Privacy policy
Effective date: August 24, 2026
Registration and sign-in
MassVLC collects the email address, public display name, and password you submit to create and operate your forum account. Your email address is used for sign-in, verification, recovery, and account administration. It is not displayed on posts or sold.
Passwords are processed with PHP’s adaptive password_hash function. The database stores only the resulting password hash, not the readable password. Registration verification and password recovery messages contain a one-time link that expires after 20 minutes. Raw link tokens are not stored in the database; only one-way SHA-256 hashes are stored.
For abuse prevention, the forum applies short request limits using keyed, one-way representations of submitted email addresses and requesting IP addresses. Those keyed values cannot be used by forum administrators to read the original address, and old rate-limit and token records are periodically removed.
Forum activity
Discussion titles, posts, dates, reports, account mute status, and moderation records are stored in the forum database. Forum posts are visible to signed-in members. Administrators can view member email addresses only for account administration, abuse prevention, and support. Do not include private or sensitive personal information in a post.
Private research and transcript corrections
Collections, bookmarks, personal notes, tags, and saved searches are stored for your account and are not published to other members. Administrators can access the database when reasonably necessary for security, support, backup, or legal compliance, but the ordinary website interfaces do not provide administrators with a member’s private workspace.
Transcript correction reports, their proposed wording, explanations, source links, review status, and administrator responses are stored so the archive can verify and document changes. A correction is visible to its reporter and administrators. Security audit events record the account, type of change, affected record number, and date, but do not copy the private note or search text into the audit record.
Questions and website ideas
The optional question-and-idea box emails the text you submit, your display name, your verified account email address, your internal member number, and the submission time to the MassVLC administrator. This lets the administrator understand the request and reply. The message is not added to the website database or published to other members, but a copy remains in the administrator’s email mailbox until it is deleted under normal mailbox-management practices. Deleting your website account does not automatically delete that email copy; contact the privacy address below if you want to request its deletion.
Cookies, email delivery, and security
A secure, HTTP-only session cookie keeps you signed in, remembers whether the optional question box was dismissed for that login, and supports request-forgery protection. If selected at sign-in, a separate secure trusted-browser cookie can restore your sign-in for up to 30 days. Its random token is stored only as a one-way SHA-256 hash and is removed when you sign out, reset your password, revoke trusted browsers, or delete your account. Hostinger email service and the bundled PHPMailer library deliver verification, recovery, and question-box messages. The forum does not include advertising trackers.
Retention and deletion
You may delete your account from the account page. Deletion removes the email address, display name, account record, private collections, bookmarks, personal notes, tags, and saved searches. Existing posts are detached from the account and shown as authored by “Deleted account” to preserve discussion context. Submitted correction reports and their decision history are similarly detached from the account and retained as archive-quality records.
Completed deletion confirmations and a keyed, one-way email hash are retained to document fulfillment without retaining the email address itself. If an account is temporarily muted when it is deleted, the restriction end time is retained with that digest and reapplied if the same email address registers again before the mute expires. Outstanding verification and recovery links are removed during deletion. Reports, correction decisions, moderation records, and security audit events are retained as needed to protect the forum, preserve source-integrity history, and comply with legal obligations; references to the deleted account are anonymized by the database.
Contact
Privacy or deletion questions may be sent to privacy@massvlc.com.