tsbb
Sign in

Privacy Policy

Effective date: November 11, 2026

This policy covers tsbb at tsbb.pwa.pit.world, a bulletin board run by Profullstack, Inc., 16375 Bonnie Lane, Los Gatos, CA 95032, USA on the open-source tsbb software. It describes what the board stores, why, and who else is involved.

1. Reading without an account

You can read every public forum, search, follow the RSS feeds and use the read-only API and MCP tools without an account. None of that asks for anything about you.

2. What an account stores

  • Your email address. It is your account: sign-in links are sent to it, and so are the notification emails you leave switched on.
  • Your profile. Your username, and whatever you choose to add: display name, avatar, signature, title, location, website, bio, time zone and language.
  • What you post. Topics, replies and their edit history, reactions, poll votes, attachments and uploaded avatars, and private messages, which are stored so the people in the conversation can read them.
  • Your activity on the board. Topics you follow, notifications, which topics you have read, your notification and display preferences, members you block, reports you file, your post and topic counts, and when you were last active.
  • Sign-in records. For each sign-in link: a hash of the link, its expiry (20 minutes) and a hashed IP address, used to rate-limit requests. For each session: a random session ID, its expiry (30 days), your browser's user agent and a hashed IP address. Passkeys, if you register one: the public key and a signature counter; the private key never leaves your device. API tokens you create: a hash of the token, its label, scopes and when it was last used.
  • IP addresses are only stored as a salted hash, on sign-in links, sessions, posts and moderation records, so abuse can be traced to a source without keeping the address itself.

There is no password to store, because there is no password: you sign in with an emailed link or a passkey.

3. Cookies

One cookie, set when you sign in, holds your session ID. It is HttpOnly and SameSite=Lax, and is sent only over HTTPS. If you pick a light or dark theme, a second cookie remembers that choice. The board itself sets no advertising or tracking cookies.

4. Who else is involved

  • Resend delivers the board's email (sign-in links and notifications), so it processes your address to send them.
  • CrawlProof (crawlproof.com) serves the ad units, inside a sandboxed frame loaded from crawlproof.com, and a CrawlProof statistics script counts page views. Your browser contacts crawlproof.com to load them, which sees your IP address and browser details.
  • Gravatar, only if you choose a Gravatar avatar: your avatar is then loaded from gravatar.com using a hash of your email address.
  • Images from other sites. Some images on the page, such as the logo and the footer badges, and images members link in posts are loaded by your browser directly from the sites that host them, which see the request the way any visit to their site would.

Nothing is sold, and no advertising profile is built from you.

5. What is public

Your profile (everything in it except your email address), the members list with join and last-active times, and everything you post in a forum that guests can read are public. That includes the board's RSS feeds, the API, the MCP tools and search engines. Private forums and private messages are shown only to the people allowed to see them. Your email address is never shown publicly; the board's administrators can see it.

6. AI agents and MCP

The board is also an MCP server, at https://tsbb.pwa.pit.world/api/mcp (streamable HTTP; tsbb-mcp does the same over stdio). Without credentials, an MCP client can use the read-only tools: the board overview, forum and topic lists, reading topics and posts, search, and member profiles. They return exactly what a guest sees on the pages. With an API token a member created in their settings (or through tsbb CLI sign-in), it can also see who it is signed in as, list that member's notifications, and start topics or reply as that member. The MCP endpoint ignores cookies; only a bearer token identifies a caller, and a token is never an administrator.

MCP and API requests are logged (time, tool or route, IP address, and the account or token if any) for abuse prevention and rate limiting. No MCP data is sold or used for advertising.

7. Keeping and deleting it

Sign-in links expire after 20 minutes and sessions after 30 days; signing out ends a session at once. You can revoke API tokens in your settings at any time. Everything else is kept while your account exists. To have your account deleted, write to us from the address you signed up with.

8. Security

The board is served over HTTPS, stores sign-in links and API tokens only as hashes, and stores IP addresses only as salted hashes. No system is perfectly secure, and we cannot guarantee absolute security.

9. Children

tsbb is not directed at children under 13, and we do not knowingly collect personal information from them.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data. Contact us to exercise them.

11. Changes

If the board changes what it collects, this page changes with it. The effective date above says when it last did.

12. Contact

Profullstack, Inc., 16375 Bonnie Lane, Los Gatos, CA 95032, USA. Email support@profullstack.com.