Privacy Notice
Last updated 7 August 2026
ComeAndGo creates temporary workspaces that delete themselves. This notice explains exactly what we hold, for how long, and what we cannot recover even if asked.
Who we are
ComeAndGo is built and operated by one person, in Thailand, under thatwhy.me. For privacy questions, contact privacy@thatwhy.me. General enquiries: hello@thatwhy.me.
What we hold, and for how long
| Data | Kept for | How |
|---|---|---|
| Messages and display names | The workspace's lifetime only | Encrypted. See "How deletion works" below. |
| A salted, non-reversible hash of your IP address | Up to 30 days | Used only to rate-limit workspace creation and abuse reports. We do not store raw IP addresses. |
| Workspace metadata — that a workspace existed, when it was created and destroyed, how many people joined, how many messages were sent | Up to 90 days, then aggregated | Counts and timestamps only. It contains no message content, no names, and nothing that identifies a person. |
| Abuse reports and the preserved copy of a reported workspace | 90 days | See "When we preserve content" below. This is the one exception to automatic deletion. |
| An account, if you choose to make one — your email address, your plan, and identifiers from our payment provider | Until you delete it | An account is optional. It exists so you can keep control of workspaces you opened from a second device, and so a subscription has somewhere to attach. You can delete it yourself at any time. |
| Which workspaces your account opened | Deleted the moment each workspace expires | Only the identifier and the key that proves you may lock, extend or end it. Never enough to read one — that needs the key in the link, which never reaches us. |
What we never collect
- No accounts, no email addresses, no phone numbers.
- No cookies and no advertising or third-party analytics trackers. The workspace pages carry a Content Security Policy that permits scripts only from ComeAndGo itself, so a third-party script cannot run here even if one were injected by our infrastructure provider — we have seen this policy block exactly that.
- No profile of you across workspaces. Two workspaces you use are not linked to each other by us.
How deletion works
Each workspace is encrypted with its own key, which is stored separately from the content and on a system with no restore capability. When the timer ends, that key is destroyed. Everything encrypted with it — including every backup copy anywhere in our infrastructure — becomes permanently unreadable at that moment.
This means we cannot recover a destroyed workspace. Not for you, not for ourselves, and not in response to a legal request. We designed it this way deliberately, and we verified it by testing recovery against our own production systems and confirming it fails.
What we cannot control: screenshots, copies, or notes made by other people in the workspace, and anything they paste elsewhere. Deletion applies to our systems, not to other people's devices or memories.
When we preserve content
If someone files an abuse report about a workspace, we take a copy of that workspace's contents and keep it for up to 90 days so it can be reviewed and, where the law requires, reported to the relevant authorities. That copy is not destroyed when the timer ends. The report form says so before you submit it.
Preserved copies are encrypted with a separate key, access is restricted, and every access is logged. This is the only circumstance in which workspace content outlives its workspace.
A technical caveat we would rather state than hide: our database provider retains point-in-time snapshots for up to 30 days, so a preserved report we delete may persist in those snapshots for up to 30 days after deletion.
The link is the key
A workspace link contains a secret in the part after the #.
Web browsers never transmit that part when they fetch a page, so it does
not reach our request logs, does not travel in a referrer header, and is
not visible to a link preview or a proxy that inspects web traffic.
Entering a workspace does send it once, over the encrypted connection,
because proving you hold it is what admits you; we compare it against a
stored one-way hash and never write it down. The consequence is that
anyone who has the full link can enter the workspace.
Share it only with people you intend to include.
Who processes data on our behalf
The service runs entirely on Cloudflare, which provides our compute, storage, bot protection, and AI. Content used to generate a workspace summary is processed by Cloudflare's AI service and, per Cloudflare's published policy, is not used to train any model. Your content is not sent to any other AI provider.
Stripe processes payments if you subscribe. It is the only other company involved, it receives your email address and your card details, and it never receives anything from inside a workspace.
Your rights
Depending on where you live, you may have rights to access, correct, or erase personal data about you, and to complain to a supervisory authority.
In practice: workspace content is erased automatically, and for the limited data we do retain we hold no identifier that would let us connect it to you. Because we deliberately cannot identify you, we may be unable to act on a request without additional information that links you to specific data. We are not asking you to provide it.
Accounts and payment
You never need an account. Creating a workspace, joining one, and reporting abuse are free of any account and always will be — the people who receive a link are the ones this service exists to protect, and they are never asked for anything.
If you do make one, we hold your email address and nothing else about you. There is no password to leak, because there is not one: signing in means proving you can read your own inbox.
Payments are handled by Stripe. Card details are given to Stripe and never reach us — we keep only the identifiers that let us tell whether your plan is live and let you cancel it. Stripe is a processor for this purpose and holds the payment record under its own terms.
Deleting your account deletes it. Any subscription is cancelled immediately, the record of which workspaces you opened is removed, and your address is erased. Workspaces already running are left alone — they belong to the people talking in them — but you will no longer be able to lock, extend or end them.
Children
ComeAndGo is not intended for anyone under 16. We do not knowingly process data from children.
Changes
If we change what we retain or for how long, we will update this page and change the date at the top.