Privacy Policy

Controller: Stupid Forums · Privacy contact: Useless@nest.rip.

1. Scope

This Privacy Policy explains how Stupid Forums (“we,” “us,” or “the Operator”) collects, uses, shares, and retains information when you visit the website, create or use an account, set a profile picture, or otherwise interact with the Service. It applies to the Service, not to third-party websites or services such as Pone or Cloudflare. Those providers handle information under their own privacy policies.

2. Information We Collect

Information you provide

• Account information: username, password-derived authentication material, and the encrypted vault used by the browser client.
• Email address: the browser encrypts the registration email before transmission. The Operator stores ciphertext and cannot read the address without the key, which the Operator does not possess.
• Profile information: display name, bio, signature, avatar URL or image, and other public fields you choose to add.
• User Content: posts, thread text, comments, images, files, links, reports, and messages you submit.
• Reactions and trophies: which posts you react to, and aggregate post, comment, and received-reaction counts used to award profile trophies and points.
• Support and legal communications: information you send to us, including reports and DMCA notices.

Information collected automatically

• Session and preference data: an HttpOnly session cookie, a CSRF cookie, cached username and user ID, cached profile-check time, avatar display values, your community-summary cache, mature-board acceptance choices, and your cookie-consent choice.
• Technical and security data: IP address, user agent, request timestamps, requested URLs, error and rate-limit events, and similar logs processed by our hosting and security providers. For signup screening and abuse enforcement, we derive a keyed one-way hash of the connecting IP and store that hash with the account and in a short-lived risk cache. The signup hash enforces one account per network; it is separate from the mutable hash used for sign-in and bans. We do not store the raw IP in our application database.
• Account activity: a last-seen timestamp is updated when an account signs in, registers, or verifies its session. It is used only to show whether a staff account is currently online; exact timestamps are not exposed by the public community summary.
• Cookies or similar technologies: we use essential first-party cookies for sign-in and CSRF protection, plus browser local storage for display preferences. We do not use advertising cookies. Our infrastructure providers may use strictly necessary security cookies. See the Cookie Policy.

Information from third parties

We use Pone to host profile images and thread or comment attachments. Pone may process the uploaded file and technical information under its own terms. We receive the resulting public file URL; profile images are displayed through our image proxy, while attachments are linked from the post or comment that contains them. We do not receive or store Pone credentials in the browser. Attachments are public wherever their URL is shared, so do not upload private files.

When you submit a content report, we send the report reason, any details you provide, your username and numeric account ID, the reported content, and a direct link to that content to a private Discord webhook used by the moderation team. Discord processes that information under its own privacy policy. The webhook URL is kept server-side and is not sent to your browser.

When you attempt to register, we send the connecting IP address to proxycheck.io to identify VPNs, Tor exit nodes, public proxies, and data-center/hosting connections. That service receives the IP address and returns a risk classification; we do not send your username, password, or account data. The classification is cached in our database against a keyed one-way IP hash for up to 24 hours. Registration is blocked when the response identifies one of those connection types. If the lookup is unavailable or errors, registration continues without the check. proxycheck.io processes information under its own privacy policy.

3. How We Use Information

We use information to:

• create, authenticate, secure, and maintain accounts and sessions;
• display profiles, posts, images, and other content you choose to publish;
• operate, debug, secure, and improve the Service;
• enforce our Terms, prevent abuse, investigate reports, and protect users and third parties;
• comply with law, valid legal process, tax and recordkeeping duties, and enforce our rights;
• communicate with you about the Service, security, and policy changes; and
• detect, prevent, and respond to fraud, security incidents, and unlawful activity.

We do not sell personal information, do not use it for cross-context behavioral advertising, and do not use advertising or analytics cookies.

4. Legal Bases and U.S. Privacy Law

Where a legal basis is required, we process information as necessary to perform our contract with you, comply with legal obligations, protect vital interests and safety, and pursue legitimate interests that are not overridden by your rights. You may have additional rights under state law, including the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and comparable statutes in other states.

5. How We Share Information

We may share information with:

• Service providers: hosting, security, content delivery, image proxying, signup risk screening, and infrastructure providers, including Cloudflare, Pone, and proxycheck.io, under their applicable terms.
• Other users and the public: profile fields, usernames, images, posts, and other content you publish are public. Do not publish information you want to keep private.
• Legal and safety recipients: law enforcement, courts, regulators, NCMEC, rights holders, and other parties when we believe disclosure is required or appropriate to comply with law, respond to valid process, address unlawful activity, or protect safety.
• Professional advisers and transactions: lawyers, auditors, insurers, and parties to a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate confidentiality protections.

We do not sell personal information and do not share it for cross-context behavioral advertising. We may disclose aggregated or de-identified information that cannot reasonably be used to identify you.

6. Public Content and Third-Party Copies

The Service is public by design. Search engines, archives, other users, and third-party hosts may copy, cache, index, or redistribute public content. Removing content from your profile does not guarantee that every copy disappears, including copies held by Pone, search engines, or other third parties. Upload only content you are comfortable making public.

Moderation records may also be public. When an IP ban is applied, Stupid Forums Auto Mod posts an entry in the Other → Bans board with the target account’s username and numeric id, the action, the stated reason, and the moderator’s username. The public entry does not include the IP address or its keyed hash.

7. Cookies, Local Storage, Sessions, and Consent

We use essential first-party cookies to keep you signed in across page loads and browser restarts. The signed session token is stored in an HttpOnly cookie named sf_session, so page JavaScript cannot read it. A separate sf_csrf cookie and a token kept in sessionStorage protect state-changing requests from cross-site request forgery; the CSRF token is not an authentication credential. We use browser local storage for cached display data such as sf.user, sf.userId, sf.profileCheckedAt, sf.avatarColor, and sf.avatarUrl, plus sf.canModerate as a display hint for the staff moderation link. A short-lived board statistics cache is stored under sf.boardStats.v1, and the home activity summary is stored under sf.community.v1. Mature-board acceptance is stored under sf.mature.accepted.v1. Your cookie notice choice is stored under sf.cookieConsent.v1. These values remain in your browser until they expire, you log out, or you clear site data.

The session cookie is sent automatically with API requests to the site, including credentialed cross-origin requests. Anyone with access to an unlocked browser profile may be able to use an active session until the cookie expires or you log out. Use a trusted device, keep your operating system and browser updated, and log out on shared devices. Clearing site data removes the cookies and cached display values.

8. Retention

We retain information for as long as needed to operate the Service, maintain account and security records, resolve disputes, enforce agreements, and comply with law. Retention periods vary based on the type of information and the reason it is kept. Public content may remain in backups, caches, logs, or third-party copies after deletion. We may retain limited records where law requires preservation or where needed to establish or defend legal claims.

Signup risk classifications are cached for up to 24 hours. Keyed IP hashes associated with an account are retained while the account is active and may be retained in security records for as long as needed to enforce a ban, resolve abuse, or comply with law. Because the hash is keyed with a server secret, it is not a plain IP address.

9. Security

We use technical and organizational measures designed to protect information, including browser-side password processing, encrypted email vaults, access controls, and encrypted transport. No method of transmission or storage is completely secure. We cannot guarantee that unauthorized access, disclosure, alteration, or destruction will never occur, and you provide information at your own risk.

10. Your Privacy Rights

Depending on where you live, you may have the right to request access to, correction of, or deletion of personal information; to obtain a copy of information you provided; to know the categories of information collected and disclosed; to opt out of sale or sharing; to limit the use of sensitive personal information; and to appeal a refusal. We do not sell or share personal information for cross-context behavioral advertising, and we do not knowingly collect sensitive personal information for inferring characteristics.

To exercise a right, contact Useless@nest.rip. We may need to verify your identity and account control before acting. You may use an authorized agent where law permits, subject to verification. You may appeal a decision by replying to our response. We will not discriminate against you for exercising a privacy right, though some features may be unavailable if you request deletion of necessary account data.

Because passwords and email vaults are encrypted in the browser, we may be unable to retrieve or produce some encrypted data. Account deletion may remove the encrypted vault, authentication record, profile, and uploads, but may not remove third-party copies or backup records retained for legal or security reasons.

11. Children’s Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information, contact Useless@nest.rip so we can investigate and take appropriate action. Users between 13 and the age of majority must have parental or guardian permission.

12. International Visitors

The Service is operated from the United States. If you access it from another country, you understand that information may be processed in the United States and other locations where our providers operate, and that privacy laws there may differ from those in your country.

13. Changes to This Policy

We may update this policy. Material changes will be posted here with a new effective date or version. Your continued use after the effective date means the updated policy applies. Where required by law, we will provide additional notice or obtain consent.

14. Contact

Privacy questions and requests: Useless@nest.rip

15. Selected U.S. References

• California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq., as amended by the CPRA.
• California Online Privacy Protection Act, Cal. Bus. & Prof. Code §§ 22575–22579.
• Children’s Online Privacy Protection Act, 15 U.S.C. §§ 6501–6506; 16 C.F.R. Part 312.
• Federal Trade Commission Act, 15 U.S.C. § 45 (unfair or deceptive practices).
• Computer Fraud and Abuse Act, 18 U.S.C. § 1030; Stored Communications Act, 18 U.S.C. §§ 2701–2713.
• State comprehensive privacy statutes, including those of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states as enacted.
• FTC, Protecting Personal Information: A Guide for Business, https://www.ftc.gov/business-guidance/resources/protecting-personal-information-guide-business.
• California Attorney General, CCPA resources, https://oag.ca.gov/privacy/ccpa.
• National Conference of State Legislatures, state privacy legislation tracker, https://www.ncsl.org/technology-and-communication/state-action-on-privacy.