Privacy
What bit collects, how it's stored, and what it doesn't do. No legal boilerplate — just the technical reality.
What We Collect
Email Address
Used for account recovery and opt-in notifications. Never displayed on public feeds or profiles.
Password
Stored as a bcrypt hash. The plaintext password is never stored or logged.
Username
A pseudonymous handle you choose. This is publicly visible on your posts, comments, and profile.
Optional Profile Fields
Bio, professional domain, sector, and location are entirely optional. When your profile is set to private, these are hidden from public views.
Certification Proofs
Submitted only if you opt into verification badges. Scrubbed permanently on account deletion.
Compensation & Reviews
Salary, bonus, and equity details are stored internally. Public compensation views expose aggregate statistics and de-identified summaries only when the privacy threshold is met (minimum 3 contributors). Public company and vendor review pages can show de-identified ratings and review text; review authors are not displayed.
Work Email (Company Verification)
If you verify a company affiliation, the application stores only a keyed HMAC-SHA256 digest of your work email, not the plaintext address. The address is processed by the configured mail service to deliver the verification code and is not written to the application database.
Network Metadata
Client IP is processed in memory for rate limiting and abuse prevention. Anonymous post-view deduplication stores only an HMAC-derived opaque key from the client address, post ID, and a coarse time bucket; User-Agent is intentionally excluded, and raw IP is not stored there. Explicitly enabled diagnostic logging may temporarily include IP, user-agent, and pseudonymous handle values; default privacy logging omits them.
What We Don't Collect
There are no third-party scripts, analytics, tracking pixels, advertising cookies, external CDNs, or web fonts on this site. Real names and phone numbers are never requested.
Cookies
session_id
Authentication session. HttpOnly, Secure in production, SameSite=Lax. Expires after up to 30 days.
csrf_token
Cross-site request forgery protection. Secure in production, SameSite=Lax.
No third-party cookies. No tracking cookies.
How Data Is Protected
Application-Layer Isolation
Public pages and API responses are generated from Data Transfer Objects that physically cannot contain email addresses, password hashes, IP addresses, or moderation state. This is enforced at compile time, not by convention.
Transport Security
TLS 1.2+ on all connections with automatic certificate management. SMTP submission over STARTTLS.
Encryption at Rest
Direct messages use AES-256-GCM with per-message random nonces. Backups use AES-256-GCM with scrypt-derived keys. This does not mean the entire SQLite database is encrypted as a whole.
Security Headers
Strict Content Security Policy (no unsafe-inline, no unsafe-eval, nonce-based scripts), X-Frame-Options: DENY, HSTS when enabled in the production configuration, and strict-origin-when-cross-origin referrer policy.
Logging
Default privacy-mode logs record normalized route patterns and numeric identifiers. Passwords, tokens, session values, verification proofs, email bodies, and request bodies are never logged. An explicitly enabled, bounded diagnostic mode may temporarily include raw IP addresses, user-agent values, and handles. The platform retains a temporary audit log that is pruned automatically.
Account Deletion
Self-service. Requires your current password and typing "DELETE" as confirmation.
What gets scrubbed?
Username is replaced with an anonymous tombstone handle. Email is overwritten with an invalid placeholder. Password hash is destroyed. Bio, professional domain, sector, and location are cleared. Sessions, password-reset tokens, magic-link tokens, credentials, flairs, notifications, votes, follows, and blocks are permanently deleted.
What's preserved?
Your authored posts and comments remain visible under the anonymous tombstone handle to preserve discussion thread integrity. The current flow is not a hard delete of every user-linked record: company verification data, compensation entries and proof paths, company/vendor reviews, direct-message history, bookmarks, abuse reports, and audit records may be retained for service integrity, moderation, or security purposes. No personal metadata, flairs, or credentials remain attached to the retained authored posts and comments.
Third-Party Services
Hosting provider
Server infrastructure on a single VPS. The hosting provider has physical access to the server by nature of hosting.
Self-hosted mail server
Transactional email (account recovery, notifications) is handled by a self-hosted mail server. Recipient email address is shared for delivery.
TLS certificate issuance
Automatic certificate management via ACME protocol. Only the domain name is shared.
No data is shared with analytics providers, advertising networks, or data brokers.
Pseudonymity Is Not Anonymity
A pseudonymous handle protects you from casual identification. It does not protect you from contextual re-identification.
What This Means
If you describe a distinctive incident, post compensation data from a small team, review your employer with specific operational details, or develop a recognizable writing style — someone with context may be able to identify you. This is an inherent property of pseudonymous communication, not a limitation of bit's engineering.
Recommendations
Generalize incident details. Be aware that compensation + role + location + experience tier can narrow a population to single digits. Consider that your writing style and opinions form a cumulative fingerprint. Review your post history periodically with an adversary's eye.