Messaging and Monitoring Notice

In short

• Nothing you write here is end-to-end encrypted. Our systems can read it, and staff can read it in the situations listed in section 6.
• What you write for other people to see is checked by automated safety tools. Some of those tools are run by outside companies working for us, which receive the text and nothing about who wrote it (section 3.1).
• Private messages and thread messages are checked before they are delivered. Table chat goes through a word filter, is delivered, and is then checked, usually within about a minute.
• Automated tools can stop a message, withdraw it or hide it while a person looks. A person, not software, decides every notice, 24-hour mute, suspension and removal for conduct. Software may hold an item, stop your table chat for one visit, or pause an account while a person looks, including a pause of up to 24 hours when activity looks like abuse; that pause ends by itself unless a person extends it, and it is not a finding. One closure happens by rule: an age re-check answered "under 18" or "high-school student", or left unanswered.
• Table chat is logged for 14 days. Private messages and thread messages are kept until you delete them, and for no longer than 12 months.
• Staff do not browse conversations, and there is no staff screen for browsing or searching Messages. Staff can read a message, and up to ten messages either side of it, only when someone in the conversation reports it or screening flags or holds it. A table's chat log can be opened only in the six situations listed in section 6.2. Each time, a reason is recorded in a log built so that entries cannot be changed.
• A report captures the reported message and the messages around it automatically, with some facts about the accounts involved. The person reported is not told who reported.
• The law limits who we may give your messages to. We do not sell them, use them for advertising or use them to train AI models. We do not report members to their colleges as a routine matter, and we do not send your messages to your college.
• The people you write to can keep and share what you send them. We cannot prevent that.
• Calls and links to other services are outside Tillyard. We log nothing there, and our reporting does not reach it.

If this summary and the full text below ever differ, the full text governs.

1 About this notice

1.1 Why it exists

Tillyard lets adults who mostly do not know each other talk in text. Keeping that safe with a very small staff depends on three things: automated screening, logs, and a report process that carries its own evidence. You are entitled to know what each of those involves before you write anything. This notice tells you, and by agreeing to it you consent to what it describes.

1.2 What it covers

In this notice a message is anything you write for another person to read. That includes:

• table chat in The Shop: chat at a table, including a reserved table such as a scheduled table, a project booth or an organization's table, and the conversation in a Fifteen;
• Messages: private messages between two connected members;
• threads: group messages, including the threads that belong to booths and organizations;
• short text shown to other members: your order line, a table label, a house-question answer, the text on a card, a thread title, your profile text;
• work and comments that pass between members: papers, readings and the reasons given with them, round entries and scores, portfolio pieces and what readers typed about them, résumé swap copies and notes, confirmations and contribution lines;
• what you write to us: reports, disputes, appeals, removal requests, inquiries and answers to the editor's questions.

Sections 3 to 5 treat these differently where the platform treats them differently.

1.3 Who it applies to

It applies to every member. It also applies, as far as it can, to people who are not members but write to us through a public form or a confirmation link. What they write is handled and kept as described in sections 3.2 and 7.8. They do not take part in conversations.

1.4 How this notice fits with our other documents

• The Privacy Notice covers everything else about personal information: what we collect, your rights, and the companies that provide services to us.
• The Data Retention Schedule lists every retention period in one place.
• The Community Guidelines say what you may and may not write.
• The Law Enforcement and Legal Requests Policy says how we handle legal demands for information.
• The Terms of Use are the contract all of these belong to.

Where this notice and another document cover the same point about messages, this notice governs, with one exception: on how long something is kept, the Data Retention Schedule governs. Section 37.5 of the Terms of Use sets the order among all our documents, including the sections of those terms that prevail over every other document.

1.5 Words we use

Words that have one meaning in every one of our documents, such as member, visitor, staff, the editor, record item, hold, case and tip, are defined in Definitions. The words below are added for this document's own subject, or repeated from Definitions for convenience. If a repeated meaning ever differs, Definitions governs the meaning of the word.

• We, us and our mean Tillyard, which operates the platform.
• Staff means the owner and any person who works for us under a paid, written contract and holds a staff account. At present the owner is the only member of staff. Members are never staff, and no member is given any power over another member's content or account, whatever title or history that member has. Nobody else is given a staff account until they have signed the company's services agreement, which includes a duty to keep what they see confidential. Members are never staff. Hosts, readers, organization officers and people who start threads have no access to anything described in section 6.
• Conversation means a set of messages among the same people in one place: the Messages between two members, one thread, or the chat at one table on one evening.
• Content means the words of a message.
• Message records means facts about a message other than its words: who sent it, to whom or at which table, when, and what screening made of it.
• Automated screening means software that checks text against a word list and, where it is configured, sends the text to an automated classification service that returns scores for kinds of harm.
• Flag means a screening result that lets a message through and marks it for possible review by a person.
• Hold means a screening result, or a staff action, that hides a message from everyone except its author while a person looks at it. A hold is not a finding that a rule was broken.
• Case means our file on a report, a hold, a dispute, an appeal or a legal request.
• Evidence packet means the fixed copy of a message and its surroundings that is saved into a case.

2 The facts first

2.1 Messages are not end-to-end encrypted

• Messages travel between your browser and our servers over an encrypted connection.
• On our servers they are stored in a form that our systems can read. That is what makes screening, and reports that carry their own evidence, possible.
• "End-to-end encrypted" would mean that only you and the person you are writing to could ever read a message. That is not the case here.

2.2 This is not a place for secrets

Do not send passwords, sign-in codes, bank or card details, identity numbers, or anything about your health or another person's that you would not want a third person to read.

2.3 Text only, and nothing is recorded

• The platform carries no audio or video, so nothing spoken is ever recorded.
• We do not record your screen, your keystrokes or your pointer.
• No third-party session-recording tool, chat widget, advertising tracker or analytics script runs on the site.

2.4 Everyone you can write to has agreed to this

Only members can take part in conversations here. Every member accepted the Terms of Use, which bring this notice in, and was shown the statements in section 12 before first writing at a table or in Messages. Everyone in a conversation has therefore been told that it is screened and logged in the way this notice describes.

3 What is screened automatically

3.1 How screening works

Screening has two layers.

1. A word list that we keep. It runs on our own systems and is always on. It looks for listed words and for spellings altered to get past it.
2. Automated classifiers. Where these are configured, the text is sent to an automated service that scores it for kinds of harm and sends the scores back. At the date of this version the services are OpenAI's moderation service and a safety model run on Cloudflare, the company that hosts the platform. The Privacy Notice names each service we use and links to what it says it does with the text it receives.

What is sent to a classifier is the text. We do not attach your email address, your account identifier or your IP address to it. If the text itself contains personal details, they go with it, and when you set or change your name, the name itself is checked.

No person is involved at this stage. Software reads the text, produces a result, and the result decides which of the outcomes in section 3.2 follows.

3.2 What happens where

Table chat is the one place where a message can be seen by others before a classifier has looked at it. That is a deliberate trade so that conversation in a five-minute break feels live. If the checking falls behind, table chat is switched off until it catches up.

3.3 What screening looks for

• Kinds of harm: harassment and threats, hate, sexual content, anything sexual involving a minor, self-harm, violence, and illegal activity.
• Listed words.
• Contact shapes: web addresses, email addresses and phone numbers. For an account in its first days, a message containing one of these is refused. For other accounts it is delivered and marked.
• Patterns: messages sent very fast, the same text in several places, repeated stops by the word list, and repeated moves to one person's table. These produce signals. Several signals about one member in one evening may open a case for a person to look at. Two patterns act at once and for a short time only: three lines stopped by the word filter in one visit switch table chat off for you for the rest of that visit, and a room that is being flooded may close the connection of the account doing it.
• Removed material. When a removal request is upheld, software can search stored text, including Messages and threads, for the exact link or text, and holds any later message that contains it. It works from a one-way fingerprint of the removed link or text. Staff see only the matches.
• Shared networks. Before one member is offered another's work to read or score, software compares keyed hashes of the network addresses the two accounts signed in from, and drops the pairing if they match. This looks at sign-in records, not at messages; the Privacy Notice, section 3, covers it.

3.4 What screening does not do

• It does not give a notice or a strike, impose the 24-hour mute as a penalty, suspend an account or remove one. A person, not software, decides every notice, 24-hour mute, suspension and removal for conduct. Software may hold an item, stop your table chat for one visit, or pause an account while a person looks, including a pause of up to 24 hours when activity looks like abuse; that pause ends by itself unless a person extends it, and it is not a finding. One closure happens by rule: an age re-check answered "under 18" or "high-school student", or left unanswered.
• It does not build a profile of you for advertising. There is no advertising here.
• It is not used to train AI models (section 8.13).
• It does not judge whether text was written by AI.
• It is not a crisis service. A message about self-harm may be flagged, and it may also be missed. The Community Guidelines list people who can help at any hour.

3.5 Screening makes mistakes

Automated screening is wrong in both directions. It can hold something harmless, such as a surname, a medical term or a quotation in a history paper. It can miss something harmful. We do not claim that any particular thing will be caught.

If something of yours is held, you will see it marked as waiting. A person looks at held items, and we aim to tell you the outcome. If something harmful gets through, report it.

3.6 When screening cannot run

The classification services have daily limits and can fail. When that happens we may switch table chat off, hold items until they can be checked, hold messages from new accounts, or fall back on the word list alone until the service returns. You may see a message such as "Table chat is resting" or "Saved. It is waiting on a safety check before others can see it."

3.7 Child safety

Where screening or a report points to apparent sexual exploitation of a child, the matter is handled differently from everything else in this notice:

• it goes to the owner alone;
• the account concerned is not told;
• the material is not sent to a classification service again;
• it is preserved as federal law requires and reported to the National Center for Missing and Exploited Children.

Federal law does not require us to monitor for or search out such material, and we do not claim to. It requires us to report when we know of it, and we do. The Child Safety Policy sets out the full procedure and governs on this subject.

4 What is logged

4.1 Table chat

• Every message sent at a table is stored in that room's log with the table, the time and the sender. A message that the word list stopped is logged as well.
• The log records what screening made of each message and whether it was later withdrawn.
• Where a call link is set at a table, the log records who set it, when, and when it was cleared.
• If the log cannot be written, chat does not open. There is no table chat without a log.

4.2 Messages and threads

• The content of each message, who sent it, the conversation it belongs to and when it was sent.
• What screening made of it, and whether it was held or deleted.
• For a thread: who started it, who was invited, who accepted, and who left or was removed, with the times.

4.3 Records that are not content

• Connections: who is connected with whom, how the connection came about and when.
• Nods and card trades: the nods you sent and received, and your own choices about trading cards.
• Blocks and mutes.
• Visits: when you came in and left, your drink and your line, the pots you counted, and who shared a table with you that day.
• Favors: who offered, who asked, who accepted, and when.
• Reports and cases: the reports you made, the reports made about you, and what was decided.

4.4 Technical records

• We do not attach your IP address or your browser's details to your messages.
• Limits on how fast anyone can act use a keyed hash of the IP address, not the address itself.
• When a report is filed or a case is opened, a keyed hash of the IP address and the browser's identifying string in use at that moment may be saved into the case.
• A hashed address is still personal information. We treat it that way, and the Privacy Notice covers it.

Sign-in sessions and devices are covered in the Privacy Notice.

4.5 What is not logged

• Keystrokes, pointer movement and the contents of your screen.
• Text you typed at a table and did not send.
• Audio or video, because there is none.
• Your location.
• Anything said on an outside call or in another app.

Tillyard Research's writing desk is a separate matter with its own consent. With your agreement it keeps a history of your drafts, counts of how much you typed and pasted, how long the desk was in active use, and how many saves were made without scripts. It also keeps the words of each paste, up to 2,000 characters, which the paper's readers and the editor see highlighted. It never records which keys you pressed. The AI-Use Policy, section 8, says more. The notice shown at the writing desk covers it.

4.6 What staff do is logged too

The first time on any day that a member of staff opens a case's evidence, and each time one opens a table log or a member's page, hides or restores an item, or acts on an account, an entry is written to the staff action log giving who, when and why. The log holds identifiers and reason keys, never names, email addresses or the text of messages. The table that holds it refuses any change or deletion, and its entries are chained together so that one could not be altered or removed afterward without the break showing. That applies to the owner as much as to anyone. Because entries cannot be removed, the log is kept for as long as Tillyard operates (section 5).

5 How long we keep it

This table repeats the Data Retention Schedule, which governs if the two ever differ.

How to read the table:

• Deletion runs on a schedule. "Kept for 14 days" means that a scheduled task deletes the material soon after day 14. It is not instant.
• Deleting your own message removes it from the conversation. The other person may already have read or copied it, and a copy that was saved into a case before you deleted it stays with that case for the case's period.
• Evidence packets do not change. Later edits and deletions, including deleting your account, do not alter a packet. That is its purpose.
• Deleting your account. After the closing period the Account Deletion and Data Export Policy describes, the text of the messages and thread messages you sent is removed, and your seat in each conversation shows only that a member left. The other people's own messages stay. Your table chat lines still inside the 14-day period are blanked, name and text. Case files that involve you stay for their own periods.
• Backups. Something you deleted can persist in a backup until that backup is itself deleted. Nothing in a backup is shown on the site, and we do not restore single messages from one.
• Legal holds come first. If the law requires us to preserve something, or we have received a valid request to preserve it, the periods above are paused for that material until the hold ends.
• The other person's copy is theirs. We cannot delete what someone has copied out of the platform.

6 When staff can read a conversation

6.1 Who staff are

Staff means the owner and any person who works for us under a paid, written contract and holds a staff account. At present that is one person, the owner. Staff reach the tools described here through a separate staff console with its own sign-in gate. No member, whatever their title or history, has any of this access.

6.2 When staff may read: the whole list

Staff do not read conversations to see what is being said. This section is the whole list of when a member of staff may read what members wrote to each other. It is narrower for private messages than for table chat, because that is how the tools are built.

Messages and threads

Staff can read a message, and up to ten messages either side of it, only when someone in the conversation reports it or automated screening flags or holds it. There is no staff screen for browsing or searching conversations.

The owner can retrieve stored messages from the database only for one of these three purposes:

1. to answer legal process (section 8.4);
2. to make an emergency disclosure, or a child-safety report, that the law allows or requires (sections 8.5 and 8.6);
3. to run the exact-match search for copies of removed material that the Intimate-Image Removal Policy describes, where the owner sees only the matches.

The owner records each retrieval, with its purpose, in the staff action log.

Table chat

A member of staff may open a table's chat log only in these six situations:

1. It was reported. Staff read the evidence packet (section 7).
2. Screening flagged or withdrew a line, or abuse signals opened a case. Staff read the line concerned and enough around it to decide.
3. An open case needs it. Where a case is already open, such as a report about a member, a dispute, an appeal, a suspected false record, suspected fraud or a suspected return after removal, and a table's log is likely to hold evidence that bears on it, staff may read that log for that purpose.
4. The law requires it, or an emergency calls for it (sections 8.4 to 8.6).
5. You ask us to. For example, you ask us to look at something that happened at your table.
6. A fault or an attack cannot be dealt with otherwise. In the rare case where a technical failure or a security incident cannot be diagnosed without looking at a log, staff may look at as little as the problem requires.

In every case the member of staff must record which table, which day and why before the log opens, and the view is written to the staff action log (section 4.6). Staff do not open a table's log to spot-check it.

6.3 How much staff read

• A report about table chat: the reported message and the ten messages on either side of it at that table, the table's label and any call-link events. For a Fifteen, the whole conversation up to a fixed length.
• A report about a message or a thread message: the reported message and up to ten messages either side of it in that conversation, including the kept text of any note taken back or edited in the last 14 days.
• Staff are expected to read no more than the matter in front of them needs.

6.4 What staff do not do

• Read conversations out of curiosity, or to see how a feature is being used.
• Spot-check table logs.
• Use what they read to market or sell anything.
• Pass what they read to other members, to your college, to an employer or to anyone else, except as section 8 allows.
• Tell the person who was reported who made the report.

6.5 Seeing the site as a member sees it

The owner can view the site as a particular member sees it, read-only, for up to ten minutes at a time. That view cannot open Messages, drafts, résumé copies or data pages, cannot join a room and cannot send or change anything. Each use needs a reason and is written to the staff action log.

6.6 Child-safety matters

As section 3.7 says, these go to the owner alone, and the owner looks at no more of the material than the legal duty requires.

7 What is attached to a report

7.1 What a report captures

When someone presses report on a message, the platform saves an evidence packet into a case at that moment. Nobody has to copy or paste anything. The packet holds:

• the reported item, as a fixed copy;
• its surroundings: for table chat, the ten messages on either side at that table; for a message or a thread message, the messages around it in that conversation. If you were part of that stretch, your own messages are included;
• when and where: the times, and the room and table or the conversation;
• the accounts involved: their identifiers, how old each account is, and earlier reports about the reported account with their outcomes;
• what screening made of the messages, including classifier scores;
• for table chat, the table's label and any call-link events;
• the technical details described in section 4.4;
• the category you chose and anything you wrote in the report.

A fingerprint of the packet is stored with it, so that any later change would show.

7.2 A packet does not change

Once a packet is made, later edits and deletions do not affect it. If either person deletes messages or deletes their account, the packet stays with the case for the period in section 5.

7.3 Who sees a packet

Staff working on the case. The person who reported, the person reported and other members cannot see it.

7.4 What the person reported is told

If we act, the notice says which item is concerned, which rule it was under, and whether it came to us through a member report or through automated screening. It does not say who reported. In a conversation between two people the other person may be able to guess, and we cannot prevent that. If that would put you at risk, say so in your report.

7.5 Reporting from inside and outside a conversation

• If you report a message in a conversation you are part of, you are choosing to show us messages that you sent or received.
• If you report something you saw at a table, the packet is built from that table's log.
• If you report a member and not a particular message, the case starts with what you wrote, and section 6.2 governs what staff may then read.

7.6 What a report does by itself

A report does not suspend or remove anyone. In some situations a reported item may be hidden while a person looks, for example in the most urgent categories, or when several established members report the same item. The Community Guidelines explain what can follow.

7.7 Records about reporting

We record who reported what and when, and we weigh reports using things such as the age of the reporting account and how earlier reports turned out. There is a daily limit on reports. These measures exist so that reporting cannot be used as a weapon.

7.8 Forms used by people without an account

A report, a dispute, a removal request or an inquiry sent through a public form stores what the person wrote, the contact email they gave, a ticket number and a keyed hash of their IP address for rate limiting. What a person writes in a report, a dispute, a second-look request or a removal request is not sent to any outside classifier; only staff read it. The name, organization and message on the larger-payment inquiry form, and the name and role an outside confirmer types, go through the same automated screening as other text. The Privacy Notice covers people who are not members.

8 Who else can see your messages

8.1 The people you wrote to

They can read what you sent them, keep it, copy it and show it to others. The Community Guidelines restrict some of that, such as posting a private conversation to embarrass someone, but we cannot technically prevent it. Write accordingly.

8.2 Companies that provide services to us

Some companies run parts of the platform for us under contract:

• our hosting provider stores and carries everything on the platform;
• the classification services named in section 3.1 receive text in order to score it;
• our email provider sends our emails. Those emails never contain the text of another member's message. They say, for example, that you have a new message, and link to it.

The Privacy Notice names each one.

8.3 The law that limits us

A federal law, the Stored Communications Act, restricts what a service like this one may do with its users' messages. In practice:

• We generally may not give the content of your messages to anyone outside Tillyard unless a person who sent or received the message consents, the law compels it through proper legal process, or one of a short list of exceptions applies.
• Records about you that are not content are less tightly restricted, but we may not hand them to a government body without legal process, your consent or an emergency.

The rest of this section says how we apply that.

8.4 Courts and law enforcement

• For the content of messages we require a search warrant, or another form of legal process that the law makes sufficient for content. For records we require a subpoena or a court order, as the law requires for the kind of record.
• We do not hand over the content of messages in answer to a subpoena in a civil lawsuit. The law does not let us do that without the consent of someone who sent or received them. A person who needs their own messages for a lawsuit can export the messages they wrote (section 9).
• We check each request and may object to one that is unclear, too broad or not valid. We aim to give no more than is required.
• We aim to tell you before we disclose anything, so that you can take advice and object. We do not do so in the cases listed in section 8.2 of the Law Enforcement and Legal Requests Policy: where a court order or a statute forbids it, in an emergency disclosure, in a child-safety matter, where telling you would put a person at risk, or where we have no working way to reach you.

The Law Enforcement and Legal Requests Policy has the details and the address for serving process.

8.5 Emergencies

If we believe in good faith that an emergency involving danger of death or serious physical injury to any person requires disclosure without delay, we may give a law enforcement agency or other government emergency service the messages and records that relate to the emergency.

8.6 Child-safety reports

Federal law requires us to report apparent child sexual exploitation to the National Center for Missing and Exploited Children. Such a report includes the content concerned and the information we hold about the account.

8.7 Your college

• We do not report members to their colleges as a routine matter. Breaking the Community Guidelines is not, by itself, something we tell a college about.
• We do not send your messages to your college.
• If your college, or anyone claiming to act for it, asks us about you, we treat that as we would any request from outside. We point to whatever you have chosen to make public on your Record. For anything else we ask for your consent or for valid legal process.
• The Terms of Use (section 19.9) and the Community Guidelines (section 7.8) keep open a narrow possibility, in these words: "Serious misconduct such as threats, stalking, fraud or impersonation may lead to permanent removal and, where appropriate and lawful, referral to law enforcement or your institution." "Your institution" means your college. A referral to a college is rare and is our own decision, for example to its police or safety office where there is a threat to people on its campus. What such a referral may contain is set by section 19.9 of the Terms of Use: your name, your college and a factual description of what happened and what we decided, to which you consent there. It never includes the content of a message on that footing. Content could be disclosed only with the consent of a person who sent or received it, or on another basis in this section. Many colleges are public bodies, which the law treats as government bodies, and that narrows further what we may send them.
• If another member has harmed you and you want to take it to your college, that decision is yours. Your export holds the messages you wrote, not the ones you received. To keep what someone sent you, report it, which saves a fixed copy into a case, or copy it yourself while the conversation is kept.

8.8 Employers, recruiters, sponsors and people who tip

Nothing. They see only what you have chosen to publish on your Record or your public page. Tipping or sponsoring gives nobody access to members' messages or records.

8.9 Other members

Members see only the conversations they are part of. A member who reports something does not receive the evidence packet. Hosts, thread starters, organization officers and readers have no way to see conversations they are not in.

8.10 Running the service and protecting the company's own rights or property

We may use and disclose messages and records as necessarily incident to providing the service or to protecting the company's own rights or property. Examples: giving them in confidence to our lawyers or our insurer, using them to bring or defend a legal claim, and using them to investigate fraud against the company or a security incident. This is not a general power to disclose messages in order to protect other members or the public; where a person's safety is at stake, section 8.5 is the case that applies.

8.10a Evidence of a crime that we came across by accident

The law lets a provider give law enforcement content that it obtained inadvertently and that appears to relate to a crime. We do not go looking through private messages for this; staff read a conversation only as section 6 allows. If something of this kind comes to our attention in one of those ways, we may refer it.

8.11 If the platform changes hands

If the company or the platform is sold, merged or reorganized, the messages we hold at that time may pass to the new operator. The Privacy Notice says what happens then and what notice you get.

8.12 At your direction

You can export the messages you wrote (section 9). Where you give us clear instructions to send something of yours to someone else, we may do so.

8.13 What we do not do

Sections 8.1 to 8.12 are the whole list of who can receive the content of your messages. It is the same list as section 17.9 of the Terms of Use and section 5.5 of the Law Enforcement and Legal Requests Policy. Beyond it:

• We do not sell or rent members' messages or message records.
• We do not use them for advertising.
• We do not use them to train AI models, and we do not give them to anyone else for that purpose. Automated screening scores a message; it is not training.
• We do not give them to data brokers.

9 Your choices

• Delete your own messages in Messages and threads.
• Mute, block or leave. Each is in every conversation and at every table.
• Hold Messages at the counter. Messages that arrive while you are brewing a pot can wait until it pours.
• Export. Your data export includes the messages you wrote in Messages and threads, and your own table chat lines that are still inside the 14-day period. It leaves out messages other people wrote to you. To keep what someone sent you, report it, which saves a fixed copy into a case, or copy it yourself while the conversation is kept.
• Close your account, as the Terms of Use and the Privacy Notice describe.
• Withdraw your agreement. Screening and logging are part of how table chat, Messages and threads work, so they cannot be switched off for one member. You can withdraw your agreement to room logging, or to the screening of Messages, under History in your account. Withdrawing closes that area for you until you agree again. The rest of the platform stays open to you, and withdrawing does not cost you your standing or your Record. What you have already sent stays subject to this notice for the periods in section 5.

If we change this notice in a way that widens what is screened, logged, read by staff or disclosed, we will ask you to agree to the new version before you next write in the places it affects.

10 What this notice does not cover

• Outside calls and other apps. If a table's opener sets a link to a call on another service, or you move a conversation to another app, nothing said there is logged by us, our block and report controls do not reach it, and that service's own terms apply.
• Email you send to our addresses. It is handled by our mailbox provider and covered by the Privacy Notice.
• Emails we send you. These carry no member-written text other than your own.
• The writing desk's draft history, typing counts and record of pasted passages. These have their own notice and consent (section 4.5).
• Résumé import. The file is read inside your browser and never sent to us. Only the text you choose to save reaches the platform.
• Tips. Payments are handled on Stripe's pages. We receive nothing about a tip through the site.

11 Keeping messages secure

• Messages travel over encrypted connections.
• Access to stored messages is limited to the systems that need it and to staff acting under section 6, through a separate console with its own sign-in gate.
• Staff actions are logged (section 4.6).
• No system is perfectly secure. If a security incident affects your messages, we will tell you as the law requires. The Privacy Notice says more.

Your part: keep your devices and passkeys to yourself, and sign out on a shared computer.

12 What you agree to, in so many words

These are the statements the site shows where you agree, word for word. The Words on the Screen: Consent Register keeps the same wording in one place with every other box on the site.

12.1 When you join

The box you tick at sign-up says that you agree to the Terms of Use, which bring this notice in by reference. It does not name this notice. Under the box is this line, which you do not tick. The screen reads:

"Rooms and messages here are logged. What you type is screened by automated safety tools, some run by outside companies working for us, which receive the text. Nothing is end-to-end encrypted. Staff may read a conversation in the cases listed in the Messaging and Monitoring Notice, such as a report or a flag."

12.2 The first time you order in the shop

You tick this box, once. The screen reads:

"I understand that what I type at a table is logged for 14 days, may be checked by automated safety tools, and can be read by staff if it is reported or flagged."

12.3 The standing line at every table

It is shown under the chat box whenever chat is open. You do not tick it. The screen reads:

"Table chat is logged for 14 days and may be reviewed."

12.4 The first time you open Messages

The page is headed "Before your first message" and lists five things. Under them is the box you tick. The screen reads:

1. "Messages pass through automated safety tools before they are delivered. One of those tools is run by an outside provider, which receives the text of a message and nothing about who wrote it. The tools do not catch everything."
2. "Messages are not end-to-end encrypted. They are stored on our servers so they can be delivered and so you can search them."
3. "Staff can read a message, and up to ten messages either side of it, only when someone in the conversation reports it or the safety tools flag it. There is no staff screen for browsing conversations."
4. "You can take back any message you sent. We keep a copy for 14 days in case it is reported, then erase it. Every message is cleared twelve months after it was sent."
5. "We hand a message to anyone outside the company only with the agreement of someone in the conversation, or when the law requires it."

The box reads: "I have read this and want to use Messages."

12.5 What these statements add up to

The statements are short, and this notice is the full account of the same things: section 3 for what is screened and by whom, section 6 for when staff may read, and section 8 for who else can receive a message. For table chat, the shop's box and standing line name a report and a flag; section 6.2 lists four further situations, which are rare. We do not treat a short statement as your agreement to something it does not say. Where this notice goes further than the statement you ticked, what binds you is the Terms of Use you accepted, which bring this notice in, and section 9 says how to withdraw.

We record when you agreed, to which statement and to which version of this notice.

13 Changes to this document

• Each version of this notice carries a number and an effective date at the top, and earlier versions are kept available.
• A change that widens what is screened, logged, read by staff or disclosed takes effect for you only when you have agreed to it (section 9).
• A new or replacement provider that receives what members write, such as a different screening service, is always treated as a widening change, because your agreement is to the recipients named in section 3.1.
• Other changes, such as a provider that does not receive member text, a shorter retention period, a clarification or a correction, take effect when posted. We aim to tell members on the site about any change of substance.
• A change to a retention period applies to what we hold from the date of the change. A longer period is treated as a widening change.

14 Contact

• Questions about this notice: support@tillyard.org.
• To report a message or a member: the report control beside it, or the public report form at tillyard.org/report.
• Legal process and preservation requests: legal@tillyard.org, or by post to Tillyard, 10602 York Rd SW, Etna, Ohio 43062. See the Law Enforcement and Legal Requests Policy.
• Security problems: security@tillyard.org.
• Accessibility: accessibility@tillyard.org.
• In an emergency, call 911. In a crisis, call or text 988.

Questions about this document

support@tillyard.org

Legal notices

legal@tillyard.org

By post

10602 York Rd SW, Etna, Ohio 43062

For anything else, see where to send what.

Fingerprint of this text (SHA-256): 8f8df8a82dd51d9500b382ceaf8da8ecd6314b61bb3648a167e1d5c9865730a7