Privacy Policy

Last updated: October 2026

CList is a personal learning and communications tool developed by Stephen Downes. This policy explains what data CList collects, where it goes, and what it never does.

What CList does not do

• CList does not collect personal data on its own behalf.
• CList does not run analytics or tracking scripts.
• The CList web server (clist.mooc.ca) does not log requests.
• The desktop application communicates only with servers you explicitly configure.

Credential storage (kvstore)

CList optionally uses a companion service called kvstore (hosted at kvstore.mooc.ca) to store your account credentials across devices. kvstore stores only:

• Your chosen username
• A one-way authentication hash of your password (your password itself is never sent or stored)
• Encrypted credential blobs — your API tokens and passwords are encrypted in your browser before transmission using AES-GCM with a key derived from your password via PBKDF2. The server stores only ciphertext and cannot read your credentials.

You can run your own kvstore instance instead of using kvstore.mooc.ca. The source code is available on GitHub.

Third-party services

CList can connect to external services on your behalf — including Mastodon, Bluesky, WordPress, Blogger, OpenAI, and Dropbox. You choose which services to connect, and CList communicates with them using credentials you provide. Each service's own privacy policy governs how they handle your data:

• Mastodon
• Bluesky
• WordPress.com
• Blogger (Google)
• OpenAI
• Dropbox

CList does not share your data with any of these services beyond what is necessary to perform the action you request (e.g. publishing a post).

Open source

CList is fully open source. You can inspect exactly what it does at github.com/Downes/CList.

Contact

Questions about this policy: stephen@downes.ca