What we keep in this ground

CyberRIP has no sign-up. Words you leave are public. Anything that could identify you is stored as a hash when we can help it.

The banned account email never goes in as plaintext. Dedup uses a salted hash (PEPPER + platform + normalized email). Visitor IPs are hashed too, for caps, review, and burst limits.

Your first stone sets an httpOnly, SameSite=Lax signed cookie (rip_m). We store only the token hash. Clearing the cookie does not erase the graves; the recovery code brings you back.

The recovery code is shown in plaintext once, when it is minted. We keep a hash. If you lose it, there is no second copy.

A report goes to a human queue. Three clicks do not hide a stone. Only a very high number of distinct IPs can auto-hide it. Staff may hide or delete. Deleted stones do not come back to the yard.