Privacy policy

• Organizations use credforge.app to create and award digital badges. We store what that needs: accounts for the people who award badges, and each recipient’s name and email address.
• A badge’s public page shows the recipient’s name, never their email address. In the signed badge, the email address is only a salted hash.
• No advertising, no analytics, no tracking pixels. Emails are sent with click and open tracking turned off.
• We don’t sell personal data or share it beyond the providers listed below.

credforge.app (https://credforge.app) is run by [name and postal address of whoever runs credforge.app]. Questions and requests about your data: abuse@credforge.app.

For accounts on credforge.app, we decide how the data is used. For badges, the organization that awards a badge decides who receives it and what it says; we store and send it on their behalf. [Confirm these roles (controller and processor) with legal advice.]

The organization that awarded you a badge gave us:

• Your name, which appears on the badge, its public page and its printable certificate.
• Your email address, to send you the badge and for the organization’s records. The signed badge contains it only as a salted hash, so it can be checked against an address someone already knows but can’t be read from the badge.
• Anything else the organization added: the date, an expiry date, evidence links, and extra columns from a spreadsheet upload. Extra columns are never public.

We also record whether the award email was delivered or bounced, and when you first opened your claim link. Your claim link works for 90 days and lets you add the badge to LinkedIn or hide its public page. A hidden page can’t be seen by anyone else. Badge pages ask search engines not to index them.

If something on a badge is wrong, contact the organization that awarded it: they can correct it (by reissuing it) or revoke it.

To have your data deleted, ask the organization that awarded the badge, or write to abuse@credforge.app and we’ll pass your request on (or, if the organization doesn’t answer, handle it ourselves). Erasing your data:

• covers every badge that organization awarded to your email address, and revokes them for good;
• removes your name, your email address and the signed badges from its records on credforge.app: the badges, the emails we sent, the rows of any spreadsheet it uploaded, and the spreadsheets themselves;
• makes what its audit log says about you unreadable: the log keeps a record that a badge was awarded and erased, but no longer who it was for;
• replaces each badge’s page with a notice that the badge was removed. Any copy of a badge (a downloaded file or badge image) still checks as revoked.

Erasing can’t reach copies outside credforge.app: badges you downloaded or shared (for example on LinkedIn), emails already delivered, or records the organization exported. Our database backups keep a copy for up to 30 days before they are deleted; if we ever restore one, erasures made since are applied again. [How quickly deletion requests are answered (for example, within one month).]

• Account details: your name, email address and a hash of your password (we never store the password itself).
• Two-step verification: your authenticator secret (encrypted) and backup codes.
• Sessions: the IP address and browser of each signed-in session, until it expires.
• Your organization’s data: its members and their roles, invitations, issuer profile, achievements, the badges it awarded and its API keys (stored only as a hash).
• Audit log: every change in an organization is recorded with who made it, when, their IP address and browser. This log can’t be edited or deleted, so that badges stay accountable. What it says about a badge’s recipient (their name, email address, and their IP address and browser when they open or hide their badge) is encrypted with a key kept with that badge, and erasing the recipient’s data deletes the key.

Issuer profiles and achievements are public on purpose: they say who awards a badge and what it means. Contact addresses you put on an issuer profile are public too.

The verification tool doesn’t store or log the badge, link or email address you check. Your IP address is used, in memory only, to limit how many checks one network can make.

Only the cookies the site needs: your session when you sign in, and a cookie that remembers a badge’s claim link on that badge’s page. No advertising or analytics cookies.

• DigitalOcean hosts our servers, database and files (region sfo3).
• Twilio SendGrid delivers our emails (award, confirmation, invitation and password emails) and tells us whether they arrived.

[Where the data is stored and any international transfers, with their legal basis.]

• Badges are kept as long as the organization that awarded them, so they can still be checked, unless the recipient’s data is erased. A revoked badge stays recorded as revoked.
• Spreadsheets uploaded to award many badges are deleted after 30 days.
• Claim links stop working after 90 days (the organization can send a new one). Invitations expire after 7 days.
• Database backups are kept for 30 days. Restoring one applies again any erasure made after it was taken.
• Server logs (IP address and the page requested, with links’ secret parts removed) are kept for [how long].
• Accounts are kept until you ask us to delete yours. [Decide how long the audit log is kept.]

Everything is sent over HTTPS. Passwords are hashed, the keys that sign badges are encrypted and files are stored privately. Owners and admins must use two-step verification. Please report security problems to security@credforge.app.

You can ask for a copy of your data, ask us to correct or delete it, or object to how we use it: write to abuse@credforge.app. For a badge, we may pass your request to the organization that awarded it. You may also complain to your data protection authority. [Rights and authorities that apply where the operator and users are.]

[Whether badges may be awarded to children, and the age limit for accounts.]

We’ll post changes on this page with a new date, and tell account holders by email about important ones.