Ziduri
Anon Postal documentation
How posts, visibility, expiry and deletion actually behave.
Posting: anonymous vs. signed in
| Anonymous | Signed in (Google) | |
|---|---|---|
| Create a public post | Yes | Yes |
| Create a private post | No — sign-in required | Yes |
| Choose an expiry window | No — fixed at 24 hours | Yes (1h, 1d, 7d, 30d, or never) |
| Edit or delete the post later | No — nothing to authenticate against | Yes, for your own posts |
| Appears in the public dashboard | Yes, if public | Yes, if public |
How expiry is enforced
When a post is created, the chosen expiry option is converted into a fixed, absolute timestamp stored with the post — not the option label itself. From that point, the app checks the actual timestamp everywhere it matters: a post that has passed its expiry timestamp is excluded from every listing and returns "not found" if visited directly, even before the cleanup job below has run. A post created with "Never" has no expiry timestamp at all and is excluded from expiry checks entirely.
How deletion actually happens
Expired posts aren't just hidden — a recurring server-side job (protected by a server-only secret, not reachable by end users) permanently removes any post whose expiry timestamp has passed. Once that job runs, the content is gone from the database, not just from view.
Signed-in users can also delete their own posts immediately and permanently at any time from the dashboard. The app checks that the post belongs to the signed-in account before allowing this — nobody can delete a post that isn't theirs.
Anonymous posts have no owning account, so there is no way to delete one manually before it expires.
Author privacy
Whether a post is anonymous or written by a signed-in user, the app never tells other viewers who wrote it. The only authorship signal ever sent to the browser is whether a post belongs to the person currently viewing it — nothing else about authorship is exposed, even to other signed-in users browsing the public dashboard.
Sign-in
Signing in uses Google as the only identity provider. It creates an account record tied to your Google profile (name, email address, profile photo) so posts you mark private, or that you want to edit or delete later, can be tied back to you. See the privacy policy for exactly what that involves.
Stack
Next.js (App Router), Drizzle ORM, Postgres (hosted on Supabase), and Google sign-in via NextAuth.
Source
Anon Postal's source is not currently public. If that changes, this page will link to it.
Related
Back to the product page, release notes, or privacy details.