Privacy & Security Policy
This platform is privacy-first and moderation-first. We collect the minimum data needed for safety operations, abuse prevention, and account integrity.
What we collect
- Email for passwordless sign-in and account recovery.
- Alias and basic onboarding profile details required for trust controls.
- Operational security events (rate limits, moderation actions, login counters).
- Cookie consent state (`Accept all` or `Necessary only`) to honor privacy preference.
What we avoid
- No requirement to publish legal identity on community threads.
- No public exposure of raw email addresses in thread/profile surfaces.
- No over-collection of demographic fields outside onboarding need.
Security baseline
Controls are mapped to NIST and OWASP guidance for practical security hardening. This is an internal operating baseline, not a formal NIST certification claim.
- NIST Cybersecurity Framework: risk management and incident handling.
- NIST SP 800-63 Digital Identity Guidelines: authentication practices.
- OWASP Top 10 + ASVS: application-level security verification.