COMMUNITY INFORMATION

Private identity. Public conversations.

These notes describe the current local beta. Anyone who can reach this server can read shared threads, images, and replies. Discord login is required to post; your Discord name is not shown publicly.

Who runs Lurk6?

Operator: Not configured for public launch yet.
Contact and data requests: A public contact email has not been configured yet.
Business address: Not configured for public launch yet.

This is a local beta. Operator details are incomplete. A working public contact channel and the applicable operator disclosures must be in place before public launch.

Loading operator contact…

Discord login and public IDs

Login requests Discord’s identify permission without email or server-list access. The server derives a keyed pseudonymous account identifier from your Discord ID. It does not save your raw Discord ID, username, avatar, email, or Discord access and refresh tokens. Discord processes the login under its own policies.

New posts use your account identifier for per-thread public IDs, OP badges, posting limits, and account restrictions. Public IDs differ between threads, but the operator can associate activity internally. Pseudonymous identifiers are not a promise of anonymity. Old anonymous posts retain their browser identity and are not automatically assigned to your Discord account.

What the server stores and why

Post and reply text, image attachments, timestamps, pseudonymous authors, and links between discussions and Lurk6 analyses to provide shared discussions.
Account-linked followed threads and read markers to sync your inbox across devices. The inbox includes conversations you started, joined or followed.
Reports, posting restrictions, and moderation logs to handle abuse and review decisions.
Internal advertising-review decisions to control eligibility for a future ad integration.
Hashed login tokens, temporary OAuth state, short-lived posting counters, and duplicate-submit records to operate login and posting protections.

If configured behind a trusted proxy, posting limits can use a keyed hash of a network address. The application does not save the raw network address in its database. Hosting providers can keep their own connection logs; their retention and processing must be documented for the eventual deployment.

Cookies and browser-only data

A seven-day HTTP-only login cookie identifies your current session; the database stores its keyed hash. Logout invalidates that session on the server. A separate reader cookie lasts up to a year and supports reports and legacy identities. OAuth state cookies last up to ten minutes.

Guest follows and read markers, drafts and prepared draft attachments, plus your old private archive, stay in browser storage. Signed-in follows and read markers are stored on your account. Guest follows are only copied to your account if you choose Import browser follows in your inbox. The archive is never uploaded automatically. Successful posting clears its draft. Other local data remains until you remove it or the browser clears it. See Cookies & advertising for the full storage overview.

Retention in this beta

Login sessions expire after seven days; expired database session records are cleaned when a new login starts. Login attempts expire after ten minutes; expired state records are cleaned when a new login starts. Posting counters expire according to their posting limit. Expired counters and duplicate-submit records older than seven days are cleaned during successful posting.

Shared content, reports, moderation records, posting restrictions, ad reviews, and account follows/read markers currently have no automatic deletion schedule. Unfollowing clears the follow selection but retains the read marker. Hidden content stays in the database for review and restoration. Permanent deletion and backup expiry require separate operator handling. A documented retention schedule and the deployment’s processing arrangements must be finalised before public launch.

Images

New uploads are resized and re-encoded, stripping original embedded camera and location metadata. Older uploads from before that feature are not modified. Details visible in the image itself remain visible. Do not upload private information or material you do not have the right to share.

Linked YouTube videos

A supported YouTube link can show a play card in the feed or a thread. No YouTube frame or thumbnail is requested until you press Play. The player then connects to youtube-nocookie.com and YouTube’s services; those services receive connection information and apply their own privacy practices. The privacy-enhanced player is not a promise of anonymous viewing. You can open the original link instead. Spoiler media stays behind the spoiler gate.

Requests about your information

Use Contact to ask about access, corrections, deletion, or a moderation review. Include relevant post links. The operator may need to verify the request before acting; never send passwords or authentication tokens. Clearing cookies, logging out, or removing Discord authorization does not delete shared content.

Optional traffic experiment

When enabled by the host, Lurk6 counts page views after one visible second, 30 seconds of visible reading time, discussion-button clicks, and successful link copies on the public feed, shared threads, analysis index and current articles. Only daily totals by page, event and an allowlisted campaign label are stored, for 30 days. No analytics cookies, browser-storage identifiers, IP addresses, full referrer URLs or account identifiers are stored with these counts. Do Not Track and Global Privacy Control signals are respected. Unlocking the moderator desk saves a local preference to exclude that browser’s future traffic events. The preference is an on/off value, is not sent to the server, and can be changed in the traffic report. It applies only to that browser profile and remains until changed or site storage is cleared. Existing anonymous counts cannot be separated by owner afterward. Counts do not measure unique visitors or returning readers. Hosting connection logs are separate from these application counters.

Advertising and third parties

No advertising or third-party analytics scripts are installed in this beta. An internal advertising review is not approval from Google. Advertising disclosures and applicable consent controls must be configured before any future advertising integration. External sites have their own privacy practices when you visit them.

Public launch is still being prepared

These are factual beta data notes, not a completed deployment-specific privacy notice. The operator still needs to finalise its identity and contact details, applicable processing purposes and legal bases, retention, service providers and transfers, and the relevant information about individual rights and complaints before inviting the public.