Privacy

This page says what ForoHackers stores about you, why, for how long, and what it cannot see. It describes the software as it runs; when the software changes, this page changes with it.

Who is responsible. Ophuscado LLC, 30 N Gould St Ste N, Sheridan, WY 82801, United States, which runs ForoHackers. Contact: support@forohackers.com.

What we never receive

• Your password. Your browser turns it into keys and sends only a value derived from it, which we store hashed again. We cannot read your password and cannot reset it.
• Your recovery key. The same: only a derived value, stored hashed.
• Your private keys. They are made in your browser and stored on our server only sealed under keys derived from your password and your recovery key.
• The content of encrypted groups. Group names, titles and messages are sealed in members' browsers; we store ciphertext only.

What we store

Your account - Your name. It is public and shown on your posts. - Your email, only if you give it. It is optional and unverified. - The values described above, needed to check your login and to give your browser back your sealed keys. - Your public keys and their fingerprint. - When you accepted the notice of the open section.

What you post in the forum - The text, the time, your name and the tags. Anyone can read it, with or without an account.

The anonymous board - The text and the time, with no account and no name. - If you choose to sign as a returning source, your source key's public half, the signature and the nickname you give, if any.

Encrypted groups - Ciphertext only, as described above. - In clear, because the service needs it: who is a member and since when, who posts and when, how long each sealed text is, how threads are arranged, and the signed record of membership changes. - In a forward-secret room, messages and keys are deleted for everyone after the period the room was made with.

The chat - Nothing. Messages are sealed in the participants' browsers and the server passes them along from memory, without storing them; it never receives a room's secret or keys. A room is forgotten when it has been empty for ten minutes, and after a day at most.

The drop - What a source sends and what the staff answer, as ciphertext only, sealed in the browser for the recipients listed on the page and for the source; we cannot read it. - In clear: when each message arrived, whether the source or the staff wrote it, which staff account replied, and which recipients' keys can open it. - The source's code never reaches us: only a value derived from it, which we store hashed. No account, name or address of the source. - Kept until the staff delete the drop.

Reports - What you report, the ground, your explanation, your name and email if you give them, and your good-faith statement. - Our decision and its reasons. - Only a hash of your receipt link.

What we do not store with any of this - Your IP address. Abuse limits count requests under a pseudonym computed from your address and the day, kept for at most one hour. - A used anti-spam challenge is kept for about eleven minutes, so it cannot be reused.

Server logs

Our web server (nginx) logs every request, with the address it came from, the time, the address requested, the browser's name and the referring page. These logs are kept for up to 14 days and then deleted. They exist to run and protect the service. They are the one place where an address and a time sit side by side, including for anonymous posts. If that matters to you, use Tor (see Tor).

Cookies and browser storage

There are no advertising or analytics cookies, and nothing on the site loads from another server.

Cookies we set - A session cookie while you are logged in (two weeks). - A security cookie against forged forms (CSRF, one year). - A cookie that remembers you accepted the notice (one year).

Storage in your browser, never sent to us - Your opened keys, while you are logged in; logging out deletes them. - Your anonymous source key, if you sign. - Nothing for the drop: its code stays in the page until you close it.

Why

• To provide the forum you asked for: accounts, posts, groups.
• For our legitimate interest in keeping it running and safe: logs, abuse limits, reports.
• To meet legal obligations: handling notices of illegal content, and answering valid orders from authorities.

How long

• Accounts: until you delete yours, on your account page: your posts stay, signed "deleted account"; your keys, memberships and email go at once.
• Posts: kept, unless a decision on a report removes one. You can disown a post of yours: your name comes off it for good, the text stays.
• Reports: kept.
• Logs: 14 days.
• Abuse counters: one hour.
• Before each update of the software: the server keeps a copy of the database to undo a failed update. The newest five are kept; older ones are deleted.
• Backups: none of the forum's database at present.

Who else sees it

• Our hosting provider, IONOS, whose server in the United States runs the site. What we store is stored there; if you write from elsewhere, your data goes to the United States.
• Authorities, when the law requires it. We answer valid legal orders, and only with what we have. That is never your password, your private keys or the content of encrypted groups.

Your rights

You can ask for: - a copy of your data; - its correction or deletion; - a limit on its use, or object to it; - and you can complain to a data protection authority.

Write to support@forohackers.com from the email on your account, or tell us how to verify that the account is yours.

Minimum age: 13, or older where the law of your country sets a higher age for using online services without a parent's consent.

Changes

When this page changes in a way that matters, the notice asks you again.