Data and privacy
This page describes what the code running at socialgraph.stackwell.tech
does with data today. Where something is missing, it says “Not yet”.
What Social Graph stores
About a person. People sign in with ChirpAuth, which gives Social Graph an account id and no email address or name. Social Graph stores:
| Data | Contents |
|---|---|
| Account | The ChirpAuth account id, a display name, an avatar URL if one was ever set, and the person’s settings for who may send them requests. |
| Connections | Who the person is connected to, when, and when a connection expires if it does. Connection requests, invite links and in-person connect codes they sent or received. |
| Tags | Tags the person put on their connections and groups. |
| Groups | Groups they created or belong to, their role, and group invitations. |
| Safety lists | People they blocked, soft-blocked or muted, and reports they filed. |
| App grants | Each app they approved: when, a hash of the access token, its expiry, and whether they revoked it. |
| Per-app ids | The psd_ id each app sees for them. |
| Memberships | The id and name an app recorded for them (see Memberships). |
| Rate-limit records | A record of each rate-limited action the person took, such as sending a connection request or searching. |
| Moderation | Any suspension or other moderation decision Stackwell made about the person, with its reason. |
About apps. The app’s registration (name, description, platform, redirect URI), its owner, its status, and a hash of its client secret. Apps registered before 7 November 2026 may also hold a package name and signing-certificate hash, which Social Graph no longer uses. Approval codes are stored as hashes.
Logs. Operational logs are kept for 14 days.
Social Graph runs on AWS in the us-east-1 region (United States).
How long
Social Graph never deletes a record. Removing a connection, a tag or a membership, revoking an app or unblocking someone marks the record and keeps it. Logs are the exception, at 14 days.
Who sees what
- An app the person approved can read, until its access ends: the person’s
psd_id for that app, display name and avatar; the same for each of their connections; whether they are connected to someone, and their mutual connections; and the memberships that app recorded for them and for those of their connections whose own approval of it is still in force. Display names are the same for every app, so apps can match people by them. The code exchange also gives the app Social Graph’s own id for the person, which is the same for every app. - Other people signed in to Social Graph see a person’s display name and avatar, and can find them by display name.
- The person can read their own data through the endpoints the Social Graph app uses. Not yet: a web screen for it.
Deleting data
Not yet:
- No account deletion. A person cannot delete their Social Graph account or data.
- No export. A person cannot download their data.
- Deleting the ChirpAuth account does not reach Social Graph. The data stays, and apps the person approved keep their access until it expires.
- No screen to revoke. The Social Graph web app has no screen yet where a person can see or revoke the apps they approved.