Contact form

Every Diffinery instance has a contact form at /contact, linked from the footer of every page. Anyone can use it, signed in or not, to write to the instance's site administrators: questions, help with an account or invitation, running your own Diffinery, feedback, partnerships, press, and privacy requests. A person reads every message and replies by email.

On diffinery.com, the project's own instance, this is how to reach the Diffinery team: diffinery.com/contact.

Two things have their own, better places:

• A security problem: use the private security report form at /security/report.
• A bug or an idea for Diffinery itself: open an issue on the Diffinery repository or its GitHub mirror.

#Send a message

1. Open /contact, or click Contact in the footer.

2. Fill in the form. Every field is required:

   Field	Limit	What it's for
   Name	up to 100 characters	How the team addresses you
   Email	a valid address, up to 254 characters	Where the confirmation link and the reply go. Not shown when you're signed in: your account's address is used.
   Topic	one of A question about Diffinery, My account or invitation, Running my own Diffinery, Feedback or an idea, Partnerships and integrations, Press and media, Privacy and my data, Something else	Gets your message to the right person
   Message	10 to 5,000 characters and at most 5 links, plain text	What you want to tell us

   A link can choose the topic for you: /contact?topic=press opens the form with Press and media selected. The values are question, account, self-hosting, feedback, partnership, press, privacy and other.

3. If you aren't signed in, complete the "are you a person" check if one shows.

4. Click Send message.

If you aren't signed in, you see Check your inbox. Open the email titled "Confirm your message to the Diffinery team" and click Confirm my message, then press Confirm my message on the page that opens. You see Your message is with the team. The link works once, for 48 hours. A message that is never confirmed is never read, and is deleted after 7 days. The confirmation email never repeats what you typed, so nobody can use the form to send someone else words through Diffinery.

If you're signed in, there's nothing to confirm: you see Message sent, and you get a copy of your message by email ("We got your message"), with its reference.

The team replies from their own mailbox to the address you gave, or your account's.

#What is stored

Your IP address and the address you typed are never stored in the clear for the limits, and nothing you type is written to logs. Only site administrators can read messages. To have a message deleted sooner, ask through the form (topic Privacy and my data). In the data model, these are the contact_messages and contact_attempts tables.

#How the form is protected

#For site administrators

Settings → Contact messages (/settings/admin/contact) is in the Site administration group. The sidebar shows how many new messages are waiting. Anyone who isn't a site administrator gets 404.

When a message arrives (confirmed, or from someone signed in), each active site administrator gets:

• an email, "Contact: topic from name", with the whole message. Its Reply-To is the sender, so replying in your mail app answers them directly. It belongs to the Organizations group of your notification settings, so you can turn it off there;
• one in-app notification, "New contact messages are waiting for you", which stays until it is read however many messages arrive.

The tabs filter by state, with counts:

The search box finds messages whose address, name or text contains what you type. Each message shows its sender's name and address, its state, the topic, when it was sent, the start of the text, and an amber badge when the sender was signed in or an active account uses the address. Click a name to read the whole message.

• Reply by email opens your mail app with a reply to the sender. Diffinery doesn't send replies itself, so the conversation stays in your mailbox.
• Mark handled marks the message Handled. Spam marks it Spam. Reopen puts a handled or spam message back to New (or Unconfirmed, if its address never confirmed it). Nobody is emailed.
• Note, on a message's page, keeps a note for the other site administrators, such as who replied and what was agreed, up to 2,000 characters. The sender never sees it. Save an empty note to clear it.
• Delete message removes it for good, for someone who asks for their data to be removed.

Every change is in the audit log: contact.create and contact.confirm when a message is sent and confirmed, contact.handle, contact.spam, contact.reopen, contact.note and contact.delete. Entries name the message by its id; none holds what it said, and contact.delete doesn't hold the address.

#From the API

With a site administrator's token (read to list, admin to change):

# New messages
curl -H "Authorization: Bearer $DIFFINERY_TOKEN" \
  "https://diffinery.com/api/v3/diffinery/admin/contact?state=new"

# Mark one handled, with a note
curl -X PATCH -H "Authorization: Bearer $DIFFINERY_TOKEN" \
  -d '{"state": "handled", "note": "Replied with the self-hosting guide."}' \
  https://diffinery.com/api/v3/diffinery/admin/contact/<id>

Each message has id, state, email, name, topic, message, sender (the login of a signed-in sender, or null), confirmed_at, note, updated_by, handled_at, created_at, updated_at and html_url. Everyone else gets 404. See the API reference for every field.

#Troubleshooting