Privacy Policy
Last updated: September 2026
Data controller: [Your legal entity name], [address], [privacy contact email].
What we collect
- Account data: email address, username, a password hash held by our authentication provider (Supabase), and optional profile fields you choose to fill in.
- Content: posts, threads, messages, reviews, submissions, votes, and course progress.
- Usage data: pages viewed, actions taken, browser and device type, and a salted hash of your IP address for abuse prevention and rate limiting. We do not store raw IP addresses in our database; our hosting and database providers may log them for security.
- Cookies: a session cookie to keep you signed in and, optionally, small preferences (like a collapsed panel). See the Cookie Policy. We do not use advertising cookies or cross-site tracking.
Why we use it (legal bases)
- To run the site and provide the features you use (performance of a contract).
- To prevent abuse, spam and fraud, and keep the community safe (legitimate interests).
- To send notifications and digests you have opted into (consent; withdraw any time in Settings).
- To comply with legal obligations.
Who we share it with
We do not sell personal data. We share it only with providers who process it for us: hosting (Vercel), database and authentication (Supabase), email delivery, payment processing for Pro memberships (Stripe; we never see full card numbers), and error monitoring. Some are in the United States; transfers rely on their standard contractual clauses. We disclose data when required by law or to protect the site and its users.
Public information
Your username, avatar, public profile fields, posts, threads and reviews are public and may appear in search engines. Private profiles hide profile fields but posts remain attributed to your username. Direct messages are private to participants and staff who investigate reports; they are not end-to-end encrypted.
Your rights
Depending on where you live (including under the GDPR, UK GDPR and CCPA/CPRA) you may have rights to access, correct, delete, export or restrict your data, to object to processing, and to withdraw consent. You can change most data in Settings. For everything else, or to request deletion of your account, use the contact page. We will respond within the time the law requires. You may complain to your local data protection authority. We do not "sell" or "share" personal information as those terms are defined in the CCPA, and we honor Global Privacy Control signals where required.
Retention
Account data is kept while your account exists. Read notifications are pruned after 90 days; rate-limit records after 24 hours; server logs per our providers' schedules. Moderation and audit records are retained for integrity. Deleted accounts are anonymized: posts stay, personal data, messages and IP hashes are removed.
Security
Data is encrypted in transit, access is limited by role, and every database table is protected by row-level security. No system is perfectly secure; report issues via the contact page.
Children
The site is not directed at anyone under 18 and we do not knowingly collect their data.
Changes
We will post changes here and update the date above.