1. The short version
- We store what we need to run your account and the forums: who you are according to your sign-in provider, and what you post.
- We never see or store a password.
- No ads, no analytics, no tracking cookies, and we don’t sell or share your data for advertising.
- Your posts are public in the forum where you post them. Your email is never shown to anyone.
- You can export everything you wrote, and delete your account, at any time.
2. What we collect
From your sign-in provider
When you sign in with Google, GitHub, Apple or your organisation’s single sign-on, the provider tells us:
- a stable account identifier, unique to that provider, which is how we recognise you next time;
- a display name or username, which we use to suggest your Kosharoad username;
- your email address, but only if the provider shares it and has verified it (GitHub sign-in doesn’t share one).
We don’t receive your password, contacts, files or anything else from your provider account.
What you give us
- your username and bio;
- topics, replies, edits, tags and likes;
- reports you make about posts, including any note you add;
- if you run a forum: its name, tagline, colours and custom domain, and the moderation actions you take.
Created as you use Kosharoad
- which topics you’ve read, so lists can show what’s new to you;
- notifications about replies, mentions and likes;
- a session record so you stay signed in (we store only a fingerprint of the session token, not the token);
- web server logs: your IP address, the page requested, the time, and your browser’s user-agent. These help us keep the service secure and fix problems.
- short-lived counters of recent actions per IP address or account, used to slow down spam and abuse.
3. Why we use it, and our legal basis
If you’re in the European Economic Area, the United Kingdom or Switzerland, the law asks us to state the basis for each use:
| Purpose | Data | Legal basis |
|---|---|---|
| Creating your account and signing you in | Provider identifier, name, email, session | Performing our contract with you |
| Showing and storing your posts and profile | Posts, username, bio | Performing our contract with you |
| Unread counts and notifications | Read state, notifications | Performing our contract with you |
| Moderation and preventing spam and abuse | Posts, reports, rate-limit counters, logs | Our legitimate interest in a safe, usable service |
| Security, debugging and backups | Logs, backups of all of the above | Our legitimate interest in keeping the service secure and recoverable |
| Answering you and legal requests | Your messages, the data a request concerns | Legitimate interest, or a legal obligation |
We don’t use your data for advertising or profiling, and we don’t make decisions about you by automated means that have legal or similarly significant effects.
4. Who can see your data
- Everyone: posts, your username, bio, join date and post counts in a forum are public, and search engines may index them.
- Forum owners, admins and moderators: also see reports about posts in their forum and posts held for review. They don’t see your email or sign-in details.
- Members you interact with: see notifications that you replied to, mentioned or liked them.
- Us: our small team can access the service’s data to run, secure and support it.
- Authorities: only when the law requires it, and we’ll tell you unless we’re legally prevented.
5. Service providers
We use a few providers to run Kosharoad. Each only gets what it needs to do its job:
- Our hosting provider runs the server where Kosharoad and its data live.
- Our storage provider (an S3-compatible service such as Backblaze B2) keeps the nightly backups.
- Cloudflare provides DNS for our domains and may carry traffic to this site.
- Let’s Encrypt issues the security certificates for our addresses. It receives domain names, not your data.
- Google, GitHub, Apple and single sign-on providers handle sign-in when you choose them, under their own privacy policies.
We don’t sell your personal data, and we don’t share it with anyone for their own advertising or marketing.
6. International transfers
Our providers may process data outside your country, including in the United States. Where data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses or another lawful transfer mechanism offered by the provider. Ask us at hello@peragolabs.com for details.
7. How long we keep it
| Data | Kept for |
|---|---|
| Your account | Until you delete it |
| Posts | Until you or a moderator deletes them, or the forum closes |
| Signed-in session | 30 days, or until you sign out |
| Sign-in step cookie | 5 minutes |
| Notifications | Your most recent 200 |
| Reports and held posts | Until moderators act on them |
| Rate-limit counters | A few minutes, in memory only |
| Web server logs | Rotated by size, typically days to a few weeks |
| Backups | Up to 12 months (7 daily, 4 weekly, 12 monthly copies), then deleted |
8. When you delete your account
Deleting your account from your Account page takes effect immediately:
- your sign-in connections, email address, bio and every session are removed;
- your username is replaced with an anonymous one, such as “deleted_123”;
- your posts stay in place, shown as written by a deleted user, so the discussions around them still make sense. If you want them gone, delete them before deleting your account, or ask us to;
- copies in backups disappear as those backups expire, within 12 months.
If you own a forum, write to hello@peragolabs.com first so we can hand it over to someone else or close it. That way its members aren’t left without anyone looking after it.
9. Security
- All traffic is encrypted with HTTPS.
- We never handle passwords. Sign-in uses your provider, with protections against forged sign-in requests.
- Session tokens are random, sent in a secure, HTTP-only cookie, and stored only as a fingerprint.
- Email addresses are encrypted at rest (AES-256-GCM), including in backups. The key is kept separately from the backups.
- Changes need a per-session token, so other sites can’t act on your behalf.
- Backups carry a checksum and are test-restored every night.
10. Children
Kosharoad isn’t for children under 13, or under 16 in the EEA, UK and Switzerland. If you believe a child has given us personal data, contact hello@peragolabs.com and we’ll delete it.
11. Your rights
You can access, export, correct and delete your data, and in many places object to or restrict how we use it. Most of this is built into your Account page. Our GDPR and your rights page explains each right and how to use it, including if you live in California.
12. Changes to this policy
If we change this policy in a way that matters, we’ll post a notice on the site before the change takes effect and update the date at the top.
13. Contact
Privacy questions and requests: hello@peragolabs.com.