Website privacy
This page covers accounts and sign-in on the Security For the Folks website, xftf.org.
Your account
We store your username, email address, account creation date, and the posts you create. Password accounts store a password hash. We record the network address used to create an account to limit abusive registrations. Posts you publish are public.
Google and GitHub sign-in
Google supplies your account identifier, verified email address, and basic profile name to create or identify your website account. We request only basic sign-in permissions, not access to your Gmail messages, Google Drive, or contacts. The website does not store Google access or refresh tokens.
GitHub supplies your account identifier, username, and verified email address. To protect the volunteer hub, we also request permission to check organization membership. We store an encrypted GitHub authorization on your connected account so you can enter the hub after signing in with either linked provider. We do not request access to private repository contents.
Connecting providers requires you to sign in and explicitly connect each account. Matching email addresses do not automatically combine accounts. Google sign-in alone does not grant access to the private member hub.
Sessions, hosting, and retention
Cookies maintain your sign-in session and protect forms. Our hosting services process requests and operational logs to run and secure the website. Account data and connected GitHub authorization remain until removed; signing out ends the browser session without deleting your account or its connections. GitHub membership is checked whenever you open a protected member page.
You can revoke website authorization through your Google or GitHub account settings. Revoking GitHub authorization prevents future membership verification. Linked resources on GitHub and other services have their own access controls and privacy practices.
Questions and account removal
For questions, corrections, or an account or connection removal request, contact xftf@malkansolutions.com. We will need to verify ownership before changing account data. Tell us whether your request includes published posts.