and with your account. Only you see them, and somebody you share with only if you switch on Check photos for them. They are never on your public page, in an email or a notification;
• whether you have Plus, and whether it comes with CW+ or is bought here, as ClackID last told us, and when we last asked (at most once an hour). Plus bought here is called Journal+ on your statement and is bought on checkout.clackis.com, which ClackID runs for every app in the family and where Stripe takes the payment; this site never sees a card, a price paid or who paid, and sends nothing from your journal there. Your keyholder is offered the chance to give you Plus only if you switch it on for them on your Sharing page: they pay there, and this site learns only that you have it and that it is a gift, never who pays;
• if people share their journal with you: a name you give each of them, which only you see, and when you last looked, so your keyholder page can show what is new. If you switch on Needs you alerts, a notification or an email saying only that something is waiting, never who or what, at most once a day each. If you switch on the morning overview, its time;
• how you use chastity.report: keeping a journal, holding keys for people who share with you, or both. It decides your home page and which reminders and emails make sense, and changes nothing about what anybody shares;
• when your 14-day Plus trial started and ends (it is used once, and never given to anyone who already has Plus through CW+);
• if you used a free Plus link from us: which link, when you used it, and when that free Plus ends. The person who runs chastity.report sees, for each link they made, whether it was used, by which username, whether you now have Plus of your own, and how many days you have logged since (a count, never what you logged). If the link also gives free CW+, we tell ClackID your ClackID account and when that CW+ ends, and ClackID passes it to CageWatchr; nothing else goes. This goes with your account;
• if you create a free profile, its separate alias, short introduction and whether you published it. It stays a private draft until you explicitly publish it. Anyone with the link can then read and copy that introduction and use your invitation link; it contains no journal figures or entries. New profiles allow search indexing by default, with a separate switch you can turn off before publishing or afterward. Search visibility requires an introduction of at least 80 characters. Search engines may connect your alias with sexual interests and retain results until they recrawl, even after indexing is switched off. Profiles created when indexing was off keep that setting. Unpublishing removes it from this site, but cannot recall copies somebody already made. You can delete the profile separately, and it also goes with your account. If the operator removes a profile, a minimal account-linked block record keeps it removed even after profile deletion; that record goes when the block is lifted or your account is deleted;
• if you switch on a public page, which parts of it you chose to show, and how far visitors have moved your lock;
• if you share your journal, the name you gave each person, whether they hold your key or read along, what you allowed them to see or do (including whether your figures may go in their morning email, and whether your keyholder is offered the chance to pay for your Plus), when an invite was first opened by somebody signed in, when they accepted, and when a reader stopped reading along. They see only those parts, and only while you share. An invite link is stored as a scrambled code, never the link itself, and works once. If you let somebody set your planned end, your lock records that they did;
• if you let somebody comment on your days, what they and you wrote on each day and when, and the one word they cheered it with. Each person sees only what was said between the two of you; you see it all, and you can delete any of it. It stays yours after you stop sharing, read only, and goes with your account; if they delete theirs, their words stay with you without their name. It is never on your public page, in an email or a notification;
• if you and your keyholder agree terms, each version: the target, how often tasks come, the limits and anything else you wrote, who proposed it, when each of you agreed, the review date and, if either of you signed, the drawn signature (the stroke only). Only you and whoever holds your key then see them; they end when the key changes hands and stay in your history. If you pause your keyholder, or everyone you share with, when you paused. Once a month you may be asked whether your arrangement is still working for you: we keep the day we asked, never your answer;
• if your keyholder may set you tasks and leave notes, the rituals between you: letters they seal for you and when each opens and was read, what you ask and how they answered, the marks they award you with the reason and the day, and the word they set for a day. Only you and that keyholder see them; they stay yours after the key changes hands, and go with your account;
• with a keyholder: each of your days on which they opened your page (for the In step count you both see), the line each of you adds to the week's review and the day of the week it falls on, the name either of you gives a lock, and who cheered a seal you reached. Only you and that keyholder see In step and the review; anybody who can see your lock sees its name and can cheer a seal. It goes with your account;
• the wellbeing check-in, only on days you choose or write something in it: how you felt that day (1 to 5), which prompt it showed and what you wrote. It is shown only to you, never to anybody you share with, and never in an email or a notification. Clearing a day removes it; you can switch the check-in off and delete everything written in it in Settings;
• your keyholders over time: the name you gave each one, when they held your key and how it ended, and a note they left if they stepped down, shown only to you in History. Somebody who held your key keeps one line on their own page saying they held it for your username between two dates, and nothing of your journal; it goes if either of you deletes your account;
• if you let somebody set you tasks or leave notes, what they wrote, the day a task is due, and how you answered. Only you and that person see them. They go when either of you deletes your account;
• for two days after somebody moves a lock from a public page, two scrambled codes that stop them doing it twice in a day. Each changes every day and cannot be turned back into their address or linked to another day. Tapping sets one small cookie that does nothing else.
• if you import steps, sleep or weight from Apple Health in the iOS app, only the daily amounts you choose are sent to your trackers here, with their source. Raw Health samples stay on your device. Tracker sharing still follows your privacy switches. Manual corrections are not replaced by later imports. A record of a deleted tracker day prevents automatic re-import; it is removed with the tracker or your account;
• if you enable iOS widgets or Apple Watch, selected tracker summaries are kept in protected storage on those devices and transferred to your paired watch. You choose which trackers appear. If you separately enable the daily journal widget, your lock day and whether today is logged are kept in protected storage on your phone for that widget; this summary is not sent to Watch. Its Log today shortcut opens the app to review and save your answers. Activities, scores, notes and sign-in credentials are not included. Summaries expire at the next account-local midnight or the app session expiry, and are cleared on sign-out;
• the iOS app can schedule a local evening reminder, off until enabled, with 9pm as the initial time. Its time and on/off setting stay on your device. It uses your account timezone and only says "Time to log today." It is cancelled on sign-out;
• if you switch on the evening reminder, the push address and keys your browser gives for each device you switch it on for.
• if you switch on an email (the morning briefing, the evening reminder by email, product news or guides), which ones, their times, and a note of which went out on which day and when you opened and clicked it, kept 90 days.

The reminder is delivered through your browser maker's push service (Apple, Google, Mozilla or Microsoft). It is encrypted so that service cannot read it, and it only ever says "Time to log today." Nothing from your journal is in it. Switch the reminder off and every device's push address is deleted.

Emails go only if you switch them on, to the address on your ClackID account, from noreply@mail.chastity.report through Cloudflare. They carry your lock day, streak, seals and tracks (a track's own name never goes in a subject), and never what you got up to, whether you came, your scores or your notes. Every email has a link that stops it in one click.

If you share your journal with somebody and they switch on the morning overview, what you share with them also goes to their email address, only for shares where you have left that on (it is on unless you switch it off for them), once a morning, while at least one of the people who share with them has Plus, a 14-day trial included. It carries only what you switched on for that person, and only these parts of it: your lock day and planned end, your next seal, when you last logged, how your tracks stand this week and how many of their tasks are open, done or past their day. Never what you got up to, who with, whether you came, your scores, your notes or what a task says. It uses the name they gave you, and never has a name in its subject. Your Sharing page says this next to the switches.

We track how you use our emails. The logo at the top of each email and every link in it carry a code for that email, so against your account we record when you first opened it, how many times, and whether and how often you clicked a link in it. We use this to see how people move through chastity.report and which emails work. Nothing about your device or where you were is recorded, and it is deleted after 90 days, or straight away with your account. If you turn images off in your mail app, opens are not recorded.

When somebody who is not signed in opens one of our public pages (the front page, Features, the pages for subs and for keyholders, Locktober, the day counter, the chastity tracker page, the guides, the help pages or this page), our servers send Google Analytics which page it was, the site the visit came from (its host name only) and any campaign tags in the link, the country, and whether it was a phone, a tablet or a computer. With it goes one word for the kind of place the visit came from (search, Bluesky, CageWatchr, an invite, direct or other), worked out on our servers from those same things. No cookie is set and nothing is stored on the device, and the visitor's IP address is never sent to Google. To count one person once a day, a one-way code is made from a random value that changes daily and is deleted after two days, with the address and browser; the code cannot be turned back into either. If the visit came from another site or a link with campaign tags, where it came from is kept under that code for two days, so that if that person signs up we can record on their account where they first found chastity.report. Your account then keeps that source, the page you landed on and the day. It is used only to see which places bring people who stay, is never shown to anybody, and goes with your account. Somebody's public page is counted as a public page, never whose; a link with a code or a token in it is never counted at all. The person who runs chastity.report can set a cookie in their own browser that only stops its visits being counted, and does nothing else.

We also count a few steps of your account in Google Analytics, from our own servers: that you signed up and where you first found us (with the same one word for the kind of place), that you signed in, finished setting up (and which of sub, keyholder or both you chose), started your trial, logged your first day, started a lock, invited or accepted somebody, switched on your public page, went to get Plus, got or lost it, earned a month by inviting, switched on the reminder, or deleted your account. Each is sent as the event's name, a few fixed words like "keyholder" or "journal-plus", and whether you are a sub or a keyholder and have Plus. It goes under a random number that is kept only on your account here and nowhere else, never your ClackID id, email address or username, and never anything from your journal: not a day, a lock's dates, a score, a note, a track, a task or a word from anybody. Google is not told where you are or what device you use, keeps it for two months, and its advertising features are switched off. The person who runs chastity.report uses it to see which places bring people who stay. The number goes with your account.

On the help pages, we count how many times each article is opened and how many searches find nothing, as totals for each day. What you type in the search is used to find answers and then forgotten: it is never stored or logged, and never sent to Google.

A few more things are counted as a single number a day, with nothing about who, which device or which account: a device switching off reminders, Plus starting or ending, a draft being put back into the form, and Today showing the card that follows a few low days on the wellbeing check-in. Once a week, for the people who switched on CageWatchr figures, chastity.report asks ClackID the same question their Today would, and keeps only two numbers: how many were connected and how many were not.

The operator also sees aggregate counts from this database: how many journal accounts saved a first day within 24 hours of signing up, after each account's full 24 hours have elapsed. These counts include backfill you chose, separate keyholder-only accounts, and exclude test and operator accounts. No entries or individual account details appear in this report, and it is not sent to Google. The same goes for the other totals worked out from what is already kept: how many days were logged caged all day, part of it or not, comebacks after a gap, how many wellbeing check-ins were kept (never a mood or a word), how sharing invitations went, and which kinds of place sign-ups came from, with any place fewer than five people came from counted only as "other".

If you switch on notes from Erik, a few come from erik@mail.chastity.report in your first weeks, around your Plus trial and after a long gap in logging. They carry nothing more than any other email would, and a reply reaches Erik, the person who runs chastity.report. If you have a Plus trial, two plain emails say the day before it ends and the day it does, unless you switch them off in Settings. Product news and guides come from news.chastity.report and are the same text for everybody. Product news is ticked when you set up, and was switched on once for everybody who joined before that tick existed; guides come only if you switch them on. Every one has a link that stops it, and so does Settings.

Your timezone is first suggested from where Cloudflare sees your connection. Only the timezone you keep is saved, never your location or IP address.

If you switch on CageWatchr figures in Settings, chastity.report asks ClackID for your verified lock days, your check record, whether checks are running or paused, and which days your checks were kept or missed, each time you open Today, History, Lock or setup. When you open a day that is already over, it also asks for that day's checks: when each was sent and answered, and whether it was kept. It never asks about today or later, so nothing here tells anybody when your next check comes. It shows all this only to you, and to somebody you share with only where you switch on CageWatchr figures or CageWatchr checks for them. You connect CageWatchr on your ClackID account, not here. We send ClackID the id it gave us when you signed in, never anything from your journal, and we keep no copy of what comes back. Switch it off, or disconnect on ClackID, and it stops straight away.

A journal about orgasms and chastity is information about your sex life. It is kept only for you, shown only to you, and never sent to anyone or any other app.

We do not store your IP address. The fonts are served from this site, so no page asks a third party for anything. There are no tracking or advertising cookies. While you are signed in, one more cookie, kept for an hour, holds only a marker of the last change you saved, so the next page you open shows it even when it is served from a copy of the database nearer you. When you sign in again to download or delete your journal, a cookie kept for five minutes holds only your account's id here and when it lapses, so the download or deletion can go ahead. So that a letter, a mark or the day's word from your keyholder writes itself out only the first time, your browser keeps a note that it has: an id or a date, never the words. A browser where Not for me was pressed on the one card that suggests CageWatchr before 16 October 2026 may still hold a cookie for up to a year with only the number 1; it is read to note the date on your account, as listed above. If you switch on Dimmer page in Settings, a cookie in that browser remembers it for a year, and it too holds only the number 1. So does the cookie that remembers, for a year in that browser, that you chose the plain name and icon (Journal) for adding chastity.report to your Home Screen; nothing about it is kept on your account. When chastity.report is opened from a Home Screen, that window adds one to the day's count of such visits, once per window; the count is a single number a day, with nothing about who, which device or which account.

Links we share on our own channels, such as our Bluesky profile, go through a short address like chastity.report/r/bsky. A visit through one adds one to that day's count for the link, and leaves a small cookie that holds only the link's name for 30 days; if you make an account in that time, one is added to the link's count of sign-ups, your account keeps the link's name, and the cookie is removed. The name is only ever counted, to see how many accounts from each link pay for Plus; nobody is shown which link you came through, and it goes with your account.

Your own invite link in Settings works the same way, with a cookie that holds only your code. If somebody makes an account through it, their account records that you invited them, so that when they first pay for Plus you both get 30 days of it free. You only ever see how many joined and how many went on to Plus, never who; they are not told anything about you. A keyholder with no journal of their own cannot use those days, so theirs go to the sub whose key they hold, or wait on their account until they next take a key. If either account is deleted, the link between them goes with it.

The front page shows a few totals over everybody, such as how many caged days have been logged. They are rounded down and never describe one person.

You can download a copy of everything you keep here from Settings, as one file: your journal days with their notes, locks, tracks and their logs, wellbeing check-ins, comments you wrote, what your keyholder sent you, terms, letters you have opened, requests, marks, agreements you are part of with their history, your settings, and a list of the check photos you keep (not the photos). Downloading and deleting both ask you to sign in at ClackID again first.

You can delete everything from Settings. It is removed straight away, and we tell ClackID to forget that you used this app, so your ClackID account no longer records it. If you pay for Plus yourself on checkout.clackis.com, cancel it first: we will not delete while it would bill again, and once it is cancelled you can delete at once, without waiting for it to run out. If you delete your ClackID account, ClackID tells us and everything here is deleted too.