Privacy policy

This notice describes how Civilized Discourse Construction Kit, Inc., or CDCK for short, collects and uses personal information. This notice also provides information about the legal rights individuals have concerning their personal information and how you can exercise those rights.

Jump to:

• What is CDCK?
• Who is responsible for data collected about me?
• How does CDCK collect data about me as a controller?
• Does CDCK sell my personal information?
• Does CDCK use customer data for training AI models?
• What personal information does CDCK collect as a controller, and why?
• Does CDCK allow third parties to collect and record personal information about online activities on CDCK Websites and Forums?
• Does CDCK use personal information for marketing purposes?
• How can I make choices about data collection?
• Where does CDCK store data about me?
• How long does CDCK store data about me?
• Does CDCK comply with the EU General Data Protection Regulation?
• What are my rights where CDCK processes personal data as a controller?
• How does CDCK safeguard international data transfers after Schrems II?
• Does CDCK comply with the California Consumer Privacy Act and other US state comprehensive privacy laws?
• Where can I access data about me?
• How can I change or erase data about me?
• Does CDCK make automated decisions based on data about me?
• Does CDCK share data about me with others?
• How does CDCK document compliance for forum hosting customers?
• Does CDCK process aggregate or deidentified information?
• How can I contact CDCK about privacy?
• What if this privacy notice changes?

What is CDCK?

CDCK is the company home and primary developer of Discourse, open source software for hosting Internet discussion forums. As a company, CDCK hosts forums using Discourse for businesses, organizations, and individual customers through Enterprise, Business, Pro, Starter, and Free plans. Discourse also provides the following websites and forums:

• meta.discourse.org, a discussion forum about Discourse itself,
• discourse.org, a website marketing Discourse and CDCK’s hosting service,
• id.discourse.com, a website for Discourse ID, a tool that enables login features across all participating Discourse communities,
• blog.discourse.org, CDCK’s blog,
• and rubytalk.org, a mirror of the “Ruby-Talk” mailing list for the Ruby programming language.

We refer to the five sites linked above as the “CDCK Websites and Forums.”

Who is responsible for data collected about me?

CDCK is the responsible party, or controller, for the data we collect and process for our own purposes. For instance, CDCK is responsible for data about our customers’ representatives and forum and account administrators, open source contributors, and visitors to the CDCK Websites and Forums.

Importantly, CDCK sets only its own privacy practices, not the privacy practices of CDCK customers or others who host forums using our open source software. Discourse processes personal data belonging to our customers’ forum users on behalf of and at the direction of those customers, as a processor and service provider. You should ask the administrators of our customers’ forums that you use for information about their privacy practices.

Privacy inquiries or notices you send to CDCK about forums we host at the direction and on behalf of our customers as a processor and service provider will be referred to the appropriate responsible party.

This notice primarily describes CDCK’s personal data processing for its own purposes as a controller and not as a processor and service provider at the direction and on behalf of our customers. We will expressly state where this notice discusses CDCK’s activities as a processor and service provider.

How does CDCK collect data about me as a controller?

CDCK collects data about you as a controller through the CDCK Websites and Forums:

• when you browse CDCK Websites and Forums

• when you create and use an account on CDCK Websites and Forums

• when you post, send private messages, and otherwise participate in a forum that CDCK hosts

• when you sign up for mailing lists and announcements

• when you purchase services from us on your or your company’s behalf

• when you contribute to our open source software

• through cookies, server logs, and other similar technologies

We may also receive data about you, including your name, email address, or other contact information from third parties, including marketing databases and data brokers.

Does CDCK sell my personal information or share it for targeted or to serve behavioral advertising purposes?

We do not sell personal information for money. We may disclose personal information to data brokers and marketing databases for valuable consideration, such as access to additional data. We may also disclose and use personal information for targeted or cross-context behavioral advertising.

Does CDCK use customer data for training AI models?

At Discourse, we believe that community trust is paramount. We do not use customer data to train AI models, nor do we share it with third parties for that purpose. Customer conversations and content belong to the communities that create them, and our role is to protect that trust. Customers always remain in control of their data. Transparency, privacy, and respect for community ownership guide every product decision we make.

What personal information does CDCK collect as a controller, and why?

CDCK automatically collects data about visits CDCK Websites and Forums.

When you visit one of CDCK’s websites or a forum that CDCK hosts, whether you have an account or not, we use cookies, server logs, and other methods to automatically collect data about what pages you visit and when.

CDCK may use data we collect automatically to:

• optimize the forum, so that it’s quick and easy to use

• diagnose and debug technical errors

• defend the forum and CDCK’s websites from abuse and technical attacks

• compile statistics on forum and topic popularity

• compile statistics on the kinds of software and computers visitors use

• perform analytics

• deliver targeted or behavioral advertising

• market our own products and services and inform you about new products and features that we offer, including by contacting our website visitors where we obtain their contact information from a marketing database

CDCK collects CDCK Website and Forum account data.

Many features of forums on CDCK Website and Forums hosts require a forum account. For example, most forums that CDCK hosts require an account to post and reply to topics.

To sign up for a forum account, Discourse requires your name, a user name, and an email address.

CDCK uses your account data to identify you on the forum and to create pages specific to you, such as your profile page. If the forum is public, CDCK publishes your account data according to the forum administrator’s configuration. If the forum is access-restricted, CDCK makes your account data available to everyone who can access the forum, according to the forum administrator’s configuration.

CDCK uses your email address to:

• notify you about posts and other activity on the forum

• reset your password and help keep your account secure

• contact you in special circumstances related to your account

• contact you about legal requests, like DMCA takedown requests

You may provide additional data for your account, like a short biography, your location, or your birthday, on the profile settings page for your account. CDCK makes that data available to others who can access the forum. You don’t have to provide this additional information, and you can erase it at any time.

CDCK stores your account data as long as your account remains open.

CDCK collects customer account data.

When you sign up for a paid plan with CDCK or create an account on Discourse Free, we will collect certain information from you, including your name, email address, and, for paid accounts information we require to process payments, such as your name and credit card information. We use this information to provide the products and services you obtain from us, perform any contract between us, enforce our contractual and legal rights, and prevent fraud and abuse, including by evaluating whether we have previously banned an account, or identified potential fraud or abuse associated with, the email address you provide.

CDCK collects data about posts and other activity on CDCK Websites and Forums.

CDCK collects the content of your posts, plus data about bookmarks, likes, and links you follow in order to share that data with others, through the forum. If the forum is public, CDCK publishes your activity. If the forum is access-restricted, or access restrictions apply to the specific post, CDCK makes your activity available only to users permitted to see it.

CDCK also collects data about private messages that you send through the forum. CDCK makes private messages available to senders and their recipients, and also to forum administrators.

CDCK stores your posts and other activity as long as your account remains open.

CDCK collects data you give through web forms you complete.

CDCK collects information in connection with web forms you fill out and submit. The information CDCK collects may include contact information such as your email address, any information you provide through text fields, drop downs, or radio buttons within the form, and other information relating to your activity on CDCK Websites and Forums that CDCK automatically collects through cookies and similar technologies.

CDCK does not collect sensitive personal information.

CDCK does not intentionally collect or process sensitive personal information as a controller, such as government identification numbers, information on racial or ethnic origin, political opinions, genetic data, biometric data, children’s data, precise geolocation, status as a victim of a crime, financial account information, biological or neural data, the contents of consumer’s mail, email, or text messages for recipients other than Discourse, health data, or any of the other special categories of personal data specified by the GDPR, such as trade union membership.

CDCK collects data about open source contributors.

Contributors to CDCK’s open source software may be asked to provide identifying and contact information such as your name, email address, telephone number, and mailing address. CDCK also collects and stores information concerning your agreement to our contributor license agreement.

CDCK uses this information to maintain the integrity of our software and software licenses, as well as the integrity of the license agreement between CDCK and our contributors. CDCK stores contributor information for as long as related contributions are incorporated into CDCK’s open source software.

CDCK uses cookies, including third-party cookies.

HTTP cookies are small bits of data that websites, like Discourse forums, send to your computer when you visit. When you return to those websites, your computer sends the cookies on your computer back to the website.

Some cookies we use are provided by third parties, which may collect or receive information about your interactions with us.

Discourse.org and id.discourse.com may use these cookies:

Discourse.org may use HubSpot cookies for targeted and behavioral advertising, for obtaining and enriching marketing data, and for forms for mailing list opt-ins or other requests. HubSpot may set the following cookies.

For more information on Google Analytics, including how Google Analytics collects, uses, and discloses information, please refer to www.google.com/policies/privacy/partners.

Google Analytics, Google Tag Manager, or Google AdWords may set the following cookies:

Discourse forums that serve advertisements, such as with the ads plugin, may also set cookies used to track you and serve advertisements.

Does CDCK allow third parties to collect and record personal information about online activities on CDCK Websites and Forums?

Yes, we may allow third parties to use the CDCK Websites and Forums to collect and record personal information about both your activities on the CDCK Websites and Forums and your online activities over time and across different online products, websites, services, and applications. Those third parties may receive the information we collect automatically and use it for measurement services, marketing, advertising, and other purposes on behalf of us, their organization, or their other customers, including delivering targeted or behavioral advertising.

Does CDCK use personal information for marketing purposes?

CDCK may use personal information about visitors to CDCK Websites and Forums, customers, and prospective customers in order to directly market our own services and inform you about new products and features that we offer. We also use the information you give to sign up for our mailing lists and announcements to send those messages.

You can always opt out of marketing communications from us, and you have the right to object to any processing of your information for marketing purposes.

How can I make choices about data collection?

You can make choices about how your account is used on the settings page for your account. When a forum uses access restrictions that vary by category, you can choose who will see your post by choosing the appropriate category.

Most web browsers let you make choices about whether to accept cookies, for specific websites or more generally. aboutcookies.org has instructions for many different web browsers. youronlinechoices.eu and aboutads.info have more information specifically about cookies used for advertising. You can also opt out of Google Analytics by downloading, installing, and enabling the Google Analytics’ Opt-out Browser Add-on, which can be found at tools.google.com/dlpage/gaoptout.

CDCK does not respond to the Do Not Track HTTP header.

You may choose not to provide the personal information we request. However, not providing information we request may restrict your ability to use certain features on CDCK Websites and Forums. For example, you may be able to restrict the collection of personal information through cookies through your device’s operating system, your browser, or by disabling cookies through our cookie banner or Cookie Settings, but doing so may prevent you from using the functionality of the CDCK Websites and Forums.

For information about interest-based advertising, and to opt out of this type of advertising by parties that participate in self-regulatory programs, please visit the Network Advertising Initiative at thenai.org/opt-out and/or YourAdChoices offered by the Digital Advertising Alliance (DAA) Self-Regulatory Program for Online Behavioral Advertising at youradchoices.com. Please note that any opt-out choice you exercise through these programs will apply to interest-based advertising that your opt-out addresses, but will still allow the collection of data for other purposes, including research, analytics, and internal operations. You also may continue to receive advertising, but that advertising may be less relevant to your interests.

You may also use Global Privacy Control (GPC) signals to communicate your preferences with respect to certain third-party cookies on CDCK Websites and Forums. If you do not have an account with us or are not logged into your account, your GPC signal will be linked to your browser identifier only and may not be linked to other personal information, such as account information, about you that we process that is not associated with your browser identifier.

If we receive a GPC signal from you, we may notify you if the GPC signal we receive from you conflicts with your privacy settings or participation in certain programs we offer, and either request that you affirm your intent to withdraw from any relevant programs or consent to continue the processing blocked by your GPC signal.

Where does CDCK store data about me?

Most forums that CDCK hosts store data in CDCK’s data centers and Amazon Web Services S3 in the United States. Some forums that CDCK hosts store data in data centers in other jurisdictions, such as Canada and the European Union. Refer to the Privacy Policy of the forum on which your account exists for detailed information.

How long does CDCK store data about me?

CDCK retains personal information for as long as reasonably necessary to carry out the purposes described in this privacy policy, unless applicable law requires us to do otherwise.

Does CDCK comply with the EU General Data Protection Regulation?

CDCK respects privacy rights under Regulation (EU) 2016/679, the European Union’s General Data Protection Regulation (GDPR). Information that GDPR requires CDCK to give can be found throughout this privacy notice, including information on the rights of data subjects.

What are my rights where CDCK processes personal data as a controller?

Depending on the laws of the jurisdiction where you reside or are located, you may have certain rights with respect to controllers of your personal data. We have described those rights generally, without noting all applicable or potentially applicable limitations or exceptions. Those rights are provided by laws that may not apply to CDCK, CDCK personal data processing, or personal data CDCK processes.

Rights that may be provided by law, depending on the jurisdiction where you reside or are located, may include:

• the right to access your personal data

• the right to confirm we process your personal data

• the right to correct or rectify inaccurate or incomplete personal data

• the right to deletion or erasure of your personal data

• the right to data portability

• the right to restrict the processing of your personal data

• the right to opt out of exchanges of personal data for money or other valuable consideration

• the right to opt out of use or disclosure of your personal data for targeted or cross-context behavioral advertising

• the right to obtain information about disclosures of your personal data to third parties

• the right to withdraw consent to the extent we rely on consent to process your personal data

• the right to object to certain processing of your information

• the right to lodge a complaint with a supervisory authority

• the right to appeal our initial decision with respect to a request to exercise these rights

You can make a request to exercise these rights by emailing us. You may also be able to exercise some of these rights through GPC or by adjusting your Cookie Settings. You can appeal an initial decision by responding to the communication of the initial decision or by emailing us.

When you make a request, we may provide more detailed information regarding any legal requirements applicable to your request, including whether we are legally required to respond and whether any exception or limitation applies. We may also request information to verify your identity and authenticate your request, including your name, email address, phone number, or other information that may allow us to verify your identity and authenticate your request.

You may be able to authorize another person to request to exercise your rights on your behalf, including GPC as described in the How can I make choices about data collection? section above.

How does CDCK safeguard international data transfers after Schrems II?

CDCK relies on the European Commission’s standard contractual clauses for international transfers(SCCs) to legally transfer personal data out of the European Economic Area. Because national security and surveillance laws may be in conflict with European data protection rules, CDCK continually reassesses the practical reach of these laws to ensure our data transfers are adequately safeguarded.

Currently:

• CDCK processes personal data on servers located outside the European Union.

• CDCK uses subprocessors with personnel and computers outside the European Union.

• CDCK has personnel in the United States, Australia, and other non-EU countries without EU adequacy decisions under GDPR. These people need access to forum personal data in order to keep forums running, address security concerns, respond to privacy-related requests from users, field technical support requests, and otherwise assist customers.

• CDCK no longer participates in Privacy Shield, following its invalidation as an adequate safeguard for EU-US data transfers.

• CDCK’s standard data processing addendum incorporates the standard contractual clauses.

• CDCK is very likely subject to section 702 of the Foreign Intelligence Surveillance Act in the United States, a law that the European Court of Justice has found inadequately protects the rights and freedoms of data subjects.

• CDCK has never received any order or request for personal data under FISA 702 or any similar national security or surveillance law of any other country. CDCK is not subject to any court order or legal obligation that would prevent it from disclosing the existence or non-existence of such an order or request.

• CDCK has adopted a policy for how we will respond to those orders and requests, in case we ever receive one. CDCK will suspend processing, notify any customer for forums we host for others, minimize disclosure, and resist disclosure of personal data, all as the law allows.

Does CDCK comply with the California Consumer Privacy Act and other US state comprehensive privacy laws?

CDCK is not presently a “business” for the purposes of the California Consumer Privacy Act (CCPA) or a “controller” directly subject to other US state comprehensive privacy laws. But we may act as a service provider for CCPA “businesses” or as a processor for “controllers” subject to other US state comprehensive privacy laws when we host forums on behalf of customers. We offer standard data processing terms for customers who are CCPA “businesses” or “controllers” subject to other US state comprehensive privacy laws.

Where we process personal information for our customers, CDCK complies with its obligations as a service provider under the CCPA and as a processor under other US state comprehensive privacy laws.

If we process your personal information on behalf of one of our customers and you would like to make a related inquiry or exercise choices that customer may provide, please contact the customer that you interact with directly. Information on features that our customers may offer, depending on their settings, with respect to your personal information — such as accessing personal information, requesting disclosure about information CDCK collects, and requesting deletion of your personal information — can be found throughout this privacy notice.

Where can I access data about me?

You can see your account data at any time by visiting your account page on the forum. Your account page also lists your posts and other activity on the forum.

Your account activity page also includes a link to download all of your activity in standard comma-separated values format.

If you do not have account with us but have a data access request, please contact us.

How can I change or erase data about me?

You can change your account data at any time by visiting the profile settings page for your account. The settings for a particular forum may also allow you to close your account, on the settings page for your account. Closing your account starts a process of erasing or anonymizing CDCK’s records of data you provided for your account. Forum administrators can also erase and anonymize accounts.

Depending on the settings for your particular forum, you may also be able to edit, anonymize, or erase your posts. When you edit posts, CDCK will keep all versions of your posts. Forum administrators can view old versions of posts, and optionally make them visible to other forum visitors.

Does CDCK automatically process personal data about me?

CDCK offers software features (as a processor) to its customers and others who host forums using our open source software (as controllers) that may engage in automated processing of personal and other forum and user data. Whether these features are available and enabled, and how they are used by forums, may vary depending on how forum administrators configure the forum and which plan and software version the forum uses. Below we provide examples of potential automated processing features and activities CDCK may offer or perform as a processor on behalf of its customers acting as controllers.

Classifying posts as spam automatically.

CDCK uses data about posts and other activity on forums to automatically flag posts as spam.

If you think a post has been wrongly blocked or removed, contact an administrator of your forum. They can override the decision that a post was spam.

Setting trust levels automatically based on data about posts and activity by default.

Depending on how administrators of your forum configure the forum, the forum may use data about your posts and activity to award you badges and calculate a trust level for your account. Your trust level may affect how you can participate in the forum, such as whether you can upload images, as well as give you access to moderation and management powers in the forum. Your trust level therefore reflects forum administrators’ confidence in you, and their willingness to delegate community management functions, like moderation.

If you think your trust level has been set incorrectly, contact an administrator of your forum. They can manually adjust the trust level of your account.

Hiding posts and silencing users automatically based on community flags.

Depending on how administrators of your forum configure the forum, your posts may be automatically hidden, or your ability to post automatically suspended, as a result of your posts being flagged by other users. Contact an administrator of your forum if you experience issues with your ability to post or with your posts being hidden.

Automatically analyzing forum posts to identify illegal, fraudulent, or other inappropriate content.

Depending on how forum administrators configure the forum and which plan and software version the forum uses, CDCK software features may analyze forum activity to identify content relating to potential illegal, fraudulent, and other inappropriate activity, including abuse, harassment, malware distribution, phishing, and other social engineering scams. CDCK may also create aggregate and/or deidentified data regarding these activities as a component of providing these software features to CDCK customers and other forum hosts or sponsors.

An administrator of your forum may act on posts or forum users CDCK software features automatically flag as potentially relating to illegal, fraudulent, or other inappropriate activity, including hiding posts or blocking users from posting. Contact an administrator of your forum if you have questions about your forum’s approach to illegal, fraudulent, or other inappropriate content.

Does CDCK share data about me with others?

CDCK shares account data with others as mentioned in the section about account data.

CDCK shares data about your posts and other forum activity with others as mentioned in the section about forum data.

CDCK may share data about you and your website interactions collected through cookies with third party providers of those cookies, marketing databases, and data brokers described in the cookies usage section above.

CDCK uses the subprocessors listed on our subprocessors page when providing forums on behalf of our customers. We may also share personal data with third parties and the service providers we use in order to transact with customers, host our website, deliver content, secure our services, store data, host and manage our open source project, market our services, and provide customer support. These service providers include:

• Akismet, for spam filtering
• Amazon Web Services, for storage
• GitHub, for open source development
• Google, for storage, analytics, and targeted and behavioral advertising
• HubSpot for targeted and behavioral advertising and obtaining and enriching marketing data
• Plausible, for anonymous, aggregate website analytics

How does CDCK document compliance as a processor and service provider customers?

CDCK provides a standard data processing addendum. The addendum incorporates the non-EU/non-EEA processor standard contractual clauses of Commission Decision 2010/87/EU for any regulated transfers. We also maintain a transfer impact whitepaper for enterprise customers.

Does CDCK process aggregate or deidentified information?

CDCK may receive, create, use, and process aggregate and/or deidentified information that does not constitute personal information, including from users of forums belonging to CDCK customers or others who host forums using our open source software. We will maintain and use deidentified information in deidentified form and will not attempt to reidentify such deidentified information except to the extent permitted under applicable law. We process personal information as described in this notice.

How can I contact CDCK about privacy?

You can send questions, requests, and complaints via email to privacy@discourse.org.

European Users with questions or complaints about GDPR compliance can also contact CDCK via mail to:

Civilized Discourse Construction Kit, Inc.
ATTN: GDPR Inquiry
Vijzelstraat 68
1017HL Amsterdam
The Netherlands

For complaints under GDPR, European Union users may lodge complaints with their local data protection supervisory authorities.

How can I find out about changes?

This version of CDCK’s privacy questions and answers took effect August 5, 2026.

CDCK will post the next version at https://meta.discourse.org/privacy. CDCK may change how it announces changes in future versions.

In the meantime, CDCK may update its contact information without announcing a change. Please refer to https://meta.discourse.org/privacy for the latest contact information at any time.