This notice describes how Civilized Discourse Construction Kit, Inc., or CDCK for short, collects and uses personal information. This notice also provides information about the legal rights individuals have concerning their personal information and how you can exercise those rights.
Jump to:
- What is CDCK?
- Who is responsible for data collected about me?
- How does CDCK collect data about me as a controller?
- Does CDCK sell my personal information?
- Does CDCK use customer data for training AI models?
- What personal information does CDCK collect as a controller, and why?
- Does CDCK allow third parties to collect and record personal information about online activities on CDCK Websites and Forums?
- Does CDCK use personal information for marketing purposes?
- How can I make choices about data collection?
- Where does CDCK store data about me?
- How long does CDCK store data about me?
- Does CDCK comply with the EU General Data Protection Regulation?
- What are my rights where CDCK processes personal data as a controller?
- How does CDCK safeguard international data transfers after Schrems II?
- Does CDCK comply with the California Consumer Privacy Act and other US state comprehensive privacy laws?
- Where can I access data about me?
- How can I change or erase data about me?
- Does CDCK make automated decisions based on data about me?
- Does CDCK share data about me with others?
- How does CDCK document compliance for forum hosting customers?
- Does CDCK process aggregate or deidentified information?
- How can I contact CDCK about privacy?
- What if this privacy notice changes?
What is CDCK?
CDCK is the company home and primary developer of Discourse, open source software for hosting Internet discussion forums. As a company, CDCK hosts forums using Discourse for businesses, organizations, and individual customers through Enterprise, Business, Pro, Starter, and Free plans. Discourse also provides the following websites and forums:
- meta.discourse.org, a discussion forum about Discourse itself,
- discourse.org, a website marketing Discourse and CDCK’s hosting service,
- id.discourse.com, a website for Discourse ID, a tool that enables login features across all participating Discourse communities,
- blog.discourse.org, CDCK’s blog,
- and rubytalk.org, a mirror of the “Ruby-Talk” mailing list for the Ruby programming language.
We refer to the five sites linked above as the “CDCK Websites and Forums.”
Who is responsible for data collected about me?
CDCK is the responsible party, or controller, for the data we collect and process for our own purposes. For instance, CDCK is responsible for data about our customers’ representatives and forum and account administrators, open source contributors, and visitors to the CDCK Websites and Forums.
Importantly, CDCK sets only its own privacy practices, not the privacy practices of CDCK customers or others who host forums using our open source software. Discourse processes personal data belonging to our customers’ forum users on behalf of and at the direction of those customers, as a processor and service provider. You should ask the administrators of our customers’ forums that you use for information about their privacy practices.
Privacy inquiries or notices you send to CDCK about forums we host at the direction and on behalf of our customers as a processor and service provider will be referred to the appropriate responsible party.
This notice primarily describes CDCK’s personal data processing for its own purposes as a controller and not as a processor and service provider at the direction and on behalf of our customers. We will expressly state where this notice discusses CDCK’s activities as a processor and service provider.
How does CDCK collect data about me as a controller?
CDCK collects data about you as a controller through the CDCK Websites and Forums:
-
when you browse CDCK Websites and Forums
-
when you create and use an account on CDCK Websites and Forums
-
when you post, send private messages, and otherwise participate in a forum that CDCK hosts
-
when you sign up for mailing lists and announcements
-
when you purchase services from us on your or your company’s behalf
-
when you contribute to our open source software
-
through cookies, server logs, and other similar technologies
We may also receive data about you, including your name, contact information such as email address, information regarding your professional role and organization, and purchasing interests or inferences regarding your purchasing interests from third parties, including business-to-business marketing databases and data brokers.
Does CDCK sell my personal information or share it for targeted or to serve behavioral advertising purposes?
We do not sell personal information for money. We may disclose personal information to business-to-business marketing databases and data brokers for valuable consideration, such as access to additional data. We may also disclose and use personal information for targeted or cross-context behavioral advertising.
Does CDCK use customer data for training AI models?
At Discourse, we believe that community trust is paramount. We do not use customer data to train AI models, nor do we share it with third parties for that purpose. Customer conversations and content belong to the communities that create them, and our role is to protect that trust. Customers always remain in control of their data. Transparency, privacy, and respect for community ownership guide every product decision we make.
What personal information does CDCK collect as a controller, and why?
CDCK automatically collects data about visits to CDCK Websites and Forums.
When you visit one of CDCK’s websites or a forum that CDCK hosts, whether you have an account or not, we use cookies, server logs, and other methods to automatically collect data about what pages you visit and when.
CDCK may use data we collect automatically to:
-
optimize the forum, so that it’s quick and easy to use
-
diagnose and debug technical errors
-
defend the forum and CDCK’s websites from abuse and technical attacks
-
compile statistics on forum and topic popularity
-
compile statistics on the kinds of software and computers visitors use
-
perform analytics
-
deliver targeted or behavioral advertising
-
market our own products and services and inform you about new products and features that we offer, including by contacting our website visitors where we obtain their contact information from a marketing database
CDCK collects CDCK Website and Forum account data.
Many features of forums on CDCK Website and Forums hosts require a forum account. For example, most forums that CDCK hosts require an account to post and reply to topics.
To sign up for a forum account, Discourse requires your name, a user name, and an email address.
CDCK uses your account data to identify you on the forum and to create pages specific to you, such as your profile page. If the forum is public, CDCK publishes your account data according to the forum administrator’s configuration. If the forum is access-restricted, CDCK makes your account data available to everyone who can access the forum, according to the forum administrator’s configuration.
CDCK uses your email address to:
-
notify you about posts and other activity on the forum
-
reset your password and help keep your account secure
-
contact you in special circumstances related to your account
-
contact you about legal requests, like DMCA takedown requests
You may provide additional data for your account, like a short biography, your location, or your birthday, on the profile settings page for your account. CDCK makes that data available to others who can access the forum. You don’t have to provide this additional information, and you can erase it at any time.
CDCK stores your account data as long as your account remains open.
CDCK collects customer account data.
When you sign up for a paid plan with CDCK or create an account on Discourse Free, we will collect certain information from you, including your name, email address, and, for paid accounts information we require to process payments, such as your name and credit card information. We use this information to provide the products and services you obtain from us, perform any contract between us, enforce our contractual and legal rights, and prevent fraud and abuse, including by evaluating whether we have previously banned an account, or identified potential fraud or abuse associated with, the email address you provide.
CDCK collects data about posts and other activity on CDCK Websites and Forums.
CDCK collects the content of your posts, plus data about bookmarks, likes, and links you follow in order to share that data with others, through the forum. If the forum is public, CDCK publishes your activity. If the forum is access-restricted, or access restrictions apply to the specific post, CDCK makes your activity available only to users permitted to see it.
CDCK also collects data about private messages that you send through the forum. CDCK makes private messages available to senders and their recipients, and also to forum administrators.
CDCK stores your posts and other activity as long as your account remains open.
CDCK collects data you give through web forms you complete.
CDCK collects information in connection with web forms you fill out and submit. The information CDCK collects may include contact information such as your email address, any information you provide through text fields, drop downs, or radio buttons within the form, and other information relating to your activity on CDCK Websites and Forums that CDCK automatically collects through cookies and similar technologies.
CDCK does not collect sensitive personal information.
CDCK does not intentionally collect or process sensitive personal information as a controller, such as government identification numbers, information on racial or ethnic origin, political opinions, genetic data, biometric data, children’s data, precise geolocation, status as a victim of a crime, financial account information, biological or neural data, the contents of consumer’s mail, email, or text messages for recipients other than Discourse, health data, or any of the other special categories of personal data specified by the GDPR, such as trade union membership.
CDCK collects data about open source contributors.
Contributors to CDCK’s open source software may be asked to provide identifying and contact information such as your name, email address, telephone number, and mailing address. CDCK also collects and stores information concerning your agreement to our contributor license agreement.
CDCK uses this information to maintain the integrity of our software and software licenses, as well as the integrity of the license agreement between CDCK and our contributors. CDCK stores contributor information for as long as related contributions are incorporated into CDCK’s open source software.
CDCK collects data through tracking technologies such as cookies, including third-party cookies, and scripts.
HTTP cookies are small bits of data that websites, like Discourse forums, send to your computer when you visit. When you return to those websites, your computer sends the cookies on your computer back to the website. Scripts are computer code embedded in a website that may collect information about you.
Some tracking technologies, including cookies and scripts, we use are provided by third parties, which may collect or receive information about your interactions with us.
Discourse.org and id.discourse.com may use these cookies:
| Name | Essential | Expires | Purpose |
|---|---|---|---|
| coupon_code | Yes | 24 hours | Applies the corresponding discount to a trial signup via promotional campaign |
| referral_code | Yes | 24 hours | Applies the corresponding referral code to a trial signup via referral URL |
Discourse.org may use HubSpot cookies for targeted and behavioral advertising, for obtaining and enriching marketing data, and for forms for mailing list opt-ins or other requests. HubSpot may set the following cookies.
| Name | Essential | Expires | Purpose |
|---|---|---|---|
| __cf_bm | Yes | 30 minutes | Set by hsforms.net or hsforms.com to block bots |
| _cfuvid | Yes | Session | Set by hsforms.net or hsforms.com to rate limit requests |
| hubspotutk | No (Analytics) | Five months | |
| __hstc | No (Analytics) | Five months | |
| __hssrc | No (Analytics) | Session | |
| __hssc | No (Analytics) | 30 minutes | |
| __hs_gpc_banner_dismiss | Yes | Five months | Set by HubSpot when Global Privacy Control is enabled in your browser |
| __hs_cookie_cat_pref | Yes | Five months | Set by HubSpot to store your cookie preferences |
Discourse.org may also use Apollo tracking technologies, including scripts, for analytics purposes and obtaining and enriching marketing data.
In addition, look at the privacy notice for your specific forum to find out which cookies that forum uses. By default, all Discourse forums use these cookies:
| Name | Essential | Expires | Purpose |
|---|---|---|---|
| Yes | Session | remembers your email as you create an account | |
| destination_url | Yes | Session | helps redirect you to your requested page after logging in |
| sso_destination_url | Yes | Session | helps redirect you to your request page after single sign on |
| sso_payload | Yes | Session | used during SSO authentication when two-factor authentication is enabled |
| authentication_data | Yes | Next Page View | temporarily stores user information during login flows |
| theme_ids | Yes | 1 year | remembers your theme personalization if you don’t tick “Make this my default theme on all my devices” |
| color_scheme_id | Yes | 1 year | remembers your color personalization if you don’t tick “Set default colour scheme(s) on all my devices” |
| dark_scheme_id | Yes | 1 year | remembers your color personalization if you don’t tick “Set default colour scheme(s) on all my devices” |
| cn | Yes | Session | temporarily stores notification read state |
| _bypass_cache | Yes | Session | allows the server-side cache to be bypassed during login flows |
| _t | Yes | 1440 Hours | remembers who you are when you log in |
| _forum_session | Yes | Session | associates an ID, and other security-related information, with your browsing session |
| dosp | Yes | Next Page View | enables client denial of service protection, a security protection |
| text_size | Yes | 1 year | remembers default text size when a user wants to change it on only one device |
| cookietest | Yes | Session | checks if cookies are enabled when authentication fails |
| __profilin | No | Session | used by software developers to bypass rack-mini-profiler |
For more information on Google Analytics, including how Google Analytics collects, uses, and discloses information, please refer to www.google.com/policies/privacy/partners.
Google Analytics, Google Tag Manager, or Google AdWords may set the following cookies: