Privacy and personal data

SpaceBay works with the WordPress privacy tools in Tools → Export Personal Data and Tools → Erase Personal Data.

• Export includes the member’s profile and custom fields, email choices, space memberships, posts, comments, private messages they sent, likes and saved posts, uploaded images, reports they sent, notifications they received, points, badges, event answers and events they organized.
• Erase deletes the member’s posts, comments, private messages (a “Message deleted” line stays in the chat), likes, images, blocked members list, profile, memberships, notifications, reports, points, badges, event answers and events they organized. Replies that other members wrote to their comments are kept as separate comments.
• Deleting a WordPress user also deletes their community data, including their two-factor setup when Pro is active.

SpaceBay adds suggested text to Settings → Privacy → Policy Guide. Review it and add what fits to your privacy policy.

Images and privacy

Uploads are kept in a private folder with random file names, and the original file name is not kept. A private image is shown only to people who may see it: the members of a chat, people who can read a private space’s posts, or the member who uploaded it and has not posted it yet. Everyone else, including logged-out visitors, gets “Image not found”. Avatars, cover images and images in public spaces are normal public files. Photo details such as GPS location and camera are removed from every uploaded image. Images are included in the personal data export and deleted when a member is erased or SpaceBay is uninstalled. Sites on nginx need one extra rule, see Security and limits.

What happens when a user is deleted

When a WordPress user is deleted, their SpaceBay profile, photo, cover, notifications, posts, comments, likes, images, memberships, points, badges, event answers and the events they organized are deleted too. Images uploaded but never posted are removed after a day.