• Account data: username, email address, hashed password, and basic activity (posts, likes, favorites).
  • Technical data: standard web logs (IP, browser, timestamps) that your hosting provider and reverse proxy may collect.
  • Images: photos you upload to threads and replies, stored on the server or in whatever storage you configure.
  • Moderation data: reports, bans, and soft-deleted posts may be retained for abuse tracking.

In a real deployment you should add information about cookies, analytics (if any), log retention, and how users can request data removal—ideally after consulting a privacy professional.