Privacy
Last updated: 6 August 2026
itching.app is built to know as little about you as possible. This page sets out what it collects, why, and who else sees it.
Who's responsible
*itching, based in Croatia, is the data controller.
Contact: support@itching.app.
What we hold, and why
If you post or react without an account
| What | Why | How long |
|---|---|---|
| Your itch, its tag and its generated name | To publish it | Until you delete it |
| A random identifier stored in a first-party cookie | To enforce one itch and one reaction per person, and to let you delete your own reactions | 1 year, or until you clear it |
| A two-letter country code, derived once when you post | Aggregate statistics about where the site is used | With the itch |
| Your browser's language list and timezone name | To work out which languages you read, and when your day resets | Not stored for logged-out visitors — read from the request and discarded |
If you have an account
| What | Why | How long |
|---|---|---|
| Username | To log you in | Until you delete the account |
| Password, hashed with argon2id | To log you in | Until you delete the account |
| Streak counts and last-seen date | The showing-up streak | Until you delete the account |
| Muted tags, language preferences | Your settings | Until you delete the account |
| A session cookie | To keep you logged in | Until you log out or it expires |
We do not ask for your email address, your phone number, your real name, or your date of birth. We have no way to contact you and no way to identify you offline.
IP addresses
Your IP address is visible to our servers while your request is being handled, as it must be for the request to reach you. It is used in memory to slow down repeated login attempts and other abuse, and is not written to our database.
Beyond the two-letter country code described above, we do not derive or retain location data from it.
Legal bases
- Contract (Art. 6(1)(b) GDPR) — running your account and publishing what you ask us to publish.
- Legitimate interests (Art. 6(1)(f)) — keeping the site up, preventing spam and abuse, enforcing the one-a-day limit, and moderating content. We've balanced this against your interests; the identifiers involved are random, first-party, and not linked to anything about you.
- Legal obligation (Art. 6(1)(c)) — where we have to act on reported illegal content.
Cookies
Three, all first-party, all necessary for the site to work:
- Session — keeps you logged in. Only set if you have an account.
- Device identifier — a random value that stops one person posting five times a day or reacting to the same itch repeatedly.
- Preferences — your language settings, if you're not logged in.
None of these track you across other websites, and none are used for advertising. Because they are strictly necessary for a service you have asked for, they do not require your consent under the ePrivacy rules. Any cookie that falls outside that category would be set only after asking you.
Who else sees your data
We use a small number of processors. All of them are bound by contract to process data only on our instructions.
| Who | What they get | Where |
|---|---|---|
| Anthropic | The text of your itch, for AI moderation and translation. Not your username, not your IP, not your country. | US / EU |
| Neon | Database hosting — everything in the tables above | EU |
| Replit | Application hosting | US |
| Cloudflare | Traffic in transit; supplies the country code | Global |
| Meta / Instagram | The Itch of the Day only: its text in English, its generated name, and its tag | US |
Anthropic's API terms state that content submitted through it is not used to train their models.
Transfers outside the EEA rely on Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
We do not sell your data. There is currently no advertising on itching.app; if that changes, this page will be updated before it does.
Publishing beyond the site
Itch of the Day is published on itching.app's own Instagram account. What goes out is the text of the itch, its generated name, its tag, and hashtags. What never goes out: your username, your country, your device identifier, reaction attribution, or anything the moderation system said about you.
Instagram posts can't be deleted through the API we use. If you delete an itch that has already been published there, it stays up until a human removes it. Write to support@itching.app and we'll do it, but treat anything published as permanently public.
Deleting things
An itch: from your profile, at any time. It disappears from all feeds immediately and is removed from our database within 30 days. Cached translations of it are deleted with it.
Your account: from your settings page. Your username, password hash, streaks and settings are deleted. You'll be asked whether to delete your itches too or leave them up — left up, they keep only their generated name and can no longer be linked to you by anyone, including us.
A post you made anonymously with no account: we can't verify it's yours, so we can't delete it for you on request. If you still have the same browser, delete it from the link you posted from. Otherwise, contact us with the permalink and we'll consider it on the facts.
Your rights
Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or provide it in a portable format.
Because we hold no email address and no verified identity, the honest position is this: if you can log into an account, we will act on requests about that account. If you can't, there is often nothing we can match a request to — which is a consequence of collecting so little, not an excuse for ignoring you. Write to support@itching.app with whatever you have and we'll do what's possible.
You also have the right to complain to a supervisory authority. In Croatia that's AZOP — the Agencija za zaštitu osobnih podataka, azop.hr.
Children
itching.app is not for anyone under 16. We don't knowingly hold data about children, and we'll delete any account we learn belongs to one.
Security
Passwords are hashed with argon2id. Traffic is encrypted in transit and the domain is HSTS-preloaded, so a plain-HTTP connection to itching.app isn't possible. Session cookies are HttpOnly, Secure and SameSite=Lax.
No system is perfectly secure. If we become aware of a breach affecting your data, we will notify the supervisory authority and, where required, you — although with no email address on file, notice to you would have to be a notice on the site.
Changes
We'll post the date at the top when this changes. Material changes get a notice on the site.