Account and security data
An account stores its username, email, display name, role and account status. Passwords are stored as hashes. Session and recovery tokens are stored as hashes, and administrator authenticator secrets are encrypted.
The security log contains event names, actor and target identifiers, counts and timestamps. It does not record passwords, tokens, email addresses, IP addresses or article bodies. Only administrators can view it.
Public contributions
Approved comments show the submitted name, text and date. Article content and attachments can also be public. Do not put private contact details or secrets in a contribution intended for publication.
Likes store a hash derived from a browser token. Comment submission limits temporarily track IP addresses and session-token hashes in process memory; these counters are not part of the security log.
Browser storage
First-party cookies support login, language selection and likes. Local storage remembers your theme and whether you dismissed the cookie notice. BenchCore does not include advertising or analytics scripts.
Hosting and external resources
The host or reverse proxy can keep access logs. Password recovery, when enabled, sends email through the configured provider. Images may come from configured object storage or an external URL; opening them can send a request to that provider.
Your choices
You can sign out, revoke all device sessions, change your password and clear browser storage. Clearing cookies does not delete your account or published contributions. For account or content removal, contact the operator of this installation; there is no automatic deletion form.
Do not post private account details, passwords or recovery links in the public issue tracker.