Fva Connect — Privacy Policy

What Fva Connect is

Fva Connect is a professional and social network run by FVA70K Services. You create an account, post updates, connect with people, send messages, and view or post opportunities.

What you give Connect

When you register with email and password, Connect stores your name, your email address, and your password in hashed form, so the password itself is not kept in readable form. Your password must be at least 10 characters long and include an upper-case letter, a lower-case letter, and a number.

Inside Connect, you also create the things you post: updates, comments, likes, connection requests, messages, job posts, job bookmarks, and job applications. Each post carries the visibility you choose: Public, Professional, or Connections.

What provider sign-in gives Connect

If you choose Continue with Google, Connect receives your verified email address and your name from Google. If you choose Continue with GitHub, Connect receives your verified primary email address and your name or username from GitHub. Connect does not keep your Google or GitHub sign-in token after sign-in. Provider sign-in is still being set up: until its sign-in details are configured, the provider buttons return a not-configured message instead of signing you in. [Fortune to confirm: the date provider sign-in goes live.]

Email verification, stated honestly

Connect has a verification step for email accounts, but its verification email sender is not configured yet. Until that sender is live, an email account cannot be verified, even though registration shows a message about a verification message. Provider accounts are different: they are marked verified because the provider already verified the email address. [Fortune to confirm: when the verification email sender goes live.]

Who can see what

Public posts are visible to signed-in Connect users. Connections posts are visible only to you and to people whose connection with you is accepted. Your own posts are always visible to you. Messages in a conversation are visible only to the two people in that conversation. You can delete your own posts. Admins can suspend accounts and hide or restore posts, and admin checks are recorded under a Trace ID.

Sign-in protection

Two-factor sign-in, where you turn it on, uses an authenticator app only. Email codes are never accepted as a second factor. After 5 failed sign-in attempts, an account is locked for 30 minutes. The human check, FVAVerify, must pass before registration or sign-in when it is active; when its site key and secret are not set, the check box is hidden and sign-in does not use it.

Sessions

Signing in creates a session that lasts 7 days. You can see your sessions in your profile and revoke one session or all sessions. Signing out clears the session cookie. Details of each cookie are on the Cookies and Data page.

What Connect does not have yet

Connect has no account deletion route yet and no data download route yet. Until those routes exist, this draft does not promise them. [Fortune to confirm: whether deletion and download routes will be added, and how a request is handled in the meantime.]

How long Connect keeps your data

[Fortune to confirm: how long posts, messages, and account records are kept, and what happens to them if an account is suspended or closed.]

Questions about your data

[Fortune to confirm: the contact address for privacy questions and requests.] Until that contact is named, this draft names no contact, rather than naming one that does not exist.