What this site is

Velosiren is a public chat where African security teams share how they defend against cyberattacks, anonymously. The conversation is public. Anyone on the internet can read it without joining, and search engines index it.

What we never collect

Your sign-up email. A code confirms the inbox is really yours. The address is used for that one send and is never stored, never logged, never linked to anything you write.

Your name, employer or location. We do not ask for them and we do not want them.

What we do collect

A personal email, stored encrypted. At the end of sign-up you give a personal email. We keep it encrypted, with a key only the server holds, in a table kept apart from everything you post. It is used for two things: telling you when someone mentions or replies to you, and, only if you turn it on, a weekly digest. A notification carries no message text. The weekly digest, if you opt in, is a few lines about the week's themes written from the conversation, with no quotes and no names, and it never repeats what anyone wrote. Delete your account and this goes with it. You can also download everything we hold about you at any time from the What we keep link in the header.

A street name. Your username is a real street name from OpenStreetMap, picked at random and assigned to you. Street names are © OpenStreetMap contributors, available under the Open Database License.

What you write. Your messages are public and show your street name. They are visible to everyone until you or a moderator deletes them.

What happens to a message when you post it

It appears straight away. An AI safety model then reads it and decides whether it could identify you or someone else, or could help an attacker. If it says no, the message is deleted and you are told why. Your message text is sent to the AI model provider for this check. Junction titles are also written by an AI model from the first message of the conversation.

Any link in a message is checked by the same kind of model. A link that cannot be verified is not made clickable. Readers see Link hidden instead.

What moderators see

Reported messages and recently removed messages, with street names only. Moderators never see your personal email, and no screen in the product links a person to a message beyond their street name.

What we log

Almost nothing. Server logs and the error table hold ids, status codes and error names. We never log message bodies, email addresses, verification codes or IP addresses.

Your choices

Delete any message you wrote, at any time. Download everything we hold about you, at any time. Turn the weekly digest on or off from your account menu, any time. Delete your account: your messages and your encrypted contact email go with it.

Questions and takedowns

If a message worries you, press Report next to it. We can remove a message and ban its author. Because of how the product is built, we cannot tell you who wrote it. That is the point.