Data Handling

Data Handling

Last updated: September 17, 2026

This document explains SourceBoard's operational principles for handling service data.

It supplements the Privacy Policy and focuses on how different categories of information are separated, retained, accessed, removed, and protected.

1. Data categories

SourceBoard may process several broad categories of data:

• account data;
• profile data;
• public posts and comments;
• restricted-visibility content;
• uploaded media;
• source-resolution records;
• moderation and report information;
• security information;
• social relationships;
• points, Store, reputation, achievement, and entitlement records;
• support and legal requests; and
• operational logs.

These categories may have different access rules and retention needs.

2. Public and private boundaries

Public content is intended to be available to viewers according to its visibility.

Private account data is not treated as public merely because it is associated with a public profile.

SourceBoard separates the public presentation of content from internal account, security, moderation, and operational information.

3. Restricted content

Where SourceBoard supports private, friends-only, blocked, hidden, removed, or otherwise restricted content, access controls continue to apply even if related public metadata exists elsewhere.

A public username does not make all content associated with that account public.

4. Media

Uploaded images and other eligible media may be processed for:

• storage;
• display;
• resizing;
• previews;
• safety review;
• access control;
• delivery; and
• removal.

SourceBoard should avoid intentionally turning private media into publicly enumerable resources.

5. Source-resolution records

Accepted Source and Verified Source actions may require durable history because provenance can change over time.

SourceBoard may retain:

• the status;
• relevant source reference;
• evidence summary;
• timestamps;
• reviewer or action identity where appropriate;
• revocation or dispute history; and
• internal audit information.

This history supports transparency, integrity, moderation, and dispute review.

6. Moderation and audit information

Not all moderation information is public.

SourceBoard may retain internal information about:

• reports;
• sanctions;
• appeals;
• account actions;
• source-integrity actions;
• administrative changes;
• security incidents; and
• reasons for sensitive decisions.

Access to this information should be limited to people or systems with a legitimate need.

7. Points and transaction integrity

Points and Store activity may require historical records so that SourceBoard can:

• prevent duplicate rewards;
• reverse ineligible rewards;
• correct errors;
• review abuse;
• preserve purchase history; and
• calculate balances consistently.

Deleting an account does not necessarily require deletion of every transaction-like record if doing so would undermine integrity or abuse prevention.

8. Data minimization

SourceBoard should avoid collecting information that is not reasonably useful for operating, securing, improving, or governing the Service.

Where a feature can function without collecting a sensitive category of information, SourceBoard should prefer the less intrusive approach.

9. Access controls

Access to non-public information should be limited according to role and purpose.

Administrative access should not imply unrestricted access to all user information.

Sensitive actions may be logged or audited.

10. Retention

Retention depends on purpose.

SourceBoard may retain information longer where necessary for:

• account operation;
• fraud prevention;
• security;
• abuse investigations;
• moderation history;
• source provenance;
• dispute resolution;
• transaction integrity;
• backups;
• legal obligations; or
• protection of users and third parties.

11. Deletion

Deletion may involve one or more of the following:

• removing public content;
• revoking access;
• anonymizing identifiers;
• deleting account-level personal information;
• expiring sessions;
• removing media;
• retaining limited integrity or safety records; and
• allowing backup copies to age out according to retention practices.

12. Backups and recovery

SourceBoard may maintain backups or recovery mechanisms to protect against corruption, accidental deletion, operational failure, or security incidents.

Deleting live data may not immediately remove all backup copies.

Backup data should remain subject to access and security controls and should not be restored for ordinary use after a valid deletion except where necessary for recovery and then re-deleted as appropriate.

13. Security incidents

SourceBoard may preserve relevant logs, records, or content when investigating a suspected security incident.

Incident handling may include:

• containment;
• access restriction;
• evidence preservation;
• credential invalidation;
• user notification where appropriate;
• remediation; and
• post-incident review.

14. Service providers

SourceBoard may use third-party providers to process data for infrastructure, delivery, authentication, storage, security, communications, or related functions.

Providers should receive only the access reasonably necessary for their role.

15. Legal preservation

SourceBoard may temporarily preserve information that would otherwise be deleted when reasonably necessary to comply with a valid legal obligation, resolve a dispute, investigate abuse, or protect users.

16. Public copies outside SourceBoard

Deleting public content from SourceBoard cannot guarantee deletion of independent copies already made by:

• search engines;
• web archives;
• journalists;
• researchers;
• other users;
• automated systems; or
• third-party services.

SourceBoard can control its own Service, not every external copy.

17. Relationship to the Privacy Policy

The Privacy Policy governs how SourceBoard handles personal information.

This Data Handling document provides operational detail and should be read together with that Policy.