What this site keeps about you
Spencer Online is a community site that ran from 2000 to 2007 and is running again. It is one server and one SQLite file. It loads nothing from anyone else's machine, has no analytics, no tracking pixels and no advertising, and it sets one cookie: the session cookie you get when you log in. That is why there is no cookie banner.
The old archive
Everything posted publicly between 2000 and 2007 is here because it was published then and is being republished now, under legitimate interest (Art. 6(1)(f)) with the archiving provisions of Art. 89. If you wrote something here twenty-five years ago and want it handled differently, see Getting yourself out below.
Two things were left out on purpose when the archive was rebuilt: the 2002–2007 visit log, which held 141,693 records with 28,554 IP addresses and 28,149 hostnames in it, and the referrer table. Both are gone from anything this site can read.
Private mail between members is not published. It is visible only to the person who sent it and the person who received it, once those accounts are back in their owners' hands.
If you have an account
The account holds a username, an e-mail address, a real name if you gave one, and a password stored as an argon2id hash. The e-mail address is used for password links and for notices about your own account, and nothing else. When you applied you wrote a few sentences about why; that is kept with the application.
Sessions are stored as a SHA-256 of the token, so the database cannot be read to log in as you.
Addresses
No visitor's IP address is written down anywhere. Rate limiting needs to be able to tell one flood from one visitor, so it uses a hash of the network prefix (/24 or /48) under a salt that changes every day and never leaves memory. It is not an address, it cannot be turned back into one, and yesterday's is not comparable to today's. There is no access log with addresses in it.
Chat
There is no chat here yet. When it comes back, messages will be deleted after twenty-four hours.
Getting yourself out
Logged in, you can download everything tied to your account as one JSON file, and delete the account. Deleting replaces your name on old posts with something like medlem-1a2b and removes the account, the address and the name.
The posts themselves stay, because a 2002 post sits inside a thread and removing it stops the reply below it making sense. If you want them gone as well, write and say so: they can be blanked to a marker that keeps the thread's shape, or removed outright. Both are done, on request, after a short conversation about what it will break.
Writing to us
Access, correction, erasure, objection, or anything else: write to weinholt, or use the address in the site footer. An answer within thirty days, usually much sooner. If it goes wrong you can complain to the Swedish authority, Integritetsskyddsmyndigheten (imy.se).
