GitShowcase Forum privacy: what we store and why

This page describes what the GitShowcase Forum, a section of GitShowcase served at gitshowcase.com/forum/, does with information. We have tried to describe what the software does, not what sounds reassuring, so some answers are plain about limits.

What you can do without an account

Reading needs nothing from you. You do not have to sign in, give a name or give an email address to read threads, browse the sections or search.

What we store when you post

You can ask a question or reply with a display name, an email address and your text. If your email is new, that creates a light member account and your browser receives a session cookie.

• Your post and display name are stored and shown publicly with the time. Anything you write is public, so leave out keys, tokens, connection strings and customer data, as the guidelines ask.
• Your email address is not stored in readable form. The forum keeps a one way hash of it, built with this forum's host name, and uses it only to recognize the same email next time. We cannot read your address back from it, and the stored hash cannot be used to send you email.
• A scrambled form of your IP address is used to limit how fast one place can post. It is a truncated hash, and the record that holds it is deleted after about seven days. The forum does not store your raw IP address in its database.
• Votes, followed threads and drafts are stored against your account. Unsent drafts are deleted after about a day.
• A one time form key stops a double submission. These keys are deleted after about seven days.

The one cookie

The forum sets one cookie, named tok, when you create a member account or sign in. It holds a signed session that identifies your account. It lasts 30 days, is limited to the /forum path, is sent only over secure connections, and cannot be read by page scripts. It is not used for advertising. Use "sign out everywhere" and every session for your account stops working. You can also delete the cookie in your browser.

The forum does not run advertising scripts or sell data. If a bot check such as Cloudflare Turnstile is switched on for posting, that service receives your browser details and IP address to decide whether you are a person, under its own terms.

Sign in links

Signing in is by email. If you ask for a one time sign in link at /sign-in/, it works once and expires after 15 minutes. The system stores only a hash of the link, and expired links are cleared out nightly.

Hosting and logs

The forum runs on Cloudflare. Like any host, the network handles your IP address and request details to deliver pages and block attacks, and it may keep operational logs. We do not use those logs to build profiles of readers.

Who sees what

Moderators can see posts, display names, account roles and the records they need to run the forum. They cannot see your email address, because only the hash is stored. We do not sell or rent member information. We may share information if the law requires it or to protect someone from serious harm.

How long things are kept

Posts stay until removed. When a post is removed it is hidden from the site, and a hidden record can remain in the database and in backups. Rate limit records, drafts, form keys and expired sign in links are cleared automatically on the schedule above. Accounts that have posted are not deleted outright, because that would break threads for other readers. Instead we remove names and identifying details when asked.

If you posted a secret

Removing a post does not undo exposure. If you pasted a key, token or connection string, rotate it first, then ask us to hide the post. A public page may already have been copied or cached elsewhere.

Your choices

Email editorial@gitshowcase.com with the web address of your post to ask for a correction, removal of personal details or removal of a post. Because we keep no readable email address, the post address is how we find your content. If you live somewhere with data rights laws, tell us what you want and we will respond as the law requires. Security problems go to security@gitshowcase.com, as the contact page explains.

Children

The forum is not meant for children under 13, and we do not knowingly collect information from them.

Changes

If the way the forum handles information changes, we will change this page and the date at the top. The parent site's own practices may also apply when you visit GitShowcase outside the forum.