← HIT Connect

What we store, and who can see it

Written in plain language on purpose. If any of this is not true of the running system, that is a bug — please report it.

The short version

Other students see your username and your profile. Nothing else. The platform additionally holds an encrypted copy of your email address, which stays sealed unless someone reports you for abuse or illegal activity.

Everything on the server

WhatHow it is storedWho can read it
UsernamePlain textEveryone on the platform
Profile (gender, preference, bio, interests)Plain textOther students who can see you in Discover or Search
Year of studyStored as the intake year from your student number, not as something you typed. Your year is worked out from it each time it is shown.Other students, on your profile
PasswordArgon2id hash with a per-password salt and a server-side secret. Not reversible.Nobody, including the administrator
Email address — searchable copyHMAC-SHA256 fingerprint. One-way; it can confirm an address you already know but cannot be turned back into one.Nobody
Email address — sealed copyAES-256-GCM, under a per-user key that is itself encrypted with a master key kept outside the database.The administrator, only through the break-glass flow described below
MessagesAES-256-GCM, encrypted at rest and tied to the conversation they belong to.You and the person you are talking to
Messages captured on an abuse reportCopied at the moment a report is filed, encrypted the same way.A moderator reviewing that report
Login sessionsOnly a SHA-256 of the session token. A database leak cannot be replayed as a login.Nobody
IP addressesNever written to disk. Rate limiting uses a keyed fingerprint instead.Nobody

What we deliberately never ask for

Your real name. A photograph. Your phone number. Your faculty or programme — that one is deliberate: faculty plus year of study plus gender would narrow most students down to a handful of people, which would make the anonymity decorative. Year of study on its own is broad enough to be safe.

Being found

Other students can search for you by username, year of study, or gender. Those are exactly the three things shown on every profile — there is nothing you can be filtered by that is not already visible, because a filter matching on something hidden would let people work it out.

If you block someone, you stop existing as far as they are concerned: your profile returns the same “not found” page as a username that was never registered. They are not told they have been blocked, because being told is itself information.

Deleting a message

Unsending deletes the row from the database for both people. There is no hidden copy, no “deleted message” placeholder, and no column that could be flipped to bring it back — a tombstone would still reveal that something was said and withdrawn, which is most of what a deleted message gives away.

The one exception: if somebody had already reported that message, the copy attached to their report survives. Otherwise anyone could send something abusive, wait for the report, and delete the evidence — making the delete feature the thing that defeats moderation.

The break-glass flow

There is exactly one path from a username to a real identity, and these constraints are enforced by the software, not by policy:

Why we tell you this

A service that promises anonymity while quietly keeping identity is worse than one that never promised, because you would calibrate what you say to a guarantee that was not real. Telling you costs us signups. We would rather have that than have your trust on false terms.

It also works better. People who know they can be identified for threatening someone mostly do not threaten people. Secret accountability catches abusers after the harm; disclosed accountability prevents some of it.

Community rules