Privacy Policy
Effective date: 2026-10-01
This page explains what Dyscuvr collects, why, who else sees it, and how long we keep it. It is your data; we collect only what the service needs to run.
Dyscuvr is offered to people in the United States, in English, and all of its infrastructure is in the United States.
What we collect and why
Identity and sign-in. When you create an account, we store your email address and, if you sign in through an external identity provider (for example, a provider you or the operator configures), the provider's name and the identifier it issued for you, so we can recognize you on your next visit. If you sign in by email code instead, we store only the email address. We do not ask for or store your name, your birthdate, or your age; we store only the time you confirmed you are 16 or older, and, if you turn on explicit content, the separate time you confirmed you are 18 or older.
What you create. We store the ratings, lists (including queues), labels, follows, blocks, mutes, and recommendations you make, and any messages or content you post, so we can show them to you and to the people you share Dyscuvr with.
Feedback. If you send us feedback, we keep it indefinitely, even after your account is deleted, so we have a record of what we were told and what we did about it. Once your account is deleted, the feedback is kept but is no longer linked to you.
Security and audit records. We log security-relevant events, such as sign-ins and changes to your account, together with the client address (IP address) the request came from. These records exist so we can investigate abuse and account compromise, and they are kept after an account is deleted, without identifying details, the way every account's history is kept.
Who else sees it
Identity providers. If you sign in through an external identity provider, that provider sees that you are signing in to Dyscuvr; we see only the identifier it gives us, not your password or anything else held by that provider.
Our email delivery service. We use a transactional email service to send sign-in codes and account notices. That service sees the email address and the message content needed to deliver them, and nothing else about your Dyscuvr account.
Cloudflare. Our service sits behind Cloudflare, which terminates the encrypted connection from your browser at its network edge before passing your request on to our server. Cloudflare can see the traffic it relays to us, the same way any content delivery network in front of a website can.
Nobody else. We do not sell your data, and we do not share it with advertisers or data brokers. We disclose account data to a government authority only when a US legal process compels us to.
Cookies
Dyscuvr sets only the cookies it needs to keep you signed in and to protect you from cross-site attacks. We do not set advertising or analytics cookies, and we do not use a cookie-consent banner, because we set nothing beyond what signing you in requires.
When you delete your account
Deleting your account removes your own ratings, lists, labels, follows, blocks, mutes, and recommendations. A recommendation or list entry someone else made that names you as its source is kept, credited to "a former member" instead of your name. Feedback you sent is kept, unlinked from your account, as described above. Audit records and the record that an invitation was used are kept without identifying content, as described above.
We keep a nightly backup of the database for 30 days. Every stored backup containing your data, including every version of it, is gone within 33 days of your account's deletion, so your deletion is complete once that window has passed.
How long we keep things
We keep your account's data for as long as the account exists, your audit and invitation records as described above for as long as the service operates, and your feedback indefinitely, whether or not your account still exists. We keep database backups for 30 days, and no backup holding a deleted account's data for more than 33 days past its deletion.
Your rights
You can read and correct most of your own information from your account settings, and you can delete your account at any time, which removes your own data as described above. If you have a question about your data that your account settings do not answer, contact us at the address below.
Changes to this policy
We may update this page. When we do, we publish the new version here with its own effective date. This policy is not accepted or versioned the way the terms of service are: the current version always applies, and you can read every earlier version of this page.
Questions
If you have a question about this policy or your data, contact us at [email protected].
Adapted from the GitHub Site Policy policies, licensed
CC0-1.0, and from the
Basecamp open-source policies, licensed
CC BY 4.0, trimmed and rewritten to describe what
Dyscuvr does. This draft has not yet been reviewed by the owner or a lawyer; see the change log of
specs/024-legal-pages/requirements.md.