Privacy

What we store

When you create an account we store your name, email address, date of birth and a hashed version of your password (we never store the password itself), and your nationality and gender if you choose to give them. As you use the site we also store what you do on it: the communities you join, the messages you post, articles you like or save, events you RSVP to, and the profile details you choose to add (bio, links).

To keep your account safe we also store, for each device you are signed in on, the browser's description of itself (such as Chrome on Windows), the internet address it last used, and when. You see them on your account page, and each is forgotten 180 days after that device signs out. If you turn on two-step sign-in, its secret is kept sealed with a key that is not in the database, and your recovery codes only as hashes. If you report a chat message, we keep the report and your reason.

If you write to us through the contact form or subscribe to the newsletter, we store that too. If you are on Codemoot's staff, what you do in the Admin Centre is written to an audit log. All of it lives in our own database on our hosting provider (Hostinger).

Your date of birth, nationality and gender are never shown to other members. They are there for one reason: when you ask a university on Codemoot to confirm you study there, its staff see them beside your application, because those are the details its international office checks. Nobody else sees them. They are kept with your account and deleted with it.

What we don't do

No advertising, no analytics scripts, no tracking pixels, and no selling or sharing of your data with anyone. We set two cookies, both needed to run the site safely: the session cookie (__Host-cmsid) that keeps you logged in, and a device cookie (__Host-cmdev) that recognises your browser, so we can email you when your account is used on a device it has not used before. The site also uses your browser's local storage for small conveniences like your light/dark theme choice.

Third-party requests

Our server gathers the news feed from the publishers named on each story and keeps a copy, so your browser reads the stories from codemoot.com. Your browser loads the picture on a story from the address the publisher's feed gives for it, and if our server cannot be reached or has no stories to give, it asks Hacker News (Algolia) and Dev.to for the feed directly. A picture a member links on a service listing or in a portfolio loads from the address they gave, so your browser asks that site for it. Those requests go from your browser to those services and are covered by their own privacy policies; we send them nothing about your account. Fonts and styles come from codemoot.com itself.

For the events list, our server fetches the open confs.tech conference data from GitHub and keeps a copy, so your browser reads it from codemoot.com and not from GitHub. Our server asks GitHub only for that data and tells it nothing about you or your account.

For NCU International, our server sends Chinese text to MyMemory (Translated srl, Italy) to translate it into English: news and notices read from Nanchang University's International Education College site, and announcements that the admins or a committee publish only in Chinese. Only that text goes, never anything about you or your account.

Who can see what

Messages you post in rooms are visible to other Codemoot members, along with your display name. Your email address is never shown to other members. Profile links you add are visible on your profile.

Your rights

All of them are self-serve on the Your data page while you are signed in: download everything we hold as a zip, switch the newsletter on or off (it and the daily email about unread messages, switched on the Notifications page, are our only optional processing), and delete the account. Deletion happens 14 days after you ask, so a mistake can be undone by signing in; then it is permanent, and residual copies in the host's routine backups expire within 30 days. Your email address and password are yours to change on the account page.

Prefer email, or need a correction you cannot make yourself? Write to hello@codemoot.com from the address on your account and we will handle it.

Age, and children

Codemoot is for adults. You must be 18 or over to have an account, and the terms say so. When you sign up we ask for your date of birth and do not open an account for anyone under 18. We do not ask for identity documents or face scans, because collecting them from everyone would take far more personal data than it would protect.

The consequence is that we cannot be certain every member is an adult, since a date of birth is what you tell us, so we work on the basis that someone under 18 may be here. If we learn an account belongs to a child we close it and delete the data. If you believe a child is using Codemoot, tell us at hello@codemoot.com or through the reporting page.

Controller and processor

Codemoot is being registered as a UK limited company; the company number and registered office will appear here the day they are issued. Until then, the person answering hello@codemoot.com is the person responsible for your data. Our one processor is Hostinger, which runs the servers, the database and outbound email.

If you think we have handled your data badly and we have not put it right, you can complain to the UK Information Commissioner at ico.org.uk.

Contact

Privacy questions: hello@codemoot.com.