Can moderators see private messages?


New member
How much privacy is there in a PM? Can the moderation team see the content of private messages? Can they see who is messaging each other? Just how private are PM's?


XenForo moderator
Staff member
Only the participants of conversations can view them.

Ultimately they are not totally private though, as anyone with database access can read the messages.


New member
Only the participants of conversations can view them.

Ultimately they are not totally private though, as anyone with database access can read the messages.
Not quite sure what your 2nd sentence means. I was told the moderation team can see at the very least who is PM'ing each other. I was also told it takes quite a bit of work to get to the PM's if someone did want to read them.


I think it is important for there to be a UI feature that allows at least an admin or license owner to review all PM's. It simply makes sense even from a legal perspective. You can easily have situations in which a full review may be necessary for legal or safety reasons.

And importantly, it goes both ways. Being able to report specific messages is not enough. The reason for that is because context is sometimes everything, and can make the difference between a phony accusation and a reasonable one, between whether one party or the other has truly been "the bad guy," or both.

I don't mind saying that I was in a conversation with Chris D about this very thing back in October. I had contacted another member to try to help him out, because he was obviously a little bit troubled, more than a little bit really. Others had been trying to help him publicly, and even one of the mods here had chided him slightly. I did the guy quite a few favors in fact, but he only repaid me very badly instead, and that's putting it mildly and succinctly. He wound up reporting me as the bad guy for something in the PM's, however, though I had not reported him, and I do not know exactly what he reported me for, and Chris did not tell me. That is another problem or defect: you are not given any information at all if someone reports you, so as to possibly defend yourself. So Chris D gave me a rule 2 violation, even though if anyone actually saw the entire context of the entire conversation instead of isolated remarks in isolated PM's within the whole coversation, I would contend that most people would agree the other guy had been "the bad guy," and that I had not even truly done at all what I was being given the rule 2 violation for instead. Ironically, however, Chris D told me that I was not being given the rule 2 violation for what the member reported me for, but only for things he saw in my private conversation that he considered to be a rule violation. That is also a "slippery slope" indeed when you're talking about private vs. public and without a full context.

I regarded and still regard that process and methodology to be very flawed, and told Chris so in some very lengthy and well thought out replies if I can say so myself. One of the biggest flaws of all is this all-important issue of context. One of the things Chris told me was that he could only see PM's of mine within the conversation that the other member had reported, not the entire conversation. That is a hugely flawed issue with regard to context, which can, and in this case I would say certainly did, lead to a flawed impression and a flawed outcome.

In this conversation with Chris I had even mentioned that surely there was access to my whole conversation with the other member even at the database level, in response to him saying he could not see all my PM's there, but he did not say anything about that. I'm not without IT experience myself, so it certainly seemed impossible that db-level access could not exist, and now I see that confirmed here. Since ultimately access does exist, I would suggest that it only makes sense to include an easy UI feature in case there are times when someone does need to review PM's. Maybe not for mods, but certainly for admins or license owners.
Last edited:

Mr Lucky

Well-known member
Login as user ... and read their PMs ?
Login as user is very useful. If they complain about some aspect of the forum not working properly, you can see exactly wat they see. Obviously it should tie in with their Analyse permissions, but I find it useful if for example:

They say they can't post in foru x

I see that their permissions say they can and tell them so.

They insist they can't.

I log in as them to double check whether either they are going mad or I am. Or xenforo is going mad.

Obviously once logged in as someone you can see their Conversations, but that isn't really the primary reason for that addon.

Being able to read other peoples' conversations is only creepy if you are doing it gratuitously and voyeuristically while letting them think those conversations are totally private (which they never are as long as you own and have access to the database anyway.

I make that very clear in my privacy policy:

Personal Conversations (PCs)

Please note that while personal conversations are not visible publically or to other members of the forum, except to those people in the conversation, forum and/or server admin may be able to access the conversations under exceptional circumstances (see below). For this reason we do not actually call the "Private" - although they are just as private as on any other forum software or social network.

Please note that the ability for admin to view personal messages is common to any similar forum software. Our policy is not to read personal conversations or allow any third party access unless those exceptional circumstances require it, however you are advised to be aware that nothing you say in personal conversations on this, or other forums, is truly private. If you want to discuss completely private matters with other members, then you are advised to do so via email, telephone or other forms of communication.

Exceptional Circumstances

Include but are not limited to:

  • Requests from law enforcement agencies with the appropriate warrants.
  • Any action needed to be taken by admin to ensure the legality and security of the forum, for example if fraudulent activity is suspected.