Online accounts and forum data
Amazon Cognito handles email verification, password-based sign-in, password recovery and account-security messages. The forum stores your shown name, public account identifier, interests, preferences, questions, replies, saved and followed threads, reactions, reports and moderation records in DynamoDB. The launch configuration places accounts, forum data, account email sending and the private deletion ledger in Frankfurt, Germany (eu-central-1). The account region configured for this website is eu-central-1. CloudFront processes API traffic through its global network; using Frankfurt for stored forum data does not mean every request is processed only in Germany. The owner must verify the deployed regions and providers before opening registration.
Public and private information
Your shown name, join date, interests and published posts are public. Email addresses, saved/followed lists and preferences are private to your account. The service also keeps a private link to Cognito’s internal account username so account checks, sign-out and deletion use the correct identity. Reports and their notes are available to the moderation team. Reporting a post hides it for you after the report is saved; it does not automatically remove it for everyone.
Browser storage
The browser uses session storage for sign-in tokens, verification-flow details and account-scoped text drafts. Pending registration details can include your email, chosen name and interests. Passwords and email verification codes are not saved in this storage. Forum API requests omit cookies; cookies do not authenticate forum accounts. Signing out clears sign-in tokens but does not promise to remove every draft or verification-flow record. Clear this site’s browser data when leaving a shared device.
Account controls and deletion
Account settings let you edit your shown name and preferences, download your data and request account deletion. Once a deletion request is accepted, forum access is blocked and your profile is removed. Account and private-record cleanup then runs in batches and retries failures; this notice does not promise a completion deadline before that process has been verified. Retained public contributions are attributed to Deleted user and have no automatic expiry. Remove a post before deleting your account if you do not want it to remain public, and contact us about personal information inside retained text. Protected moderation records and copies may retain earlier text or identifiers until their separate cleanup. A minimal deletion ledger records account identifiers and the deletion time to help prevent deleted profiles from being restored.
Limits and moderation
Verified accounts, posting limits, temporary first-day link holds and moderation reduce spam. The service also uses short-lived pseudonymous request-rate records and security/audit records to enforce limits and investigate abuse. Email verification does not guarantee that every member is human or that advice is safe.
Features not enabled
This release accepts text only: no photos or profile images are uploaded. Google and Apple sign-in are not offered until configured. Notification preferences can be saved, but forum reply and summary emails are not sent yet. Verification, recovery and security messages are separate account messages.
Retention and backups
The launch configuration has database point-in-time recovery disabled. It does not provide the 35-day recoverable history discussed in the original proposal, and no scheduled database-backup service is configured. Keeping a database when infrastructure is removed is not a backup of earlier data.
The current expiry settings are approximately 24 hours for pseudonymous request-rate records, up to 2 days for other posting-limit and session records, 7 days for request-retry records, 30 days for archived reports and moderation-action copies, and 90 days for moderation audit records. API and account-trigger logs have a 7-day retention setting. The private deletion ledger has a 60-day expiry policy; completed deletion/security records are marked for expiry 60 days after cleanup completes. The private Cognito username link remains while the account exists or deletion work is unfinished, then is marked for expiry 60 days after deletion completes. Database expiry, log retention and storage lifecycle rules use background cleanup, so these settings are not guarantees of deletion at an exact time.
Unresolved reports and resolved reports still held in the current review record do not yet have a fixed automatic expiry. Public posts and active account records also remain until removal or account cleanup. Moderation notes are stored as entered; they are not automatically redacted. The owner must settle these retention choices and the treatment of unverified registrations before public accounts open.
Owner review required before registration opens
This notice is prepared for deployment review. The operator must confirm the actual regions, providers, browser storage, retention rules, disabled-backup configuration, deletion completion period, international-transfer terms and contact process before making registration public. Live tests and an owner review are still required; this draft does not confirm that the online forum has been published.
Before launch
The owner must review the final service providers, retention periods, photo handling, cookies and sign-in storage, international transfers and contact process. This draft describes the intended product; it is not a statement that a production service has already been deployed.
Questions: smarttoolfactory@icloud.com.
Read the existing app privacy policy · Community house rules