Privacy
This page states what this site holds about a reader, why it holds it and the period after which each record class is purged. That period is 30 days.
What is held
This site holds contributor accounts, sessions, magic-link tokens, correction submissions and emailed assessment copies in its database. The field table names every column. Specification pages are files in the repository, not database rows. A published changelog credit is repository content. Ending an account does not rewrite that credit. A maintainer commit does.
Field table
Every column on the six tables this site writes.
| Table | Column | Purpose | Retention |
|---|---|---|---|
| user | id | Internal key for the account row. It is not shown on any page. | Held while the account is live. After deletion, held 30 days and then purged. |
| user | name | The sign-in library (Better Auth 1.7.1) requires a name column and writes it when an account is created. A magic-link sign-in stores an empty value. This project does not treat it as a display name. | Held while the account is live. After deletion, held 30 days and then purged. |
| user | The address used to sign in. It stays unique until the row is purged. | Held while the account is live. After deletion, held 30 days and then purged. | |
| user | email_verified | Library flag that a magic-link sign-in has confirmed the address. | Held while the account is live. After deletion, held 30 days and then purged. |
| user | created_at | When the account was created. | Held while the account is live. After deletion, held 30 days and then purged. |
| user | updated_at | When the account row last changed. | Held while the account is live. After deletion, held 30 days and then purged. |
| user | role | Whether the session is a contributor or the maintainer. The maintainer cannot end this account from the site. | Held while the account is live. After deletion, held 30 days and then purged. |
| user | deleted_at | Set when the contributor ends the account. The row stays until the stated period ends. The purge then removes it. | 30 days from deletion, then the row is purged. |
| session | id | Internal key for the signed-in session. It is not shown on any page. | Held while the session or magic-link is live. |
| session | expires_at | When the signed-in session ends on its own. | Held while the session or magic-link is live. |
| session | token | The session token the browser holds. It is not shown on any page. | Held while the session or magic-link is live. |
| session | created_at | When the session was created. | Held while the session or magic-link is live. |
| session | updated_at | When the session row last changed. | Held while the session or magic-link is live. |
| session | ip_address | The sign-in library (Better Auth 1.7.1) writes the network address of the browser on every session create. This project did not add the column and does not display it. | Held while the session or magic-link is live. |
| session | user_agent | The sign-in library (Better Auth 1.7.1) writes the browser string on every session create. This project did not add the column and does not display it. | Held while the session or magic-link is live. |
| session | user_id | Ties the session to the contributor account. | Held while the session or magic-link is live. |
| account | id | Internal key for the sign-in library account link. It is not shown on any page. | Held while the account is live. Removed when the user row is purged after 30 days. |
| account | account_id | The sign-in library's identifier for this account at the provider. | Held while the account is live. Removed when the user row is purged after 30 days. |
| account | provider_id | Which sign-in provider created the link. This site uses a magic link. | Held while the account is live. Removed when the user row is purged after 30 days. |
| account | user_id | Ties the sign-in link to the contributor account. | Held while the account is live. Removed when the user row is purged after 30 days. |
| account | created_at | When the sign-in link was created. | Held while the account is live. Removed when the user row is purged after 30 days. |
| account | updated_at | When the sign-in link row last changed. | Held while the account is live. Removed when the user row is purged after 30 days. |
| verification | id | Internal key for an unused sign-in link. It is not shown on any page. | Held while the session or magic-link is live. |
| verification | identifier | The address the unused sign-in link was sent to. | Held while the session or magic-link is live. |
| verification | value | The one-time sign-in token. It is not shown on any page. | Held while the session or magic-link is live. |
| verification | expires_at | When the unused sign-in link dies on its own. | Held while the session or magic-link is live. |
| verification | created_at | When the unused sign-in link was created. | Held while the session or magic-link is live. |
| verification | updated_at | When the unused sign-in link row last changed. | Held while the session or magic-link is live. |
| correction | id | Internal key for the submission. It is not shown on any page. | Held until the submission is withdrawn and then 30 days. |
| correction | identifier | The specification decision the correction addresses. This is a permanent identifier. | Held until the submission is withdrawn and then 30 days. |
| correction | body | The correction text the contributor submitted. | Held until the submission is withdrawn and then 30 days. |
| correction | contributor_id | Ties the submission to the account. Becomes empty when the author row is purged. | Held while the correction is live, then anonymized on author purge. |
| correction | attribution | Whether the submitter asked for a named credit or an anonymous one. | Held until the submission is withdrawn and then 30 days. |
| correction | status | Where the submission sits in the maintainer queue. | Held until the submission is withdrawn and then 30 days. |
| correction | notified_status | The last queue status mailed to the author. | Held until the submission is withdrawn and then 30 days. |
| correction | notified_at | When that status mail was sent. | Held until the submission is withdrawn and then 30 days. |
| correction | deleted_at | Set when the author withdraws. The purge reads this timestamp. | 30 days from withdrawal, then the row is purged. |
| correction | created_at | When the submission was received. | Held until the submission is withdrawn and then 30 days. |
| correction | updated_at | When the submission row last changed. | Held until the submission is withdrawn and then 30 days. |
| assessment_copy | id | Internal key for an emailed assessment copy. It is not shown on any page. | Held 30 days from send, then purged. |
| assessment_copy | recipient_address | The address that asked for a copy. Sending a copy creates no account. | Held 30 days from send, then purged. |
| assessment_copy | profile | The six-layer current and target answers. | Held 30 days from send, then purged. |
| assessment_copy | question_set_version | Which question set the answers belong to. | Held 30 days from send, then purged. |
| assessment_copy | specification_version | Which specification version the result was taken against. | Held 30 days from send, then purged. |
| assessment_copy | created_at | Send time. The purge reads this timestamp. | Held 30 days from send, then purged. |
| assessment_copy | updated_at | When the copy row last changed. | Held 30 days from send, then purged. |
| assessment_copy | deleted_at | Present because every table carries this timestamp. The purge never writes it and selects on created_at. | Never written. The row is purged 30 days after send. |
Assessment copy
An emailed assessment copy is an address, a per-layer profile, two version stamps and a send time. It is held to re-send the copy and to answer a reader who asks what is held about them. It is not read for measurement. Sending a copy creates no account. The row is purged 30 days after send. A reader who wants it gone sooner writes through /contact/.
YouTube
The resources page (/resources/) loads a YouTube player from youtube-nocookie.com. That host delays some cookies. It does not remove them. A reader who loads the iframe is subject to YouTube cookies. The watch link (https://www.youtube.com/watch?v=kxrNJWHUW_k) plays the video on YouTube without the embed.
Contact
A message sent through /contact/ reaches a mailbox and leaves no row on this site.
Sign-in links, contact messages, assessment copies and credit notices travel through third-party mail services. Those services handle addresses on the way through. This page does not name them.
Analytics
An analytics script records page views. It sets no identifying cookie. This site reports no visitor number. This page does not name the tool.
Deletion and the period
A contributor ends the account from /account/corrections/. The account is unreachable at once. Sessions and unused sign-in links are removed in that same step. The address stays unique for 30 days. The purge then removes the row. Live submissions stay in the queue until they are decided. A withdrawn submission is retained for 30 days and then purged. A published changelog credit stays until a maintainer commit. That commit has no date attached.