Summary
- Public pages can be browsed without an account.
- Email accounts store an Argon2id password hash, never a plaintext password.
- Google sign-in requests only
openid,email, andprofile. We persist Googlesub, a verified email, and a display name, but no Google access or refresh token. - We do not read Gmail, Drive, Contacts, or Calendar content, use account data for advertising, or sell personal data.
- To request access, correction, export, or deletion, email prdusk.com@gmail.com from your registered address.
1. Data we process
Email and password accounts
When you register by email, we process your email address, public display name, an Argon2id hash of your password, and temporary state or token information needed for email verification, password reset, and sign-in. DuskRain Community does not store plaintext passwords.
Public content and profiles
When you use community features, we process comments and replies you post, your public display name, and profile information you choose to display. This information may be visible to anyone who can access the relevant page. Do not submit information you do not want to make public.
Google sign-in
A Google OpenID Connect response may contain sub, email, email_verified, name, and standard profile claims such as a picture URL, name components, or locale. DuskRain uses and persists only the stable sub, verified email, and display name. Other unneeded claims are ignored and are not stored as DuskRain profile data.
GitHub sign-in
GitHub sign-in reads only the numeric user ID, username or name, and a verified email needed for identity verification. The access token is used only during that sign-in, is not written to the database, and is not used to read repository content.
Sessions and security information
The service handles the IP address and client information needed for network communication, rate limiting, security, and troubleshooting. Session IP and User-Agent values are stored as keyed hashes; necessary authentication and security events are recorded in an audit log. Sessions and one-time verification or reset tokens are stored only as irreversible hashes.
2. Google user data
Access
DuskRain Community requests only openid, email, and profile to verify identity, obtain a verified email address, and set a display name. It does not request or read Gmail, Google Drive, Contacts, Calendar, or other private Google content.
Use
Google-derived data is used only to identify the sign-in subject, create or identify a DuskRain account, confirm email verification, set a display name, establish DuskRain's own session, and prevent impersonation or abuse. It is not used for advertising, credit decisions, data sales, data brokerage, or unrelated profiling.
Storage
The application database persists Google sub, verified email, and display name. A Google access token is used transiently during the current OAuth flow; access and refresh tokens are not written to the application database or used for ongoing Google API access. A DuskRain session does not grant access to Gmail, Drive, Contacts, or Calendar.
Sharing
Google user data is not sold or provided to advertising platforms or data brokers. The servers, networks, and infrastructure hosting duskrain.cn may process account data only as necessary to provide the service. Limited disclosure may occur where clearly required by applicable law or genuinely necessary to handle a security incident.
Deletion
After a deletion request sent from the registered address is verified, it covers the Google sub, verified email, and display name stored by DuskRain. Revoking Google authorization does not automatically delete an existing DuskRain account; use the contact process in this policy to request account deletion.
DuskRain Community's use and transfer of information received from Google APIs will comply with the applicable requirements of the Google API Services User Data Policy, including Limited Use requirements.
3. Why we use this data
- to create, verify, and maintain accounts and sessions;
- to display public names, profiles, comments, and replies;
- to send email verification and password reset messages;
- to prevent bulk registration, brute-force attempts, spam, impersonation, and other abuse;
- to handle support and access, correction, export, or deletion requests; and
- to troubleshoot failures, handle security incidents, and comply with genuinely applicable legal requirements.
DuskRain Community does not sell or rent personal data, use account data for targeted advertising, or provide Google or GitHub identity data to data brokers.
4. Third parties and email delivery
- Google: Google OAuth authentication and Gmail SMTP system-mail delivery;
- GitHub: GitHub OAuth authentication;
- Infrastructure: servers, networking, and related services required to host duskrain.cn; and
- Legal and security situations: limited processing clearly required by applicable law or genuinely necessary to protect users or the service.
Google OAuth is used for account sign-in. Gmail SMTP is a separate outbound channel used by DuskRain only for verification and password reset messages. SMTP does not read a user's Gmail account and no Gmail API scope is requested. The recipient address and system-message content pass through the mail service to complete delivery.
Google, GitHub, and infrastructure providers operate under their own terms and privacy policies. DuskRain Community is independent of Google and GitHub and is not sponsored or endorsed by them.
5. Cookies, sessions, and one-time links
Only first-party cookies required for sign-in, CSRF protection, and security are used; no cross-site advertising tracking is performed. Session and CSRF cookies use Secure, HttpOnly, and SameSite restrictions.
- ordinary login session: up to about 12 hours;
- “keep me signed in”: up to about 30 days;
- email verification link: about 24 hours;
- password reset link: about 1 hour; and
- temporary OAuth state: about 10 minutes.
These periods describe validity, not a universal deletion schedule for every related security record. Sessions may end earlier after sign-out, a password change, revocation, or detected risk.
6. Retention and deletion
While an account exists, we retain the email, public name, password hash, and third-party identifiers needed to maintain it. A new Argon2id hash replaces the previous password hash after a password change; sessions and one-time flows expire as described above.
Deletion requests are handled within a reasonable practical period. Limited information may continue to be processed only where genuinely necessary for a security incident, dispute, or applicable legal obligation. We do not promise a fixed universal deadline that does not match the real system.
If your request also concerns public comments or replies, identify the content or page. Deleting account identity data cannot remove copies already copied, republished, cached, or indexed by third parties.
7. Your choices and requests
The account center supports changing a public display name, changing a password, and signing out other devices. You may also revoke third-party authorization in your Google or GitHub account settings.
For access, correction, export, or deletion, email prdusk.com@gmail.com from your registered address with the subject “DuskRain Data Request.” To prevent impersonation, we may ask you to confirm control of the registered address or account and will request only what is needed for verification.
8. Security
We use HTTPS, Argon2id password hashing, minimal OAuth scopes, time-limited sessions and verification flows, secure cookies, rate limiting, keyed hashes, and necessary auditing. These measures reduce risk but cannot guarantee absolute security. Contact us if you believe an account has been misused or you discover an account-related security issue.
9. Changes and contact
If account features, third-party sign-in, data fields, cookies, mail delivery, or other data practices materially change, we will update this policy and its effective date. New Google data types or scopes will be disclosed and authorized before use; existing authorization will not be treated as permission for unrelated Google content.
Privacy, account data, access, correction, export, deletion, or security requests: prdusk.com@gmail.com.