Privacy

You can read and download everything here without signing in. Doing that stores one row recording that a download happened: which resource and version, when, the browser’s user-agent string, and a hash of your IP address — not the address itself. The hash groups repeated downloads from one visitor so the counts mean something, and cannot be turned back into an address.

There is no advertising, no tracking pixel and no third-party analytics script on this site.

Stored because the account cannot work without it:

• Your username, email address and a hash of your password.
• Whether the email address has been confirmed, and your account status.
• Sessions: a hash of each sign-in token, when it expires, roughly when it was last used, and the browser that created it. Signing out revokes it.

Stored because you chose to enter it, and shown on your profile:

• Display name, bio, avatar, location, self-described role, languages and social links.

Stored because of something you did:

• Resources you upload, and the files that go with them.
• Drafts of uploads you have not finished.
• Favourites, ratings and reports you file.

• The database and the site itself are hosted in the United States.
• Uploaded files and images live in object storage in Canada, and images are served through a content delivery network.
• Email — confirmations, password resets and moderation notices — is sent through a transactional mail provider. Your address is given to them because that is how a message reaches you.

None of these are sent your data for their own purposes, and none of it is sold to anybody.

When staff act on something — approving an upload, removing a resource, suspending an account — that decision is written to an append-only log with who did it and why. That record is the reason anybody can question a decision later, so it survives the deletion of the account it was about, holding the name at the time rather than a live link to a person.

Reports are stored with a hash of the reporter’s IP address for rate limiting. A report does not need to identify anybody.

Account settings has a Delete Account control. It removes your profile, your drafts and your ability to sign in, and releases your username and email address so neither is held by an account that no longer exists.

Resources you have already published stay. Other people have downloaded them, linked to them and built on them, and a site where anybody can withdraw work the community depends on by pressing one button is a worse site. If a specific resource needs to come down, ask through Report Content and a person will handle it.

Write to us through Contact and we will tell you what is stored against your account and hand it over. If you believe something here is wrong, say so the same way.