Privacy policy
This is written for people who may be in dispute with a government department, so section three on what becomes public is worth reading carefully before you post anything.
1. Reading this site
You can read everything here without an account and without giving us anything. We do not run third-party advertising or behavioural tracking, and we do not sell or share data with data brokers.
2. What we collect if you sign up
- Account: your email address, chosen username, display name and a hashed password. Passwords are stored hashed with bcrypt and are not readable by us.
- Content: the threads, comments and votes you post. Threads and comments are public. Votes are not shown to other users.
- Session: a single HTTP-only cookie that keeps you signed in. It contains a signed token identifying your account and nothing else.
- Newsletter: if you subscribe, your email address and the date you subscribed.
3. What you should assume is public
Anything you post in the community is published on the open web and can be read, copied, archived and indexed by anyone, including a department you are in dispute with, and including after you delete it. We cannot un-publish something from third-party archives.
If your situation is sensitive: use a pseudonym, use an email address not tied to your name, and redact case references, National Insurance numbers, addresses and anything identifying a child before you post.
4. Lawful basis
- Contract — running your account so you can post.
- Consent — the newsletter. Withdraw it at any time and the record is deleted.
- Legitimate interests — keeping the site secure and moderating abuse.
5. Retention
Account data is kept while the account exists. Delete your account and the account record and its personal data go; posts may remain with the author shown as deleted, because removing them entirely would break the threads other people wrote. Newsletter records are deleted on unsubscribe. Server logs are kept for a short period for security purposes.
6. Your rights
Under UK data protection law you can request access to your data, correction, erasure, restriction of processing, portability, and you can object to processing. Contact the desk and you will get a response within one month. You can complain to the Information Commissioner’s Office.
7. Processors
A live deployment will involve a hosting provider and possibly an email delivery service. Those must be listed here by name, with their location, before launch.