Privacy & cookies

Who handles your information

The Wall Street Pressure Project (TWSPP) is an independent development project operated by Sean Morgan, an individual. It is not currently a separate LLC or corporation. Contact: TWSPP@icloud.com.

This policy describes the TWSPP website hosted on Amazon Web Services (AWS) in Northern Virginia, United States. The login and policy pages are publicly accessible. Member content requires a verified account and acceptance of the website agreement. New registration may be paused while email delivery is being enabled.

What we collect and why

• Account details: your display name, email address, password hash, account status and preferences, to provide and protect your account. The account database does not store your password in plain text.
• Forum activity: discussions, replies, edits, reports and moderation records, to provide the forum and handle abuse. Other signed-in members can see your display name and available posts; your account email is not shown with your posts.
• Sign-in and security records: session identifiers, confirmation and recovery records, activity times and limited abuse-prevention events. Connection addresses are used for rate limiting, and some events retain a hashed address. Hashing does not necessarily make that information anonymous.
• Newsletter choices: preferences, confirmation and unsubscribe records, to respect your choice about updates.
• Messages to the operator: your email address and anything you choose to include, to answer your request.

Do not put passwords, brokerage credentials or sensitive personal information in forum posts or emails.

Optional profile and security features

These features help you personalize your account and keep access to it. Ordinary members choose whether to add extra sign-in security; administrators and moderators must use it. Other members cannot read your backup email or security methods through the website.

Profile picture

If you choose a picture, your browser crops it to a small square and sends its pixels. The server stores a 128 × 128 PNG for your own account menu and settings. The original file, filename and embedded metadata are not uploaded. You can replace or remove the saved picture.

Backup recovery email

We store the backup address you verify, any proposed replacement and its verification records, including a protected code hash, expiry, attempt count and delivery state. This lets us confirm that you control the address and send a requested password reset there. Your backup address is not shown on forum posts. A password reset does not bypass an enrolled authenticator or other required extra sign-in security.

Authenticator apps and recovery codes

An authenticator app needs a shared setup secret. TWSPP stores that secret encrypted, together with the method’s label, creation and use times, and verification counters. Protect the setup information on your device. Recovery codes are shown when created; the website stores protected hashes and whether each code has been used, rather than a readable copy of the codes.

Passkeys and security keys

We store the public credential, its identifier, your label and limited verification metadata such as use counters, supported connection methods and use times. Passkey private keys and biometric or device-unlock information stay with your authenticator; TWSPP does not receive them. Your browser or device may offer a PIN, fingerprint, face recognition or another device to approve a passkey sign-in.

Security notices and sign-in records

We record events such as sign-ins, password resets and security-method changes, with their time, a broad browser/device label and email-delivery state. These help you review activity and receive security notices. They are separate from newsletter preferences, contain no recovery codes or setup secrets, and may be delayed or limited. A browser/device label describes what the browser reports; it is not a verified device identity or precise location.

Automated-traffic protection

The login and registration forms use Cloudflare Turnstile to help limit automated abuse. Your browser connects to Cloudflare for a security check, which may require a simple checkbox. Cloudflare processes browser and network information for this check. Our server sends its verification token to Cloudflare before processing the account request; we do not include your entered password or email address in that verification request.

The check uses an opaque identifier tied to the current browser session and form. The website does not store the Turnstile token in your account record or browser storage. Read Cloudflare’s Turnstile privacy information for its processing practices. Existing website rate limits and email verification still apply.

Cookies and browser storage

The website uses an essential first-party cookie named __Host-twspp_session to maintain sign-in and protect account actions. Its maximum browser lifetime is 30 days. Logging out or revoking an account’s sessions ends the corresponding access sooner.

If you choose Reduce motion, the website saves one display preference in this browser’s local storage under twspp.reduce-motion. It contains no account identifier or sign-in proof, is not used for tracking, and does not sync to other devices. It stays on a shared browser after logout until changed or site storage is cleared. Your device’s reduced-motion preference is also respected. If storage is blocked, the choice works for the current page but may not survive a reload.

You can remove or block cookies in your browser. Blocking this cookie can prevent sign-in and account features from working. The current preview does not use advertising cookies, a third-party analytics service or cross-site tracking. If optional tracking or embedded third-party services are introduced, this policy will explain them and any required choices will be provided before they are enabled.

Email and newsletter choices

Creating or verifying an account does not enroll you in a newsletter. Newsletter confirmation is separate and optional. You can change your choice in Your account → Newsletter or use an available unsubscribe link. Unsubscribing does not remove website or forum access.

Regular newsletter broadcasts are not connected. Account verification, recovery and requested newsletter-confirmation messages are delivered through Amazon Simple Email Service for requested account actions. AWS processes the recipient address and message. Email you send directly to the contact address is handled through Apple iCloud Mail and your own mail provider.

Who can access the information

The operator handles account administration and website data. Authorized moderators can access forum reports and moderation information needed for their role. Other members can read the forum content available to them.

Website account data is stored in an encrypted AWS database in Northern Virginia, United States. AWS retains automated recovery backups for seven days. The operator may keep encrypted or access-restricted recovery copies and deployment records. The laptop preview has separate accounts; existing laptop accounts have not been transferred. It is not sold or shared for targeted advertising in this preview. No connected payment processor or brokerage receives account information through this website. Information may also be disclosed when legally required or reasonably necessary to investigate misuse and protect people’s rights.

External links, such as links to open your email provider, lead to services with their own privacy practices. This policy does not control those services.

Retention, deletion and backups

Account and forum records remain available while the account is active. The preview does not yet apply one fixed deletion schedule to every category of account, consent and moderation record. Session and confirmation links have limited validity; expired links do not grant access.

Deleting your account removes personal profile fields, your saved picture, backup-email records, authenticator and passkey records, recovery-code hashes and security-event records from the active database. It also removes the text of your own forum contributions, revokes access and removes associated newsletter records. Anonymous placeholders and limited moderation structure remain so other members’ replies stay connected. The only moderator must arrange a replacement before deleting their account.

Deletion does not recall emails, downloaded exports or copies already made by other people. Historical backups and private test messages are separate copies and are not instantly erased. Scheduled backups rotate, but separately saved historical copies may remain until removed. Contact the operator about information that may remain in those copies.

Your choices and privacy requests

Use Your account to update your display name, manage newsletter choices, download your data, end sign-ins or delete your account. Your data export includes your saved picture, backup-address records, security-method labels and recent security-event records alongside your profile and activity. It excludes password material, session tokens, authenticator setup secrets, passkey credentials and recovery-code hashes, as well as other members’ private details.

For access, correction, deletion or other privacy questions, email TWSPP@icloud.com. We may need to verify that a request concerns your account without asking for your password. Applicable privacy rights depend on your location and circumstances; nothing in this policy removes rights granted by law.

Changes to this policy

The date at the top identifies this version. If the website’s data practices change, the policy will be updated and material changes brought to affected users’ attention. Questions can be sent to TWSPP@icloud.com.

Messages to the operator

The member Contact form sends your message, topic, display name and account email address to TWSPP@icloud.com so Sean can read and reply. Your browser tab saves an unfinished draft until you send or clear it. Drafts are not shown to other members.

The website database keeps a message reference, content fingerprint, word count, account identifier and delivery status to prevent duplicate sends and limit spam. It does not store the message text. Receipts older than seven days are removed when new messages are submitted. Delivered emails remain separate inbox copies; contact the operator about access or deletion. Local testing writes only to a private test inbox and sends no email.

Account agreement records

After you verify your email and log in, you must expressly accept the current Terms and Conditions before entering member content. Creating an account or verifying email does not accept the terms.

The private account database saves your account identifier, accepted terms version, hashes of the accepted terms and their attached Privacy Policy, acceptance time recorded by the server, email-confirmation category and the Agree then Submit action. It does not add your raw connection address, birth date, password or payment details to this receipt. The operator can use it to establish which agreement was accepted. Other members cannot see it. Newsletter and payment choices stay separate.

You can view the acceptance in Your account and include it in your data export. Versioned terms and their attached privacy copies remain available. Later informational updates to this page do not rewrite a saved acceptance record. Live acceptance receipts remain while your account is active and are removed from the active database when you delete your account. Historical backups are separate copies and follow the backup handling described above; account deletion does not instantly erase them. Any future legal preservation or different retention practice requires an appropriate policy review.