CoursesWeb Forum privacy: what we store and why

This page describes what the CoursesWeb Forum, a section of CoursesWeb served at coursesweb.net/forum/, does with information. We have tried to describe what the software does, not what sounds reassuring, so some answers are plain about limits.

Reading needs nothing from you

You do not have to sign in, give a name or give an email address to read threads, browse the sections or search.

What we store when you post

You can ask a question or reply with a display name, an email address and your text. If your email is new, that creates a light member account and your browser receives a session cookie.

• Your post and display name are stored and shown publicly with the time. Anything you write is public, so leave out passwords, API keys, database logins and personal data, as the guidelines ask.
• Your email address is not stored in readable form. The forum keeps a one way hash of it, built with this forum's host name, and uses it only to recognise the same email next time. We cannot read your address back from it, and the address is never shown on the site.
• A scrambled form of your IP address is used to limit how fast one place can post. It is a shortened hash, and the record that holds it is deleted after about seven days. The forum does not store your raw IP address in its database.
• Votes, followed threads and drafts are stored against your account. Unsent drafts are deleted after about a day.
• A one time form key stops the same post being submitted twice. These keys are deleted after about seven days.

The one cookie

The forum sets one cookie, named tok, when you create a member account or sign in. It holds a signed session that identifies your account. It lasts 30 days, is limited to the /forum path, is sent only over secure connections and cannot be read by page scripts. It is used to let this browser vote, edit its own posts and mark answers. It is not used for advertising. Use "sign out everywhere" and every session for your account stops working. You can also delete the cookie in your browser.

The forum does not run advertising scripts and does not sell data. If a bot check such as Cloudflare Turnstile is switched on for posting, that service receives your browser details and IP address to decide whether you are a person, under its own terms.

Sign-in links

A one time sign-in link works once and expires after 15 minutes. The system stores only a hash of the link, and expired links are cleared out nightly. If a link is sent by email, the address is used for that message and handled by the mail provider that delivers it.

Hosting and logs

The forum runs on Cloudflare. Like any host, the network handles your IP address and request details to deliver pages and block attacks, and it may keep operational logs.

What posts can reveal

Code and error messages often contain file paths, usernames, server names and sometimes keys. Check what you paste. Once a post is public it can be copied, and removing it here does not remove copies made elsewhere.

Who sees what

Moderators can see posts, display names, account roles and the records they need to run the forum. They cannot see your email address, because only the hash is stored. We do not sell or rent member information. We may share information if the law requires it or to protect someone from serious harm.

How long things are kept

Posts stay until removed. When a post is removed it is hidden from the site, and a hidden record can remain in the database and in backups. Rate limit records, drafts, form keys and expired sign-in links are cleared automatically on the schedule above. Accounts that have posted are not deleted outright, because that would break threads for other readers. Instead we remove names and identifying details when asked.

Your choices

Email hello@coursesweb.net with the web address of your post to ask for a correction, removal of personal details or removal of a post. Members can also edit their own posts for 30 days after posting. Because we keep no readable email address, the post address is how we find your content.

Children

The forum is not meant for children under 13, and we do not knowingly collect information from them.

Changes

If the way the forum handles information changes, we will change this page and the date at the top.