An essay from the house
Nobody gets doxxed all at once
The word sounds like breaking in. Almost none of it is. It is a map, assembled one small clue at a time, and the mechanics of the map are what you can actually do something about.
Masque ·
The map, not the hack
Doxxing sounds like intrusion, a password stolen, a database cracked. The overwhelming pattern is nothing of the kind. It is correlation: one detail from this account, one from that one, laid side by side by someone patient until the pieces become a name, then a workplace, then a street.
Our co-founder lived this. She never showed her face. What found her was not a camera but a pattern, accounts mapped against each other by people with time. Her letter tells that story in her own words; this essay is about the mechanics, because the mechanics are the part you can do something about.
What the clues actually are
The clues are almost never the photo's subject. They are the room around it: a window with a skyline in it, a mirror or a reflection carrying a second face, mail on a counter, a street sign through the curtains, a plate at the edge of the frame, a work lanyard on a hook.
They are also the habits. The same handle reused on a safe account and a risky one. The same distinctive phrasing in both places. A tattoo described once and shown once. A voice in one clip matched to a voice somewhere else. A posting schedule that quietly maps to a time zone and a shift.
And they are the file itself. Photos carry metadata, and on some devices that includes where the photo was taken. Large platforms mostly strip it on upload; smaller sites do not always, and files shared directly keep everything.
One person does not need every clue. A patient one needs surprisingly few.
Why reporting rarely ends it
When the map gets used, the instinct is to report, and reporting matters. But on a platform where a new account costs nothing, removal is a round in a game the other side can always rejoin. The post comes down and returns under a new username the same afternoon. Blocking a person blocks an account, and an account is not a person.
This is not an argument against reporting. It is an argument about what reporting can and cannot do where re-entry is free. The record of how that plays out, with sources attached, lives on our Why Masque page, and we will not restate its numbers here.
If it is happening to you right now
Preserve first, react second. Take screenshots with the URLs and dates visible, keep them somewhere that is not the platform, and write down what happened while it is fresh. Evidence you did not keep is the hardest thing to get back.
Do not negotiate with the person doing it. Payment and pleading both confirm that the pressure works.
Tell the people who matter before someone else does. A threat's power is the reveal; a partner or an employer who already heard it from you is a card removed from the other hand.
Then work a checklist instead of your pulse. Our safety guide walks the first hour step by step, and the report form works without an account, for you or for someone acting on your behalf.
What a platform can choose differently
Most of the clue surface is a design decision somebody made, which means different decisions exist. A platform can require one verified adult identity per account, so a ban holds and the tenth burner never exists. It can strip photo metadata on upload instead of hoping. It can keep contact request-only, so a stranger's reach costs a request you never have to grant. It can decline to publish a browsable gallery of its members for anyone to scrape.
Masque made those choices for every room past its one public square, and one honest limit stays: no site can stop every screenshot, and verification cannot read intent. What a design can do is make the map expensive, the audience accountable, and re-entry cost something real. That is the whole premise, stated plainly.
Pseudonymous, not anonymous: the differenceAnonymous chat with verified adults
The sentence we operate under
Our co-founder ends her letter with a promise that is also this company's founding sentence: Masque will never be the reason anyone finds out who you are. Publishing the mechanics is part of keeping it, because how people get found should not be knowledge held only by the people doing the finding.
Help that already exists
None of these belong to us, all of them are free, and each does one thing well.
CISA personal security guideFTC people-search guidanceStopNCIICCRI crisis helplineSPARC stalking guidanceIntimate-image removal on Masque, no account needed