1. About this notice
This notice adds to our privacy policy for people who use Fluxer Feedback, our site for bug reports and feature requests. It also applies to you if something you wrote on GitHub or sent to our old bug report bot was copied to the site. Fluxer Platform AB is the controller of this data, as section 1 of the privacy policy explains.
The privacy policy also explains how to contact us, our legal bases, where data is kept and how it is transferred, how we protect it, your rights and how we make changes. Everything it says on these topics applies to this notice as well.
2. Signing in
You sign in to Fluxer Feedback with your Fluxer account, and the site asks Fluxer only for your basic account details. It keeps your Fluxer ID, username, display name and avatar, and updates them each time you sign in. It also keeps whether your account belongs to Fluxer staff and whether Fluxer has flagged it for spam.
The site works out the age of your Fluxer account from your Fluxer ID. You can vote once your account is 7 days old, posts from new accounts may wait for review, and moderators and reviewers see the age next to reports and held posts.
When you sign in, the site sends your IP address to Fluxer, which handles it as section 2.2 of the privacy policy describes. The site uses the access that Fluxer gives it only once, to get your account details, and it doesn't keep that access.
A sign-in session lasts 30 days and keeps the user agent string of your browser. If you use the site's API, each access token expires after at most 30 days.
3. What you post
Fluxer Feedback keeps the bug reports, feature requests, comments and files you post, together with every edit you make to them. It also keeps your votes, the posts you follow or mute, which posts you have read and your settings.
When you report a bug or reproduce one, the site keeps the platform, build and steps that you give it. The build field starts with the name of your browser and operating system already filled in, and you can change it before you post.
Before the site stores a file you upload, it removes metadata such as the location in a photo. If you mention someone by their username, they get a notification on the site, and notifications show who acted and quote what they wrote.
If you link your GitHub account by posting a gist, the site keeps your GitHub username and ID and shows them on your profile. Our server checks the gist on GitHub.
Accepted repros earn XP, and reviewers can offer extra XP as a repro bounty on a bug that nobody has been able to reproduce yet. XP is a points system with no monetary value, and it can't be exchanged for anything or turned into money.
Report security issues through our security page, not on Fluxer Feedback.
Keeping this data rests on contract necessity (section 3.1 of the privacy policy), because we need it to run Fluxer Feedback, the site that you chose to use.
4. Who can see it
Anyone can see your approved posts and comments, their edit history and files without signing in, and search engines can index them. Your profile shows everyone your name, username, avatar, the date you joined the site, any staff, moderator or reviewer badge, your posts, comments, accepted repros, XP and linked GitHub account.
Only you can see which posts you voted for, and other people see only the number of votes on each post. Posts that wait for review are visible only to you and to the moderators and reviewers who handle them until they are approved.
Moderators look after the site, and some of them are Fluxer staff while others are members of the community. They can see deleted and hidden posts and comments, reports and who filed them, the notes that moderators keep about accounts, and strikes. The person you report never sees that you reported them.
Moderator and reviewer actions are listed in the public moderation log with who acted and which account or post it was about. Only moderators can see the reasons for bans, role changes, removals and erasures of content, rejections and private reports.
Moderating the site and being open about it rest on our legitimate interests (section 3.1 of the privacy policy), and you can object as section 10 describes.
5. Alerts in Fluxer
Fluxer Feedback posts alerts about new posts, comments, status changes and repro bounties to channels in our Fluxer Labs community. An alert in a public channel shows the author's name, avatar and profile link with the post title and a short excerpt.
Alerts in channels for moderators and reviewers also show posts and comments waiting for review, reports with their reason and the reported text, how old the author's Fluxer account is and what moderators did. Alerts in channels for moderators also show who filed each report and the note that the reporter wrote with it.
An alert about you can mention you so Fluxer notifies you. This is on by default, and you can turn each kind of mention off under "Mentions in Fluxer" in your settings.
We keep a log of sent alerts for 30 days. Alerts that were already posted in Fluxer stay there when a post or an account on Fluxer Feedback is deleted. To have one removed, ask us through the privacy route on our company information page. Alerts rest on our legitimate interest in keeping our community up to date on bugs and requests.
6. Content copied to the site
We copied issues, discussions, pull requests and comments from Fluxer's GitHub repositories to Fluxer Feedback, with the files attached to them. Each copy shows its author's GitHub username and links to the original, and the site keeps the author's GitHub ID and the number of thumbs-up reactions it had.
The site keeps checking our GitHub repositories for new releases and pull requests, and it shows the GitHub username of each pull request's author. If you wrote something on GitHub that was copied, you can claim it by linking your GitHub account.
We also copied the reports sent to the bug report bot we used in Fluxer before Fluxer Feedback existed. They include the steps, settings and files in each report, the decisions made on it and the Fluxer messages it came from.
If someone sent reports to the bot but has never signed in to the site, their profile shows the Fluxer username and avatar they had when we copied the reports. If their Fluxer account was already deleted by then, it shows "Deleted User" instead.
Copying this content rests on our legitimate interest in keeping the history of our bugs and requests in one place. To have copied content about you removed, or to object to the copying, use the privacy route on our company information page.
7. Requests and IP addresses
Fluxer Feedback doesn't store IP addresses in its database. Our edge servers and the servers that run the site log each request with your IP address, the page and the response. When you are signed in, the site's own log also notes your account.
No request log is kept longer than the security and usage logs in section 7.4 of the privacy policy. To limit abuse, the site also counts requests by IP address, network and account in memory, and forgets those counts within 6 hours. Request logs and these limits rest on our legitimate interest in keeping the site secure and working.
Our edge servers may keep a copy of a public page, and of the preview image for a shared link, as visitors who aren't signed in see them. A copy of a page expires within an hour and a copy of a preview image within 7 days. Pages that signed-in visitors see are never kept. When a post or comment is deleted or hidden, its copies are usually cleared within seconds, and if that fails they still expire at those times.
The site loads no third-party scripts, fonts or analytics, and pages load images only from the site and Fluxer's own servers. To draw the preview images for shared links, our server gets GitHub avatars from GitHub, and GitHub never sees your request.
Fluxer Feedback uses these cookies. Each one is needed for the site to work or remembers a setting you chose, and none of them tracks you.
| Cookie | What it does | How long it lasts |
|---|---|---|
__Host-bugs_session |
Keeps you signed in | 30 days |
__Host-bugs_csrf |
Protects sign-in and forms from forged requests | 1 year |
bugs_oauth |
Keeps track of a sign-in that is in progress | 10 minutes |
__Host-flash |
Shows a one-time message after an action | 60 seconds |
__Host-theme, __Host-width, __Host-tz, __Host-lang |
Remember the theme, page width, time zone and language you chose | 5 years |
While you submit a post, the site keeps the page and form you were on in your browser's session storage, which your browser clears when you close the tab.
9. How long we keep it
We keep these for a fixed time.
- Files you upload but never post are deleted after 24 hours.
- Which posts you have read is deleted after 365 days.
- After you delete your account, the site keeps your Fluxer ID with your moderation records for 30 days so that bans and holds still apply if you come back. A strike from those 30 days that wasn't lifted keeps your Fluxer ID with no time limit.
- A ban keeps the banned Fluxer ID until the ban is lifted.
Posts, comments, edit history, reports, notifications and XP have no fixed time limit, and we keep them until they are deleted as section 10 describes.
The moderation log, strikes and moderators' notes are our record of moderation decisions, and we keep them after an account is deleted. They no longer show the account's name. A record of a linked GitHub account still has its GitHub username and ID, and a ban made before someone first signed in still has their Fluxer ID.
Encrypted backup copies of the site follow section 7.3 of the privacy policy.
10. Deleting and downloading your data
"Download your data" in your settings gives you a file with your profile, settings, posts, comments and linked GitHub account. It also has details of your files, edits waiting for review, your suggestions, the posts you follow and the posts you voted for.
For a copy of anything else that we keep about you, such as your XP, repros or edit history, use the privacy route on our company information page.
When you or a moderator delete a post or comment, it disappears from the site, but moderators can still see it and restore it. To have it erased with its edit history and files, ask us through the privacy route on our company information page.
"Delete account" in your settings removes your name and avatar from the site, removes your Fluxer ID except as section 9 describes, and signs you out everywhere. It also deletes your votes, follows, notifications, the reports you filed, your suggestions, your edits that are waiting for review and your linked GitHub account.
Your posts and comments stay on the site with their text, files and edit history, but without your name. If you check "Also erase everything I posted", they are erased with their edit history and files. A banned account can't check this box, and you can always ask us to erase your content through the privacy route instead.
Deleting your Fluxer account doesn't delete your Fluxer Feedback account or what you posted there. Delete your Fluxer Feedback account first, because once your Fluxer account is deleted you can't sign in to the site, and after that you can ask us to delete it through the privacy route on our company information page.