The short version
++ We collect only the bare minimum amount of information that is necessary to protect + the service against abuse. We do not sell your information to third parties, and we + only use it as this document describes. We aim to be compliant with the EU GDPR. +
+What information we collect and why
+Information from server logs
+We collect the following information (in web server logs) from every visitor:
+-
+
- The visitor's Internet Protocol (IP) address +
- The date and time of the request +
- The page that was requested +
- The user agent string of the visitor's browser +
These items are collected to ensure the security of the service, and are deleted after 14 + days to balance our "legitimate interest" (as mentioned in the GDPR) of security with user + privacy.
+Information in cookies
+Our cookies for any users of the service may contain:
+-
+
- A unique PHP session token +
- One or more "flash" messages (temporary notifications of an action's success or failure, + to be displayed at the top of the next page load and then deleted) + +
Additionally, cookies of users that are logged into the service may contain:
+-
+
- A random authentication secret ("remember me" token) unique to the user to persist their login +
These data are required for authentication, user security, or customization, which are all + "legitimate interests" as above, and thus we cannot ask for consent to use these + cookies.
+Information in user-submitted content
++ User-submitted content is considered to collectively refer to any content that you may + submit to the site, which includes, but is not limited to: comments, images, messsages, + posts, reports, source changes, tag changes, and votes. +
+User-submitted content by users (authenticated or not) may contain any or all the following + information:
+-
+
- The IP address at the time of submission +
- The browser user agent string +
- The page that initiated the submission +
These items are only used for the "legitimate interests" of identifying and controlling abuse + of the service and are not shared with any external party.
+Information from users with accounts
+If you create an account we require some basic information at the time of + account creation. You will be asked to provide:
+-
+
- a username, shown on your profile and generally only visible to you and site staff +
- a password, stored only as a cryptographic hash +
We also store your IP address whenever you log in for security reasons.
+Information that we do not collect
++ We do not intentionally collect personal information, but users may include it in + user-submitted content. We will remove personal information if we deem it too sensitive. + Inform us if you believe shared information is too sensitive. +
+This is especially important because information shared in public user-submitted content may + be indexed by search engines or used by third parties without your consent.
+Information that may potentially be shared with third parties
++ We do not in any way share individual account information with third parties unless legally + compelled to do so. +
+Most of the site is public-facing, and third parties may access and use it.
+How we secure your information
+We take all measures reasonably necessary to protect account information from + unauthorized access, alteration, or destruction.
++ While in transit, your data are always protected by the latest version of Transport Layer Security (TLS) our software supports. + To protect user data on our servers, we strictly limit access, and require the use of + elliptic Ed25519 or 4096-bit RSA keys for server login. +
++ HTTPS is required for all connections to our service. Our cookies use a "secure" setting and may only be transmitted privately to us. We use + a restrictive Content Security Policy (CSP) + to protect against page hijacking and information leakage to third parties, an image proxy + server to avoid leaking user IP address information from embedded images on the site, a Cross-Origin Resource Sharing (CORS) policy to restrict third-party + usage, a strict Referrer-Policy to prevent leaking data for + external links, and a frame policy to prevent clickjacking. +
+Passwords are hashed using bcrypt at + 210 iterations with a 128-bit per-user salt.
+No method of transmission, or method of electronic storage, is 100% secure. Therefore, we + cannot guarantee its absolute security; we only make our best effort.
+Resolving complaints
++ If you have concerns about the way we are handling your personal information, please let us + know immediately. You may contact us via email directly at admin@ponepaste.org. +
+