Privacy Policy — The Motherhood Diary

Effective date: [EFFECTIVE DATE] Last updated: [LAST UPDATED] Who this is from: Motherhood Diary Media Company, [STATE OF INCORPORATION] [ENTITY TYPE], [COMPANY ADDRESS] — the company behind The Motherhood Diary Blog and Den of Mamas.

---

The short version

We ask for as little as we can, we tell you what each piece is for, and we never sell it.

On the Blog, that means an email address. In Den of Mamas, it means an account — your name, your email, and your ZIP code, so we can put you in the right Local Den — and the words you write there. We keep the ZIP and nothing finer. No street, no coordinates, no location from your phone.

Your Den's feed carries one sponsored card from a local business now and then. It knows which Den you are in. That is the only thing it knows. Nothing you write, and nothing you are going through, is ever used to sell you anything.

If you want to see what we hold, correct it, download it, or leave, this page tells you how. The door is never locked.

---

1. Who we are, and how to reach us

The Motherhood Diary (we'll call it TMD, or "we") is a community for mothers. It has two homes: the Blog — news for families, recipes with a Kids' Job, and stories from the community — and Den of Mamas, a free, mothers-only, adults-only community made of Local Dens. A Local Den is a named area. You are in one of them, and your feed is your Den's feed, in the order things were written. There is a real human moderator, and there is only one of her.

Both are run by Motherhood Diary Media Company, founded in [FOUNDING YEAR] by Makenna, who is the founder and the only administrator. She is the person who reads what is flagged, answers what is asked, and makes the decisions this policy describes. For privacy law, the company is the "controller" of your information.

Contact us about privacy:

• Email: [CONTACT EMAIL] — put "Privacy" in the subject line and we will find it faster
• Post: [COMPANY ADDRESS]
• If you are in the European Union: our representative is [EU REPRESENTATIVE NAME AND ADDRESS]
• If you are in the United Kingdom: our representative is [UK REPRESENTATIVE NAME AND ADDRESS]

We are based in the United States. Readers and members join us from the UK, the EU, and elsewhere, and this policy is written to honor the rights you have wherever you are.

---

2. What this policy covers

This policy covers five places where information about you reaches us:

1. The Blog — including the email gate and The Mama Who Knew newsletter
2. Den of Mamas — the community, your account, what you write, and the Local Den ads that appear in your feed
3. The advertiser page — /advertise, where a local business applies to sponsor a card in a Den
4. The Partner Portal — where brands who work with us are managed
5. The site tag — the cookies and measurement that run across the Blog and the portal

One thing is worth saying at the top: the site tag does not run inside the Den. No analytics tag, no advertising pixel, no third-party script of any kind executes there. There is no cookie banner in the Den either, because there is nothing to ask you about. Section 5 explains what the Den does store, which is only what is needed to keep you signed in.

This policy also explains the automated systems that touch your words (Section 7), how long we keep things (Section 11), the rights you have (Section 12), and what happens if you ask us to erase you (Section 13).

It does not cover other companies' platforms. If you follow us on Instagram, Pinterest, Facebook, or TikTok, what you do there is governed by their policies, not ours. The same goes for any site you reach by clicking a link from ours, including the link on a sponsored card.

---

3. The Blog

3.1 The email gate

The homepage is open to everyone. When you click through to a full article, recipe, or activity, we ask for your email address. That is the price of the Blog: free, and one letter from us on Sundays.

When you give it, we collect:

• Your email address.
• How you found us — for example, from a search engine, from Pinterest, or from a partner's link. We call this the acquisition source. It tells us which doors people come through.
• The date you joined.

We use your email to send The Mama Who Knew newsletter and, occasionally, a note about something new from us. Every letter has an unsubscribe link that works in one click. We do not use your address for anything else, and we do not give it to anyone (see Section 8 for the companies that send the letter on our behalf).

3.2 What you read and click

We keep count of clicks on articles, recipes, and activities. This is how we know what is useful and what should be retired to make room for something better. Click counts are tied to a random visitor id set by a cookie (Section 5), not to your name or email, and only if you have allowed measurement cookies. If you have not, we still count the visit, but without any id at all.

3.3 Comments and stories you send to the Blog

If you comment on the Blog or send us a community story, we collect what you wrote, the name or byline you asked for, and your email address so we can reply. Every comment and submission is read by a person before it appears (Section 7). If you ask to be anonymous, your name is replaced with a descriptive byline before publication, and that choice cannot be overridden by accident.

When you submit a story, we also ask where it may appear — the Blog, the letter, the printed magazine, social posts — and whether your name goes with it in each place. Your answers are stored with the story and the publishing system cannot place it anywhere you did not allow. You keep the copyright in your story. That is set out in the Terms of Service; we mention it here because your permissions are part of the record we hold about you.

---

4. Den of Mamas

4.1 What you need to give us to join

The Den requires an account, and every account is approved. This is for moderation and safety. To apply, we collect:

• Your name.
• Your email address. It is your identity here. It is how you sign in, and how the rare message about your account reaches you.
• Your ZIP code. This is how we know which Local Den is yours. We keep the ZIP and nothing finer — no street address, no coordinates, no location from your device. We do not ask for those, and there is nowhere in our system to put them.
• Your confirmation that you are a mother and over 18. This is something you tell us. The Den is for mothers, and only for adults. We do not ask for identity documents, ever.
• A few lines about you — free text, in your own words. It is there so that a person, not a form, decides.
• The verification step. Two paths are built, and a setting chooses between them: a checkbox where you attest for yourself, which approves you straight away, or a personal review, where your request waits for Makenna and she may write back with a question first. [CONFIRM: which verification method is switched on at launch — Playbook J2 item 6 / Part P17 item 1.]
• Your acceptance of the Five Community Standards, with the date and time you accepted them. Five plain lines, not a scroll of legal text.

How you sign in. We email you a link, and the link signs you in. There is no password to forget at 2am. If you would rather have one, you can set one, and then we keep only a one-way hash of it — a scrambled version that lets us check a password without ever knowing it. No screen, export, or log anywhere in our system contains a password.

Your display name. Once you are in, you choose the name other members see. It does not have to be your legal name. Makenna knows who you are; the room does not have to.

If we decline. The note is private and warm, and it invites you to write to us again after 30 days. We keep your application and the decision, so that if you do write again, Makenna sees what was decided before and why. That record is part of what we hold about you.

If no Den serves your ZIP yet. You are still a real member. You go on the waitlist for your ZIP, we tell you plainly that this is what has happened, and you are moved into a Den when one opens near you.

4.2 What you can choose to tell us

After you join, you may be invited to tell us a little more about your household. This is entirely optional. We ask for it only if you give us a separate, specific consent, which we call a little more about you.

If you do not give it, we do not ask. Your record then says that you were never asked, rather than that you left it blank. We keep those two things apart on purpose: one means you said no, the other means you never got the chance.

4.3 The sensitive questions

Two questions — household income and partner status — sit behind their own consent, separate from everything else. You can say no to them without losing anything. They are marked sensitive in our system, and our code will not let them be collected under a general consent.

4.4 Your profile, and who sees it

Your profile holds:

• Your display name — whatever you choose.
• A photograph, if you want one. Optional, and stripped of location and device data like every other image (4.8).
• Your home Den, shown as text. It is always there. It is the one piece of location the Den ever shows, and it is coarse on purpose. There is no map, no distance, no "0.4 miles away," no "mothers near you."
• Your life stage, if you set one — Expecting, New Mom, Toddler Years, School Age, Teen Years, Empty Nest & Beyond. Optional. It appears beside your posts and on your profile, for the members who can see them, and it is there for one reason: so another mother in the same season can find you. The advertising system cannot read it. That is not a setting or an interface rule. The ad code has no access to the place it is kept.
• A little about you — free text, which passes through the rules engine like everything else written here (Section 7).
• The month and year you joined — not the date.

No fields about children. None. Not names, not ages, not birthdays, not due dates, not a count. The form never asks, and there is no column for any of it anywhere. A local database of children's names and ages beside their mothers' is the one thing this community must never become. What you write in your own words is yours to write. We simply never build the box.

Quiet Mode. If you turn it on, you do not appear in your Den's directory and cannot be found by a name search. You are reachable through the connections you already have and the posts you choose to make. It is offered at signup, in plain words, for anyone who needs to be hard to find. [CONFIRM: whether Quiet Mode is on or off by default at launch — Part P17 item 4.]

Nothing here is public. Not one page of the Den renders to a signed-out visitor. Every route carries noindex. There is no sitemap for the Den, and no social-preview cards — a pasted link shows nothing at all to anyone who cannot sign in.

4.5 Following, friends, and blocking

• Follow. One way, no approval needed. Her posts appear in your Following tab. She can see who follows her. Nobody is watched here without knowing it.
• Friends. Mutual: you ask, she accepts. Friendship is what unlocks messages. Your friend list is visible only to you. In a room where everyone lives nearby, a public list of who a woman is close to is a map, and the person most motivated to read it is the person she most needs not to have it.
• Block. Total, mutual invisibility. Neither of you is notified. She cannot see your posts, comments, profile, or your name in the directory, and you see nothing of hers. Nothing anywhere gives away that a block exists.
• No counts. Followers, friends and posts are not shown on any profile. You can see your own figures in your own settings, and nowhere else.
• No contact upload, ever. We will not ask for your phone's address book. The feature is not built, so it cannot be switched on later by accident.
• No "people you may know." No suggestions built from your contacts, your mutuals, or your behavior.
• The directory is a plain alphabetical list of the members of your Den who are not in Quiet Mode. That is the whole of discovery.
• New accounts are limited to ten follow or friend requests a day for the first 14 days. A new mother does not need fifty friends on day one. Someone with worse intentions does.

4.6 What you write

Your posts and comments are held in our database. They are seen by the members of your home Den, and by any member who follows you — not by the whole membership, and not by anyone who is not signed in.

• Anonymous posts and comments. Any of them can be anonymous. They show as "A mama in [Den]." That is anonymous to the community and not to Makenna — she can still see who wrote it, because she has to be able to. The composer says so, in those words, before you post.
• Help requests. A structured ask: what you need, by when, and how someone can help. It can be anonymous. You close it yourself with "Sorted — thank you."
• Polls. Voting is anonymous to everyone, including the person who asked. Makenna sees totals only. No vote is ever joined to a name in any view the community or the author can reach.
• Reactions. Four of them: Holding you, Me too, That helped, Celebrating. Counts are shown to everyone. Who reacted is shown to the author of the post only.
• Meet-ups. A meet-up carries your name — not anonymous, because you are asking people to come and meet you. RSVPs are visible only to the others who have RSVP'd. The venue is free text and must be a public place, and every meet-up carries one quiet line: The Den introduces; it cannot vouch.
• No share button. No action on anyone's post produces a link that works outside the Den. "Copy link" produces a link that opens only for a signed-in member of that Den. We cannot stop a screenshot, and we do not pretend we can — but we will not hand anyone the tool.
• "May I share this?" Nothing you write in the Den appears on the Blog, in The Mama Who Knew newsletter, on social, or in the magazine unless Makenna asks you first and you say yes. She asks per destination, and per destination you choose named or anonymous. Your answer is recorded and kept on your member record, and the publishing system cannot place anything anywhere you did not allow.
• Editing. Edit any time. The post is marked "edited," and the original is kept for Makenna, because moderation needs to know what was actually said.
• Deleting. Delete a post, a comment or a message and it leaves everyone's view straight away. We keep the record for 30 days, so that a question about it can still be answered, and then it is purged for good.

Nothing you write in the Den is used to build an advertising audience. Not once, not in aggregate, not ever. Section 7 explains the systems that read your words for safety. Section 9.4 explains the sponsored cards. Section 13 explains what happens to everything if you leave.

4.7 Messages

• Between mutual friends only. There are no message requests from strangers. This is not a privacy setting you have to find — the path does not exist.
• Small groups, up to eight, where everyone is a friend of whoever started the group.
• No read receipts. No typing indicators. A mother who cannot reply yet should not owe anyone an explanation for having read something.
• No advertising. There are no sponsored cards in Messages. No slot was built.
• Distress detection runs on messages. It is the same system described in Section 7.1, and it reads private messages as well as posts. If it matches, what Makenna sees is the flag and that one message — not the conversation around it. The message is held from the person you sent it to until she has decided. [CONFIRM: this is the recommended position in Part P17 item 8; it must be confirmed and must match the crisis response protocol.]
• If you report a message, that message and the messages above it in the thread are shared with Makenna, along with the names of everyone in the conversation. You are told exactly that before you confirm, and nothing after the reported message travels. The person you reported is never told who reported her.
• Deleting. Deleting removes a message from your view. The record is purged when everyone in the thread has deleted it, or when an account in it is deleted.

[CONFIRM: whether messages ship in the first version of the Den — Part P17 item 2. If they do not, this section is held back with them.]

4.8 Photographs

Every image you upload — a photo in a post, your profile picture, and an advertiser's creative too — is stripped of EXIF, GPS and device metadata and re-encoded before anything is stored. Only the stripped file is ever written. The original, with whatever your camera put in it, never reaches our storage at all.

Photographs are held in private storage. They are served only through short-lived signed links, minted for you, which expire and do not work for anyone else. There is no public address for any member photograph, and none can be guessed or hot-linked from outside the Den. Alt text is prompted every time and never required.

4.9 The notes Makenna keeps

If something of yours is ever held for moderation, or if the crisis system reaches out to you (Section 7), a note is kept on your record so that Makenna knows the history when she is deciding what to do next. It exists so that no decision about you is made from memory, and so that the second time something happens, the person deciding knows it is the second time.

These notes are for Makenna alone. They are excluded from every partner-facing figure by code. No advertising audience can read them. If a brand ever asked us for "mothers going through a hard time," the data to build that list does not exist. That is the point.

One honest exception, and it runs the other way. When your feed is drawn, the ad code reads a single flag on your record: show her nothing right now. It does not read the note, the reason, the rule, or anything else. It cannot; those tables are closed to it. It learns only that there is nothing to show. And the advertiser is never told a card was withheld — their reach figure simply reads a little lower. Section 9.4 explains when that flag is set.

4.10 What we deliberately do not collect

• No location finer than a ZIP code. No street address, no coordinates, no location from your device. Not collected, not stored, not requested.
• No fields about your children. None, ever (4.4).
• No IP address on your record, and none on your sessions. A session carries a device label — "Safari on iPhone" — and nothing more. See Section 8 for the honest note about hosting logs.
• No password in any form we could read.
• No identity documents.
• No third-party scripts inside the Den. No analytics tag, no advertising pixel, no chat widget, no ad-tech kit. Nothing that would carry your presence out of the room.

---

5. Cookies, the site tag, and consent

5.1 How consent works on the Blog

Nothing but the essential runs until you choose. When you first visit, a banner asks you. Whatever you decide is remembered for 12 months in a cookie called tmd_consent, and you can change it any time from the Cookie settings control in the footer of eligible public pages. Withdrawing is as easy as giving — one click, no explanation needed.

There are four categories:

5.2 The cookies we set

Our own (first-party) cookies:

Other companies' (third-party) cookies — only after you have said yes to the category, and never inside the Den:

5.3 Inside the Den, there is no banner

There is no consent banner in the Den because there is nothing to consent to. The Den stores only what it strictly needs to work:

• Its session cookie (tmd_den), so you stay signed in.
• The app's own offline cache, kept by your browser so the Den opens quickly and works on a bad signal.
• A push subscription, but only if you turn notifications on yourself. Section 8 explains what that involves.

Google Analytics does not run in the Den. Neither does any other measurement or advertising tag. The counting we do there is first-party, on our own servers, and it feeds one internal dashboard: how many members, how many posts a week, how many help requests were answered. No third party sees any of it.

5.4 Google Consent Mode v2

Google Tag Manager and Google Analytics load only after you allow Measurement on an eligible public page. The site prepares denied consent defaults locally before requesting Google's code. If you refuse or have not chosen, it makes no Google analytics request and sends no denied-state measurement pings. Every Google tag also requires analytics-storage consent.

After consent, Google Analytics receives a sanitized public-page address without its query string or fragment, a general page label instead of the article headline, the referring site's origin, and allowed campaign labels. Form contents, email addresses, sign-in and newsletter-confirmation tokens are not included. Enhanced measurement, Google signals and advertising personalization are disabled. No Google Ads or other advertising destination is active.

If you confirm a newsletter signup or the server saves a new partner enquiry, a clean success page may also send that outcome after Measurement consent. The only outcome detail is method=email for a confirmed newsletter signup or form_name=partner_enquiry for a saved enquiry. Neither event carries your address, name, answers, subscriber/member ID, receipt ID or a monetary value. A one-time server receipt and a once-per-page browser check prevent refreshes or repeated confirmations from generating another outcome. If you refuse measurement or leave before choosing, no Google outcome event is sent. The form and token-bearing confirmation page itself do not load this integration.

5.5 Where pixels run, and where they do not

• Google Analytics 4 is configured for eligible public Blog pages, the public Partner landing page and verified one-time newsletter/enquiry success pages, after Measurement consent. A direct visit to a success-page address without its receipt does not activate tracking. Arriving from the letter or social media does not bypass these checks.
• Private Partner pages, sign-in and API routes, the admin app, errors, story submissions, sensitive articles and Den of Mamas do not load this analytics integration. Sensitive articles and articles whose body cannot be checked omit the shared tag entirely.
• Google Ads, Meta Pixel, Pinterest Tag and TikTok Pixel are not configured as active advertising destinations. Selecting Advertising does not activate any of them in the current setup.
• Den of Mamas carries Local Den ads, and nothing that watches you. A sponsored card from a local business appears in your Den's feed. It is served by us, from our own servers, and it knows only which Den it is in. No advertising pixel, ad-tech kit, or third-party tracking script runs inside the Den. Section 9.4 sets out every rule that card obeys, including all the places it is never allowed to appear.

5.6 Do Not Track and Global Privacy Control

If your browser sends a Global Privacy Control signal, we treat it as you switching off the Advertising category. [CONFIRM: GPC handling is built and tested; required for California and several other states.]

---

6. Guarded health pages

Some of what we write about is health. Pregnancy. Trying to conceive. Fertility and IVF. Miscarriage and stillbirth. The NICU. Birth trauma. Postpartum depression and mental health. Therapy, medication, a diagnosis, a disability, special needs.

Reading about these things says something about you, and that something is health data. The Blog checks article kind, headline, excerpt, body and custom content blocks for sensitive subjects. Personal stories are always excluded from the shared tag. On these pages, a stricter rule applies regardless of what you chose in the banner:

• No Google Analytics or advertising pixel loads. The shared tag is omitted from the page.
• The page title and address do not leave the site. Nothing that says which page you were on is sent to any other company.
• No page-view event is sent by the shared analytics tag. This exclusion applies even if you previously allowed Measurement.

You do not have to do anything to get this protection, and you cannot accidentally switch it off. The list of guarded topics is kept in our tracking configuration and reviewed when we add new subjects. [CONFIRM: whether a separate Consumer Health Data Privacy Policy is required under Washington's My Health My Data Act and similar state laws, and whether the guarded-page pattern list should be published in full.]

---

7. Automated systems that touch your words

We want to be clear about this, because it is the part most sites leave vague. Some of what you write is read by code before it is read by a person. Here is exactly what that code does, and what it cannot do.

7.1 If you seem to be in crisis

The Den's code watches for words that suggest someone may be in danger, or thinking about harming herself. It reads everything you submit: posts, comments, help requests, poll questions and their options, meet-ups, private messages, your profile text, and your display name.

When it matches, these things happen at once, without waiting for a person:

1. What you wrote is held. It is not removed and not deleted. It is set aside.
2. A check-in reaches you privately, within seconds, from Makenna's name. The subject line is plain — A note from The Motherhood Diary — because a subject line can be read over a shoulder. It carries the crisis resources: text HOME to 741741, or call or text 988, the Suicide & Crisis Lifeline. Both are free and answered any hour, in the United States. [ADD: UK and EU equivalents — e.g. Shout, text SHOUT to 85258 — to confirm.]
3. Makenna is alerted immediately, on every channel she has. That alert cannot be switched off, by her or by anyone.
4. Sponsored cards stop appearing for you for 30 days. Nothing is sold to a mother the system has reason to worry about. The advertiser is never told (Section 9.4).

Then a person takes over. Makenna reads what you wrote herself, in full, and replies personally. [CONFIRM: the reply target belongs in the crisis response protocol, which sets it; this policy should point there rather than promise a figure of its own.] She decides whether to publish it, keep it held, or write again. The system never makes that decision. The only thing that goes out automatically is the check-in.

We do not put a notice on your post telling you it has been held. We would rather reach you with a message than a system banner. Nothing marks the post for anyone else either — no member can tell that a post was ever flagged, and nothing about a flag is visible outside the admin portal.

A keyword match is not a judgment. Words like these are held so we can reach you, not so we can hide you. Content that suggests a crisis is never removed automatically, and never removed by anyone before Makenna has read it.

If you are ever worried about another member, the report reasons include "I'm worried about her." It routes exactly like a crisis flag, straight to Makenna, and she is not told who raised it.

We do not send anything about you to Crisis Text Line, to 988, or to any crisis service. The numbers are for you to use, if and when you want to.

If you need someone right now: text HOME to 741741, or call or text 988 (US). [UK/EU LINE].

[CONFIRM: the build sends the check-in for abuse-category matches in-app only, unless a setting says otherwise. Confirm which is right, because it changes what arrives in a member's inbox.]

7.2 Moderation holds

Every comment on the Blog, every story submitted, everything a member writes in the Den, and every advertiser's creative passes through a rules engine before it renders. Nothing appears to anyone else while it is being decided. The engine works from a keyword and pattern library. The outcomes are:

• Approved — nothing matched. It is live at once.
• Held — something matched that a person needs to read in context. A held item looks live to you and is seen by nobody else until Makenna decides. This includes parenting judgment, unsolicited advice, comparisons, self-critical language, brand mentions, external links, and political content.
• Removed from view — a zero-tolerance match: identity-based hate speech, child endangerment, sexual harassment, violent threats, or spam flooding. These are taken out of view automatically. You are told, and you are given a way to contact us. Makenna reviews every one afterwards, and every quarter we go back through the automatic removals looking for mistakes.

Some holds are for care, and they never count against you. External links, all capitals, your first post from a new account, grief and loss, self-critical language, and politics are all held so that a person sees them first. None of them is a strike. Your first post is held so that Makenna can welcome you personally when it goes up, and you are told that is what is happening — a designed moment, not a punishment. A story over 2,000 words is held so she can ask whether you would like to split it. Nothing is cut; the piece belongs to you. A post the grief-and-loss filter matches also keeps sponsored cards away from it (Section 9.4).

Strikes, and what follows them. Where something is actually removed for breaking a standard, Makenna's decision is the strike, and you are told plainly where you stand. At the second, she writes to you privately. At the third, commenting is paused for 48 hours — that one is enforced by the code, and the composer tells you warmly the exact time it lifts. A permanent removal is Makenna's decision alone, and Section 13 explains what it leaves behind.

7.3 Nothing you write is deleted by us

You can delete your own words at any time, and they go: out of everyone's view immediately, purged from our records after 30 days (4.6). Your account works the same way (Section 13).

What we promise here is different, and narrower. Our system never deletes anything on its own, and nobody here destroys your words to make a problem go away. When something is "removed," it is removed from view and retained for Makenna. And the record of a moderation decision — what was written, which rule matched, what was decided, and by whom — is not deleted, because it is the only thing that can answer a question later.

We keep those records for four reasons:

• So the answer exists. If you ask why something happened to your post, we can tell you. The words, the rule that caught them, and the decision are all there.
• So decisions can be checked for fairness. We review our own moderation every quarter. That review is impossible if the evidence is gone.
• So a pattern can be shown. If someone is harming the community, the record of it is what protects everyone else.
• So safety comes first. A held crisis post is held, not lost. The person matters more than the feed.

An edit works the same way: your post updates for everyone, and the original is kept for Makenna.

7.4 The audit log

Every action taken in our admin portal writes a line to an audit log: moderation decisions, member approvals, content archived, distress flags marked handled, check-ins sent, suppression applied, opening a Local Den, moving a member to a different Den, cancelling a meet-up, approving or pausing an advertising campaign, sending a "May I share this?" request, newsletters sent, and requests to erase an account with the written reason.

The log cannot be edited or deleted, by anyone, from any screen. It is kept for 12 months and then [DELETED / ARCHIVED — confirm]. If you delete your account, your name is replaced in those entries with "former member" for the rest of their twelve months. Nothing that identifies you stays in them.

Its purpose is answerability: if a member asks why something happened to her post, the answer exists.

7.5 The few things the code decides on its own

Most decisions here are Makenna's. A small number of protective limits are automatic, and it is fairer to name them than to imply a person is behind each one:

• A new account can send ten follow or friend requests a day for its first 14 days.
• Sponsored cards stop for 30 days after a crisis flag, and while you have an open help request.
• Commenting pauses for 48 hours at a third removal, with the lift time shown.
• A help request nobody has answered after 72 hours is surfaced to Makenna automatically. A mother asked for help and nobody came is something she should know the same day.

Everything else — approving your account, publishing or removing a held post, a permanent removal — is a decision a person makes after reading.

7.6 What this means for your rights

Under UK and EU law you have the right not to be subject to a decision made solely by automation that has a legal or similarly significant effect on you. No such decision is made here. Holds are followed by a human decision. Automatic removals from view are reviewed by a person, and you can ask for that review at any time by contacting us. [CONFIRM: analysis under GDPR Article 22, of the automatic limits in 7.5, and of whether the AT-005 check-in constitutes a significant automated decision.]

---

8. Who we share information with

We do not sell your information. We do not give it to partners, and we do not give it to advertisers. We do share it with a small number of companies that do specific jobs for us, under contracts that limit what they may do with it. They are:

Beyond these:

• Partners (brands). A partner never receives a person. Section 9.2 explains what they do receive.
• Local Den advertisers. An advertiser never receives a person either. They receive daily totals for their own campaign in their own Den — impressions, clicks, click rate, paused days — and a rounded count of members reached. Never a member, never a list, never which mother saw anything, and never the fact that a card was withheld from anyone (Section 9.4).
• The law. If a court order, subpoena, or legal obligation requires it, we may have to disclose information. If the law allows us to tell you first, we will.
• Safety. If we believe someone is in immediate danger, we may share what is necessary with emergency services. This is a judgment Makenna makes, never the code. [CONFIRM: wording and legal basis; align with the crisis response protocol once it exists.]
• A change of ownership. If the company is ever sold or merged, your information would go with it, under this policy, and you would be told before anything changed.

A note on IP addresses and bans. Your record holds no IP address, and neither do your sessions. But if someone repeatedly abuses the community's standards, we may block them at the network level, which means an address can sit on a block list held with our hosting or firewall provider. [CONFIRM: describe the mechanism actually used.]

---

9. Advertising audiences, partners, and "do not sell"

9.1 How audiences work on the Blog

If you allow Advertising cookies, your browser may be placed into one or more audiences. Each is a rule, not a list:

No audience is built from a guarded health page. No audience is built from anything written or done in the Den. No audience can read the notes Makenna keeps. Nothing you tell us under the "a little more about you" consent becomes an advertising audience on another platform. Your life stage is not an audience anywhere, and the advertising system cannot read it at all.

9.2 What a partner sees

A partner can have a segment built for them. They cannot have the people in it. Concretely, a partner receives:

• Clicks on their own links, by post and by position
• Conversions they post back to us, and the value they attach
• The size of their audiences, as a number, never as a list

A partner never receives any individual reader by any identifier, our site totals, our subscriber count, another partner's figures, or any community content. Any figure that would describe fewer than 25 people is suppressed entirely — the partner is told the group exists and is too small. Every figure is drawn only from people who consented to the category it came from; a count that quietly included everyone would be larger, and false.

9.3 California and "do not sell or share"

We do not sell your personal information, and we never have.

California law also has a category called "sharing" — passing information to another company for advertising across sites. Using Meta, Pinterest, or Google Ads audiences as described above may count as sharing under that definition, even though no list of people ever leaves us. So if you are a California resident, you have the right to opt out of it, and the way to do that is the Do Not Sell or Share My Personal Information link in the footer, which opens the same Cookie settings and switches Advertising off. A Global Privacy Control signal from your browser does the same thing.

Local Den ads are not sharing. Nothing about you leaves us to serve one. No third-party company is involved, no identifier crosses any context, and the only fact used is which Den the feed belongs to. [CONFIRM: the "sharing" and "profiling" analysis under CPRA for Local Den ads; the CCPA/CPRA applicability thresholds; and whether a separate "Notice at Collection" is required.]

We do not knowingly sell or share the personal information of anyone under 16 — the Den does not admit anyone under 18 at all.

9.4 Local Den ads

The Den carries advertising. One kind, and only one:

A card in the feed of one Local Den, for a term, sold to a business local to that Den.

A bakery, a pediatric dentist, a swim school, a photographer. Somebody who is actually down the road. It is part of how the Den stays free. Here is every rule it lives under.

What the ad knows about you. Which Den you are in. That is the whole of it. There is no targeting by life stage, by anything you have written, by anything you have read, by keywords, by behavior, by lookalike audience, or by retargeting. No third-party data comes in, and none goes out. This is not a promise held in place by policy — the advertising code cannot query members, posts, comments, messages, or profiles at all. Access is closed off in the database itself, not filtered in the interface. That is the reason these promises hold.

What runs. Nothing of theirs. No ad-tech kit, no pixel, no third-party script ever executes inside the Den. The card is a photograph, a business name, up to two sentences, and a link, served by us.

How it is counted. On our own servers, first-party, as daily totals for each campaign in each Den — impressions, clicks, click rate, and any paused days. Never per member. There is no record anywhere of which mother saw which ad, because there is no table to write one to. The advertiser's monthly report carries those totals, a rounded count of members reached, and a written note from Makenna. Nothing else.

How it is labelled. "Sponsored · Local to [Den]" across the top of the card, in the Den's own type, never smaller than body text. If the label fails to render, the card is not shown at all.

What you can do with it. Every card carries three things:

• "Why am I seeing this?" — which answers, in one line: Because you're in the [Den] Den. That's the only reason.
• Hide this ad. If you hide one, we remember that on your record so it is not shown to you again. That note is the only ad-related thing you carry, and no advertiser ever sees it.
• Report this ad. One of the report reasons is simply "This ad shouldn't be here." It goes to Makenna like any other report.

Where a card is never allowed.

• Never in the first three positions of your feed.
• Never more often than one card per ten posts. Makenna can make that sparser. Nothing can make it denser.
• Never directly above or below a help request, an anonymous post, a post the grief-and-loss filter matched, or an event thread.
• Never inside a thread, in Messages, in notifications, on a profile, in search, in the composer, at sign-up, on the Community Standards page, or anywhere near a crisis check-in. There is no slot on any of those surfaces to switch off, because none was built.
• Paused across the whole Den for 48 hours around each dedication day.
• Never to you at all for 30 days after a crisis flag, or while a help request of yours is open. The flag sits on your record and is read when your feed is drawn. The ad code learns only "not now" — never why (4.9). The advertiser is not told; their reach figure simply reads lower.

Before any of it appears, the creative passes through the same rules engine that reads members' posts, and then Makenna approves it herself. Nothing renders that she has not seen.

---

10. Why we are allowed to do this (legal bases for UK and EU readers)

If you are in the UK or the EU, the law requires us to name a legal basis for each thing we do. Here they are.

Where we rely on legitimate interests, we have weighed them against your rights. You can object at any time (Section 12).

---

11. How long we keep things

We keep information for as long as it does the job we collected it for, and then we stop. Where we have chosen a period, it is stated. Where we have not yet, it is marked.

---

12. Your rights

Wherever you are, you can ask us for any of these. We will not treat you differently for asking.

• Access. See what we hold about you, and get a copy.
• Correction. Fix anything that is wrong or out of date. In the Den you do most of this yourself, from settings: your display name, your photograph, your about text, your life stage, your home Den when you move house, Quiet Mode, your notifications and quiet hours, and the devices that are signed in.
• Download. From settings, whenever you like, without asking anyone: everything you have written or posted — your posts, your comments, your messages, your photographs — in a portable, readable form. [CONFIRM: the download also includes your safety history in plain words — the notes from Makenna, and any hold with its plain-language reason — because the right of access reaches everything we hold about you. Confirm this before launch.]
• Erasure. Ask us to remove you, or do it yourself from settings. Section 13 explains exactly what happens.
• Portability. The download above is the portability right, self-service. Ask us if you would rather we sent it.
• Withdraw consent. Any consent you gave, you can take back, and it is as easy as giving it was: the unsubscribe link in any letter, the toggle in your account settings, the Cookie settings link in the footer. Withdrawing does not affect anything done before you withdrew.
• Object. Where we rely on legitimate interests, you can object, and we will stop unless we have a compelling reason we can show you.
• Restrict. Ask us to hold your information without using it while a question is sorted out.
• Block another member. Total, mutual invisibility, and she is never told (4.5).
• The controls on a sponsored card. "Why am I seeing this?", Hide this ad, and Report this ad, on every card (9.4).
• Cookie settings on the Blog. Change your choices any time: [COOKIE SETTINGS LINK].
• A review of any automated action. If the code held or removed something of yours, ask, and a person will look at it.
• Complain. To us first, we hope. And to a regulator at any time (Section 19).

If you are in California you also have the right to know what we collect and why, to delete, to correct, to opt out of sale or sharing (Section 9.3), to limit the use of sensitive personal information, and not to be discriminated against for exercising any of these. You can use an authorized agent; we will ask for proof that you gave them permission.

How to ask. Email [CONTACT EMAIL] with "Privacy" in the subject, or use the controls in your Den account. We will need to be sure it is you: for members, that means confirming from your signed-in account or the email on it; for Blog readers, from the subscribed address. We answer within one month, or within 45 days for California requests. If a request is unusually complex we may take longer, and we will tell you why. There is no charge.

---

13. What happens when you ask to be erased

Your right to be erased is absolute, and we honor it in full.

The moment you ask. Your account, your posts, your comments, your messages and your photographs leave everyone's view straight away. Nobody in the Den can read them, find them, or reach you.

Within 30 days. The records are purged for good. Your name, your email address, your ZIP code, your home Den, your display name, your password hash if you had one, everything you told us about yourself, and everything you wrote. Not hidden, not archived under another name. Gone.

What stays, and only this. The moderation record and the audit log keep their twelve months, because they are what lets us answer a question about a decision we made. Your name is replaced in them with "former member." Nothing that identifies you remains. Your deletion request itself is logged, with the reason you gave, so we can show it was done.

Your permissions. When you delete your account we ask about anything you agreed to share — a post that was going into the letter, a story headed for the magazine. Unless you tell us otherwise, every outstanding permission is narrowed to "no," on every destination. We never widen one after you have gone. [CONFIRM with Makenna: this is a proposed commitment, not yet a written policy.]

A permanent removal is not the same thing. If Makenna removes someone for harming the community, that account closes, but the record is retained and the email address is added to a list that blocks a new application. That is a safety measure, and it is the one case where a record survives a closed account (Section 11). It is not what happens when you simply choose to leave.

[CONFIRM: whether purging a member's posts within 30 days satisfies GDPR Article 17 and the CCPA right to delete in the form described, and what should happen to other members' replies beneath a purged post. Part P is silent on the replies. This needs Makenna's decision and the attorney's view — see Section 21.]

---

14. Keeping it safe

• Signing in. We email you a link, and the link signs you in. There is no password to lose. If you set one anyway, it is stored only as a one-way hash — we cannot read it, and neither could anyone who took a copy of our database.
• Your sessions. You can see every device signed in to your account, and end any of them. There is a "sign out everywhere" button. A session carries a device label — the browser and the kind of phone — and no IP address. When a new device signs in, we email you.
• If you lose access to your email, anything beyond "send me the link again" goes through Makenna personally. "I've lost access to my email" from a woman whose former partner has her phone is a safety event, not a support ticket, and the system should not resolve it on its own.
• Your photographs are held in private storage and served only through short-lived signed links, which expire and do not work for anyone else. There is no public bucket and no guessable address.
• Nothing in the Den is public. Every route carries noindex. No page renders to a signed-out visitor.
• The walls are in the database, not the interface. A query for another Den's feed returns nothing. The advertising system cannot read members, posts, comments, messages or profiles at all. Both are enforced at the data layer, which is why the promises in Section 9.4 hold.
• Only Makenna has access to the admin portal. There is no other administrator.
• Our providers (Section 8) hold recognized security certifications. [CONFIRM: list SOC 2 / ISO 27001 status per provider.]
• Any paid download we sell in future will be served through a signed link that expires, tied to your account, carrying your name and email visibly in the footer of the file and invisibly in the file's own metadata. That is described in the Terms of Service.
• [OPEN — not yet designed: whether the Den offers two-factor sign-in or passkeys alongside the emailed link. Nothing in the specification decides it, and this policy should not promise it until something does.]

If something goes wrong and your information is exposed, we will tell you, and we will tell the regulator, within the time the law requires — 72 hours under UK and EU law. [CONFIRM: US state breach notification obligations.]

---

15. Children

The Motherhood Diary is written for mothers, not for children. Nothing on the Blog or in the Den is directed at children, and no surface is designed for them.

• The Den is adults only. We do not open accounts for anyone under 18. [CONFIRM: what we do if we learn an account belongs to someone under 18. Erasing the record and blocking the email pull in opposite directions — see Section 21.]
• We do not knowingly collect any information from a child. Because no part of our service is directed at children, the US Children's Online Privacy Protection Act (COPPA) does not apply to it. [CONFIRM.]
• We collect nothing about your children. No names, no ages, no birthdays, no due dates, no count. There is no field for any of it and the form never asks (4.4).
• If your children appear in a photograph you post, that photograph is your content: private to your Den, stripped of location and device data, and never published anywhere else without your permission through "May I share this?" (4.6).
• Children appear in our own published photographs only with a signed release from a parent or guardian, kept on file and attached to the photograph's record. A photograph of an identifiable child cannot be published without one. This applies to Makenna's own children as much as anyone's.
• Our Community Standards ask that no one shares identifiable information about another person's child without consent. If you see that happen, tell us, and we will act.

---

16. Partners, advertisers, and the Partner Portal

If you represent a brand that works with us, or has asked to, this section is about you.

What we collect from a partner. Your name, your work email, your role, the brand's details, the answers you gave to our five qualification questions, the stage you have reached with us, agreements, deliverables, invoices, and the clicks and conversions on your own links.

What we collect from a local advertiser. If you apply at /advertise to sponsor a card in a Local Den, we collect the business details and its address or service area, a contact name, email and phone number, which Den or Dens you want, the term in calendar months, the creative you want to run, and a card authorization for the fee. /advertise is the only page of the Den app anyone can open without signing in. Members never see a door marked "buy ads."

How the money works. The card is authorized when you apply, not charged. Nothing renders until Makenna has approved the campaign. Approval captures the payment; a decline releases the authorization and nothing is taken. Stripe handles all of it and we never see or store your card number. [CONFIRM: how the card form on /advertise is served.] Fees are a flat amount per term, in three bands by the size of the Den. [AD RATE BANDS — to be set before the first advertiser.]

Who can buy. A business that is in, or genuinely serves, the Den's ZIP codes. Makenna checks that herself. Some categories are refused outright, and some applications are simply declined.

What an advertiser is not. There is no advertiser login. Advertisers do not join the Den, do not see it, and cannot message a member. If the contact email on a campaign matches a member's, that is flagged to Makenna before anything proceeds. [CONFIRM: this check is built and behaves as described.]

Your monthly report. Generated from live data and sent to the email on your record. For a partner, the figures in Section 9.2. For a Local Den advertiser, the daily totals in Section 9.4, a rounded count of members reached, and a written note from Makenna. Never a member, never a list, never any community content.

Where it lives. In the admin portal, which only Makenna can open. A partner-facing login is planned but not yet built. When it is, you will see only your own agreements, deliverables, reach, and clicks — never our site totals, subscriber counts, another partner, or anything from the Den.

If we decline. When we decide not to work with a brand, we keep the brand's name, the reason, the date, and the details of the person we spoke to. We keep this so that our answer is consistent and so that the same conversation does not happen twice. [CONFIRM: retention period, Section 11.]

Retargeting. If you visited our partner page and allowed Advertising cookies, you may see our partner offer again in Google's placements. If you are already a live partner, the same audience is used to make sure you do not see them.

Your rights. The same as everyone's, in Section 12.

---

17. Where your information travels

We are in the United States, and so are most of the companies in Section 8. If you are in the UK or the EU, your information crosses to the US when you use our site.

We make that transfer lawful by [MECHANISM — confirm for each provider: EU-US Data Privacy Framework certification, Standard Contractual Clauses, or the UK International Data Transfer Agreement]. You can ask us for a copy of the safeguards in place. [CONFIRM: Supabase and Vercel regions; whether EU-region hosting is available and advisable.]

---

18. Changes to this policy

When we change this policy, we change the date at the top. If the change matters to you — a new purpose, a new company we share with, a shorter promise — we will tell members in the Den and by email at least [30 DAYS — confirm] before it takes effect, and we will not apply a new purpose to information we already hold without asking. Earlier versions are kept and available on request.

---

19. Complaints

If something here does not feel right, tell us: [CONTACT EMAIL], subject "Privacy". Makenna reads these herself.

You can also complain to a regulator, at any time, without coming to us first:

• United Kingdom: the Information Commissioner's Office, ico.org.uk
• European Union: the data protection authority in the country where you live. [EU LEAD SUPERVISORY AUTHORITY, if any]
• California: the California Privacy Protection Agency, cppa.ca.gov, or the California Attorney General
• Elsewhere in the United States: your state Attorney General

---

20. Words we use

• The Blog — the public site: news, recipes, activities, community stories, and The Mama Who Knew newsletter.
• Den of Mamas, or the Den — the free, mothers-only, adults-only community behind a login.
• Local Den — a named area made of one or more ZIP codes. Each one has its own feed.
• Home Den — the Local Den you belong to, set from your ZIP code at signup and changed from settings when you move.
• Following — the second tab in your feed: posts from mothers you follow, whichever Den they are in.
• Friends — a mutual connection. It is what unlocks messages. Your friend list is visible only to you.
• Block — total, mutual invisibility between two members. Neither is notified.
• Member — a mother with a Den account.
• Reader — anyone who visits the Blog, with or without giving an email.
• Partner — a brand we work with on the Blog, whether as an affiliate, a sponsor, or an ad-space buyer.
• Sponsored card — the one advertisement that appears in a Local Den's feed, sold to a business local to that Den, labelled "Sponsored · Local to [Den]".
• Help request — a structured ask for help, posted to your Den. Can be anonymous.
• "May I share this?" — the permission Makenna asks before anything written in the Den appears anywhere else.
• Quiet Mode — a setting that keeps you out of the directory and out of name searches.
• Held — set aside from view for a person to read. Not deleted.
• Removed from view — taken out of the feed, but retained for moderation and audit. Not deleted.
• "Former member" — what replaces your name in the moderation record and the audit log once your account is deleted.
• Guarded page — a Blog page about a health topic where no pixel fires and no identifier is kept.

---

21. For the attorney

This draft was prepared from the TMD Master Playbook (Parts A3, B, E, G, L, M, N, O) and Part P, Den of Mamas Platform Specification, which is the governing source for everything about the Den — the Local Dens, the feed, posts, connections, messages, profiles, safety, and the Local Den ad platform. Where Part B and Part P differ, Part P wins. The tracking and member-record designs in the build files supplied the technical detail. Every point below needs professional confirmation before publication. The launch checklist in the admin portal blocks the collection of any email address until this policy is published, so these are pre-launch items.

Identity and jurisdiction

1. Legal entity name, entity type, state of incorporation, and registered address (Section 1).
2. Whether an EU representative (GDPR Art. 27) and a UK representative are required, given that the site is not deliberately targeted at the EU/UK but has readers there (Art. 3(2) analysis). If required, appoint and insert.
3. Whether a lead supervisory authority applies in the EU.
4. Whether a governing-law clause belongs in this policy or only in the Terms of Service.
5. Effective date and version control.

Consent and legal bases (Sections 3, 4, 5, 10)

1. The email gate: whether trading full content for an email address is a "freely given" consent for the newsletter under GDPR/PECR, or whether the letter should be framed as part of a contract (content in exchange for subscription). The gate copy states the exchange plainly; confirm the framing.
2. The Article 9 basis for health information members write in the Den (pregnancy, loss, mental health). The draft relies on the member having shared it with the members of her Den, or anonymously. Note that the Den is not public, which weakens an Art. 9(2)(e) "manifestly made public" argument. Explicit consent at signup may be the safer basis; if so, add it to the signup flow.
3. The basis for distress detection: Art. 6(1)(d) vital interests and Art. 9(2)(c), and whether legitimate interests is the safer primary basis with a documented assessment.
4. Distress detection on private messages. The rules engine reads member-to-member messages, and on a match Makenna sees the matched message alone, unless the thread is reported. Confirm the disclosure in 4.7 and 7.1 is adequate, and advise on the confidentiality-of-communications position — ePrivacy Art. 5(1) in the EU/UK, and the US Stored Communications Act and state wiretap analogues, including whether acceptance of the Standards is a sufficient consent from both parties to a conversation. This is Part P17 item 8, and it blocks Den launch.
5. Whether partner status and household income require the "sensitive" treatment given (they are not GDPR special category, but are treated as sensitive personal information under CPRA and by TMD's own design). Confirm the separate-consent language.
6. Consent Mode v2 "denied state" pings under ePrivacy in EU/UK jurisdictions.
7. Cookie lifetimes over 12–13 months (tmd_aud at 180 days is fine; _ttp at 13 months and tmd_vid at 13 months are at the CNIL/ICO guidance ceiling). Confirm acceptable, and confirm the Den's tmd_den session cookie is strictly necessary and needs no banner.

Local Den ads (Sections 5.5, 9.4, 16)

1. Whether serving a sponsored card selected only by Local Den constitutes "profiling" under GDPR Art. 4(4), or "sharing" for cross-context behavioral advertising under CPRA. The draft says neither, because nothing about the member is used beyond the Den her feed belongs to, no identifier crosses any context, and no third party is involved. Confirm that reasoning and the wording in 9.3.
2. Whether "Sponsored · Local to [Den]" satisfies the FTC's Endorsement Guides and .com Disclosures, and UK CAP/CMA disclosure rules for readers there.
3. The suppression flag (30 days after a crisis flag, and while a help request is open) and the hidden-ad note are both personal data on a member's record, and the first is derived from a sensitive circumstance. Confirm the legal basis in Section 10, the retention in Section 11, and that the disclosure in 4.9 and 9.4 is sufficient.
4. The legitimate-interests assessment for showing the card at all, given the room it appears in.

Automated processing (Section 7)

1. GDPR Article 22 analysis: whether the automatic hold plus the AT-005 check-in, the Tier 1 automatic removal from view, the automatic 48-hour comment restriction at strike three, the new-account request limit, and the ad suppression are "solely automated decisions with legal or similarly significant effect." The draft asserts they are not, because a human decision follows every consequential one; confirm, and confirm the wording of the right-to-review paragraph in 7.6.
2. Whether the policy's disclosure that a crisis-held post carries no visible notice to the member is legally sufficient, given the design that "the member is not told her post is held."
3. The emergency-services disclosure in Section 8 ("Safety"): wording and basis. Align with the crisis response protocol once it exists.

Retention (Sections 7.4, 11)

1. Every bracketed retention period in Section 11. The only periods fixed by the specification are the 12-month audit log, the 30-day purge of deleted content and deleted accounts, the 30-day crisis suppression, and the cookie lifetimes.
2. The moderation-record period must be decided. Part P12 says a moderation record is never deleted. The removal notice we send a member says twelve months. Those cannot both be published. Decide, then make the code, the notice and Section 11 agree.
3. What happens to audit log entries after 12 months (deletion versus archive), and confirmation that replacing the name with "former member" is adequate anonymization for the rest of that period.
4. Retention of the notes Makenna keeps, after account closure and after deletion.
5. The blocked-email list. A permanent removal retains the record and blocks the email address from re-applying. That list is itself personal data with no natural end. Set a period and a review, and confirm the legitimate-interests basis in Section 10.
6. Retention of declined applications, given that Makenna sees the earlier decision when a declined applicant writes again after 30 days.
7. Retention of declined-brand records: the Playbook suggests indefinite and notes it "interacts with the privacy policy once written." Recommend a fixed review period.
8. Retention of Local Den ad daily aggregates, and of advertiser and campaign records.

Erasure (Section 13)

1. Whether the purge model as described — everything out of view immediately, records purged within 30 days, moderation and audit rows keeping twelve months under "former member" — satisfies Art. 17 GDPR and the CCPA right to delete. It is a stronger position than the anonymized-byline model this draft previously took, and simpler to state; confirm it can be delivered as written before it is published.
2. Replies beneath a purged post. Part P is silent. If a mother's question is purged, twelve answers beneath it lose their subject. Decide: purge the thread, keep the replies orphaned, or keep the post's text as an anonymous stub. This is a Makenna decision with a legal edge, and it must be settled before launch.
3. The proposed commitment that outstanding share permissions narrow to "no" on deletion unless she chooses otherwise (Section 13). This is a draft position, not yet a Makenna decision.
4. Under-18 accounts. This policy previously promised to erase the record of any account found to belong to a minor. The removal model retains the record and blocks the email. Which applies to a minor, and does retaining a minor's record to enforce the block conflict with COPPA or state minor-privacy law?

CCPA / CPRA and US state law (Sections 5.6, 6, 9.3)

1. Whether TMD meets CCPA applicability thresholds at launch. The draft honors the rights regardless; confirm whether the California-specific paragraphs should be retained, simplified, or expanded into a separate California notice and a "Notice at Collection."
2. The "sharing" analysis for the Blog's consented advertising pixels and audience segments. The draft says they may constitute sharing and offers the opt-out link.
3. Global Privacy Control: confirm the build honors the signal and that the description matches the behavior (California, Colorado, Connecticut, and others require it).
4. Washington My Health My Data Act and similar laws (Nevada, Connecticut): whether a separate Consumer Health Data Privacy Policy is required, and whether the guarded-page pattern list should be published in full. Note that the Den holds a great deal of what those statutes call consumer health data, written voluntarily by members.
5. US state breach notification obligations (Section 14).
6. COPPA: confirm the "not directed at children" position (Section 15), and confirm the under-16 sale/share statement for CPRA.

Providers and transfers (Sections 8, 17)

1. Data processing agreements with each provider: Vercel, Supabase, beehiiv, Resend, Stripe, Google, Meta, Pinterest, TikTok, Buffer, Composio. Confirm each is in place and names the correct entity.
2. Push notification services. A push subscription is routed through Apple, Google or Mozilla depending on the member's browser. Confirm whether they are processors, whether they need naming individually in Section 8, and what the subscription endpoint and keys are in data-protection terms.
3. The international transfer mechanism per provider, and hosting regions for Supabase and Vercel.
4. The honest note on IP addresses: no IP is written to a member record or a session, but hosting logs hold them and a network-level block list may exist. Confirm the description, and whether a block list is itself a record requiring a retention period.
5. Meta's terms on receiving health data: confirm the guarded-page rule is sufficient and that Meta's Pixel is not loaded on any page with health-related content that the pattern list might miss.

Partners and advertisers (Section 16)

1. Whether brand and advertiser contacts' details (name, work email, phone) need any business-specific notice, and whether the B2B retargeting audiences require separate consent from the contact.
2. Stripe's role (processor or independent controller) for partner and advertiser payment data, and the authorize-then-capture flow on /advertise — including how the card form itself is served.

Design and build items to confirm before publication

1. The "mother and over 18" verification method (Playbook J2 item 6 / Part P17 item 1) — both paths are built and a setting chooses. Confirm which is switched on at launch, and that Section 4.1 matches it.
2. Whether Blog subscribers and Den members are one record or two (Playbook J2 item 5). The policy describes them as separate; if unified, Sections 3 and 4 need merging.
3. Build check, not a legal question: confirm before launch that noindex is set on every Den route, that no sitemap includes the Den, that no social-preview metadata is emitted for member content, and that no page renders to a signed-out visitor.
4. Build check: confirm the settings switch that chooses between the purge model and the older anonymized-byline model is pinned to purge, or removed, so the code cannot drift from Section 13.
5. UK and EU crisis line equivalents for the check-in message (Section 7.1), and the crisis reply target, which belongs in the crisis response protocol rather than here.
6. UK and EU members, and postal codes. Part P speaks only of ZIP codes; the build's schema will accept a UK outward code. Confirm what we ask a UK member for, and what Sections 4.1 and 4.10 should promise, before either is published.
7. Whether messages and meet-ups ship in the first version (Part P17 items 2 and 3), and the Quiet Mode default (item 4). Sections 4.4, 4.6 and 4.7 change if any of them slips.
8. The product name spelling — "Den of Mamas" throughout this draft (Part P17 item 10).
9. The Cookie settings link, the "Do Not Sell or Share" link, and the contact email exist in the footer before this policy goes live.

End of draft.