Are PMs truly private and not crawlable?

[mittals24 (Sharad)]

I would assume so by the nature of a Private Message. Still confirming as a user on our forums asked.

[Steven]

Technically, admins can access direct messages through incarnate or user profile.

There is an option in the DM to make them public but it’s a manual command, and other than that they are not accessible by anyone else than concerned users and admins

But this plugin can be interesting for a truly private access to dm

Discourse Encrypt (for Private Messages)

Discourse Encrypt Discourse Encrypt is a plugin that enables private, encrypted messaging between end-users. All sensitive information is stored securely on the server and is encrypted and decrypted only on the client-side. How do I install it? Follow plugin install guide and use https://github.com/discourse/discourse-encrypt.git for repository URL. Three easy steps to use this plugin Enable encryption and activate current device. Send an encrypted message. The recipien…

[mittals24 (Sharad)]

Thanks. I guess the concern in our case is just web crawlers like google. That encryption plugin is pretty cool though.

[Bill]

@mittals24

I guess the concern in our case is just web crawlers like google.

PM’s don’t show up in search engines but admins can read them.

[Stephen]

PMs aren’t private messages, they’re Personal Messages. The naming distinction is quite intentional.

The only people able to access PMs are participating users, administrators, and anyone with access to the database / backups.

AFAIK there are no known configurations where anonymous users or crawlers can see the contents of a PM.