What we keep, and what we refuse to

What we store

• Your username, display name, title, bio and email address.
• Hashes of your recovery codes (never the codes: they are shown once, to you; each hash is tied to your account), and, while a verification or reset link you asked for is live, a hash of that link with the address it went to; both are dropped a day after they expire or are used. Whether your email is verified.
• An avatar and banner if you upload them. Uploads are re-encoded on our server, resized, and stripped of all metadata (no EXIF, no location), so the original file is never stored or served.
• A password hash (Argon2id). We never see or store the password itself.
• If you turn on two-step sign-in: your authenticator app's secret, encrypted with a key kept outside the database (it has to be readable to check your codes, and is never shown again after setup), and the time step of the last code you used, so no code works twice. For each passkey, its public key, its id, a name you choose, whether it is synced, and when it was added and last used; never anything that could sign in as you. While a sign-in waits for its second step (five minutes at most) or a passkey prompt is open, a hash of that attempt and how many tries it has had; after a reset link, also your new password's hash, which is set only once the second step passes and is deleted with the attempt otherwise. All of it goes when you turn it off or delete your account; the dates and names are in your export.
• What you post: posts, comments, resources, courses, decks and cards. Pictures you add to a thread or reply are re-encoded like every picture (no camera, no location), count toward your storage, and are shown to whoever can see the thread; one uploaded for a post you never send is deleted after a day.
• Your library: links, notes and files you keep. Private items are visible only to you and are served only to you; items you share with a camp are visible to its members; public items are visible to everyone. Nothing you upload is kept with its metadata: pictures are re-encoded (no EXIF, no location), and PDFs are rewritten without their author, title, software, dates, edit history, comment authors, attachments, scripts or the metadata of the pictures inside them. A PDF we can't clean (a password-protected one, say) isn't accepted. Text files have no metadata and are stored as uploaded. Deleting your account deletes your private items and their files.
• Copies you keep beside your links: the file (cleaned the same way), the licence you picked, who made it, where the copy came from, your note on your right to keep it, who may open it and when you confirmed the licence. We never fetch a file from a link for you. A copy is opened only by you unless you choose otherwise, and never by more people than can see its link: a link shared with everyone can keep its copy private. Copies count toward your storage and are listed in your export (without the files, which you can download from the link's page); a copy someone else keeps is never in your export. Deleting a link deletes its copy. Deleting your account deletes your private copies and the copies beside your private links; copies you shared stay with their links, like the links.
• Your credit ledger and awards given and received, and the limited awards you hold (which ones and how many). A limited award you send to another member moves to their account; they are told who sent it.
• Your level: an XP ledger recording what earned each point (a thread, a finished book, a graded assignment) and in which camp, your level and prestige, and the achievements you hold. All of it is in your export and is deleted with your account.
• Your study record: the courses you enrol in, which lessons you have started and finished, flashcard reviews (each with the card's previous state, so you can undo an answer), your study options (new cards a day per deck, desired retention) and the cards you suspend, the assignments you submit, your answers to a lesson's interactive parts (quiz choices, gaps, words you mark, where you click on a picture, code you ran, poll votes, ratings, checklists and reflections, with your best score and how many tries), the steps of a path you mark done, and your log on a path (the titles you start and finish, your reports and marks). A course's author sees how its learners did on each question as totals, the votes on its polls and its ratings as totals, and the reflections written in it. All of it is in your export and is deleted with your account.
• Pictures and files you upload to a course's lessons, cleaned the same way: pictures re-encoded (no camera, no location), PDFs rewritten without their hidden details, text stored as uploaded. Only people who can see the course can open them, and they count toward your storage. A list of them (name, size, course, date) is in your export. They go when they're removed from the course or the course is deleted; a private course is deleted with your account, and uploads to a course others can see stay with that course, credited to “Deleted user”.
• Suggestions you write on paths (what you proposed, where, and the maintainers' answer), shown to everyone who can read the path unless declined, when only you and the maintainers see them. The paths you follow, and when you started following. They make up your Today page; others see only how many people follow a path, never who.
• The cohorts you join on a path, and when you joined. Members of the same cohort see each other, with which step each is on; on a step's page, people who share a cohort with you, or who are in the camp and working through the path with you, see that you're on that step. Nobody else does.
• Whether each of your reports on a published path is shared with everyone following it, or kept to the path's camp. You choose when you write it, and you can change it whenever you edit the report.
• Market listings you post: they are forum threads, with a price, how it happens, a subject and whether it is still open. Deals you take part in: who the other member is, the listing, the line you agreed on, whether it was confirmed and when. A deal is seen only by the two of you; the number of confirmed deals is cached on your account and shown on your profile. camp never handles the payment, so we hold nothing about it.
• Moderation state on your account: a trust setting staff can pin (steward, or restricted) and a posting pause that starts by itself when members' flags hide several of your posts in a day, or that staff set. Your trust level itself is not stored: it is worked out from your account's age, posts, level and reputation whenever it is needed. Each report you file records the weight your trust gave it. Whether more of your flags were brought back by moderators than kept hidden (which makes them count half) is not stored either: it is worked out from your reports and the moderation log when your flags are counted.
• Vouches you give and receive, with the reason you wrote. A vouch is shown on the other member's profile with your name; retracting it removes it entirely.
• Direct messages, end-to-end encrypted. We store only the encrypted text, which we cannot read, plus who wrote to whom, when each message was sent, when each of you last read the conversation (shown to the other person only if you both share read receipts), which key encrypted each message, and a “New message from…” notification. Your private key is encrypted in your browser with your messages PIN before it reaches us, and we encrypt it once more with a key kept outside the database; we keep a check value for your PIN, never the PIN. Staff cannot read messages. That protection is as strong as your PIN: someone holding both our database and that outside key could try PINs offline, so a short PIN can be guessed where a longer one can't. Reporting a message sends that one message's text to staff. Deleting your account deletes your conversations for both sides. Your export includes them as the encrypted text we hold.
• Secret camps, end-to-end encrypted with the same keys and PIN as your messages. A secret camp's name, description, threads and replies are encrypted in members' browsers before they reach us; we store only that encrypted text, which we cannot read, plus who is a member and their role, when each member last opened the camp (to mark what's new), who wrote each thread and reply and when, how long each is (roughly: it's padded), invitations (who invited whom, until when), copies of the camp's keys, each sealed to one member's key so only they can open it, and for each new key a seal that lets members' browsers check it came from someone who held the one before. When someone leaves or is removed, the next member's browser to open the camp moves it to a new key, and nothing new can be written until it has. Secret camps need a messages PIN of at least 10 characters: every member holds the camp's keys behind their own PIN, so the shortest PIN in a camp is what someone holding both our database and the key kept outside it would have to guess. What you write in secret camps counts toward your storage. Staff cannot read secret camps or see their names; an admin can delete one, and is shown only its id, member and thread counts and dates. Secret camps appear nowhere else: not in search, the directory, profiles or feeds, and their notifications say nothing about what was written. Reporting a post in one sends that post's text to staff. Deleting your account takes you out of every secret camp (you must hand on the ones you own first); what you wrote stays, encrypted, attributed to “Deleted user”, as in other camps. Your export includes your memberships, invitations, what you wrote and the keys sealed to you, as the encrypted text we hold.
• Members you have blocked, your choice of who may message you, and whether you share read receipts. With read receipts on, the other person sees when you last read the conversation, but only if they share theirs too. While you type, the other person sees a typing indicator; we keep that only in memory for a few seconds and never store it.
• Payments go through a crypto payment processor, which sees the payment and your wallet, and from us only the item and our order number, never a name. We keep an order record (what was bought, for whom, the amount, the processor's reference and the status), never wallet addresses or transaction hashes.
• A list of signed-in devices with a coarse label such as “Chrome on Windows”.
• A log of security events (sign-ins and how they were completed, failed and blocked sign-in attempts, password changes and recoveries, two-step sign-in turned on or off, other devices signed out) visible only to you, kept for 90 days. Recent failed attempts on your account (a wrong password, second step or recovery code) also count toward a limit that holds across our servers; your address is never part of it. If this site sends mail and your address is verified, a short alert goes to it when your account is recovered, your password is reset or changed, how you sign in changes, or someone with your password keeps failing the second step: what happened, when and the device label, never a code, a password or a link that signs you in.
• Notifications (replies, vouches, invites, messages, achievements). Read ones are deleted after 90 days and all of them after 180; a notification about something that is removed goes with it.
• Requests to join a camp (with the note you wrote) and invitations to one (who invited whom). A decided request is deleted after 90 days, an expired invitation after 30. For each camp you belong to, when you last opened it, so threads newer than that can be marked as new; it goes with your membership.
• Reports you file (what you reported and why) and, if a moderator ever acts on your account, the decision, its reason and its date. Camp moderators see reports about content in their camp, but not who filed them; site staff see the rest. Both are included in your export.
• Appeals you make against a removal: what you wrote, when, and the outcome with the moderator's note. The moderators who may decide it (site staff, or the camp's moderators for content in a camp) see what you wrote; your export includes it, without the name of who decided. Like reports, appeals are kept after you delete your account.

What other members see

• Profiles are public by default, including to search engines. You can make yours members-only or private.
• With activity shown (the default), other members see your recent posts and a dot on your posts when you used the site in the last two hours. Turning activity off hides both, and a private profile never shows the dot.
• The emblems of public verified camps you belong to (you can turn these off). A private camp shows only if you pick it as your main banner. Hidden camps never show.
• Your credit balance, and your awards: those you received and the limited awards you hold (which ones and how many), on your profile and beside your posts.
• Your vouches (with which ones came from a confirmed deal), your number of confirmed market deals, and your open market listings.
• While you are new, links you write show as plain text to everyone.
• Never your email address, your votes, or who gave an anonymous award.

Moderation

Site staff and camp moderators can remove content, lock threads and suspend accounts. Every such action is written to a log with the moderator's name and reason, so decisions can be reviewed. A suspension tells you the reason when you try to sign in. Staff can see your email address for account support, which camps you belong to, and how many devices are signed in (not which); they keep notes on the reports they settle. Nobody else sees any of it.

What we do not store

• IP addresses. They are used in memory for rate limiting and never written to disk.
• Raw browser user-agent strings, device fingerprints or location.
• Analytics profiles, ad identifiers or behavioural tracking of any kind.

Third parties

Pages load no third-party scripts. Fonts are served from this site. A lesson with a YouTube or Vimeo video shows a placeholder; the video loads from that service only when you press play, and from then on the service sees your IP address. Read aloud on flashcards uses only voices that run on your device. Links you post point wherever you point them; we mark them nofollow noopener noreferrer so the destination does not learn where you came from.

Mail from this site (the link to verify your address, a password reset link you ask for, and security alerts) is sent through Resend, an email delivery service, which hands it to your mail provider. For that, Resend receives your email address and the mail itself: its subject and text, which hold your username and either the one-time link or, in an alert, what happened, when, and the device label. Nothing else about you goes to Resend: never your password, your IP address or anything you write here. A verification link works for a day and a reset link for an hour, each only once, and with two-step sign-in on a reset link alone changes nothing.

Sessions

Signing in sets one cookie containing a random token. Only a hash of that token is stored, so a copy of the database cannot be used to impersonate you. A session ends after two to four weeks without use, and six months after signing in however much it is used; you can revoke any of them from Settings.

When you are signed in, your browser also sets a tz cookie with its time zone (for example Europe/Berlin), so a study day starts at 4 a.m. where you are. It is read to work out that boundary and never stored; signing out removes it, and it lapses after a month. Expired sessions are deleted.

Stored in your browser

• Your unlocked messages key, in the browser's own storage and marked so it can't be read back out. Signing out or locking messages removes it.
• Whether flashcards are read aloud, if you turn that on.
• For each secret camp you open on a device, the newest key that device has checked, so a server showing an older one is noticed. Signing out removes it.

Your controls

• Set your profile to public, members-only or private.
• Hide your activity from your profile page.
• Export everything as JSON from Settings → Account & data.
• Delete your account. Personal data is erased immediately: your profile, level, private items and kept copies, private decks, private and never-published courses (with their pictures and files), study record and path logs, the paths you follow, messages, votes, vouches given and received, settings and notifications. What you shared (posts and market listings, replies, shared library items, public decks and courses) stays, attributed to “Deleted user”, so other people's threads and studies still make sense. The market deals you took part in are deleted, and a confirmed one no longer counts for the other member. Your credit ledger, payment orders and the reports and appeals you filed are kept, attached to that anonymous account, for accounting and moderation; so are the awards you gave, the peer reviews and gift messages you wrote, the invitations you created and your actions as a camp moderator, all attributed to “Deleted user”, and copies of your public messaging key that other members' secret-camp keys were sealed with, so their camps still open. Notifications we sent other members about what you did keep your name for up to 180 days. Your username is never handed to anyone else. Encrypted backups are kept for up to eight weeks; your data leaves them as they expire. If you own a camp, hand it to another member or delete it first.