Privacy Policy

**Effective date:** 2026-05-17

**Version:** 1

**Operator:** the Operator (Melbourne, Victoria, Australia)

**Contact:** our contact form at /contact

**Status:** Operator-drafted, pre-counsel. Refined wording follows counsel engagement.

This Privacy Policy explains how personal information is handled on

this site. It is written to align with the *Privacy Act 1988* (Cth)

and the Australian Privacy Principles (APPs).

---

1. What information is collected

When you use the site, the Operator may collect:

• **Account information**: name, email address, account preferences.
• **Authentication identifiers**: if you sign in via OAuth2 (e.g. via

the Narrow Way Commons identity service), the OAuth `sub` claim is stored

to link sessions across associated sites.

**Content you submit**: feedback items, suggestions, comments,

reflections.

**Site usage data**: pages visited, timestamps, IP address,

browser user-agent. Used for site operation, debugging, and

rate-limiting.

**Email correspondence**: if you email the Operator, the email

content and address.

The site does **not** use third-party analytics, advertising, or

fingerprinting. It does **not** sell personal information to anyone.

2. Why information is collected

To:

• Operate accounts and authenticate sessions
• Display your contributions with attribution (subject to your

profile preferences)

Route feedback to the appropriate reviewer/guild Respond to your support requests Detect abuse Comply with legal obligations

3. Who can see your information

• **You** — at all times, via your account profile and dashboard.
• **The Operator** — for site administration.
• **Guild reviewers** — when reviewing a contribution you've

submitted, they can see the contribution and your account name.

Per the federated content flow, your submission may also appear

as an issue or merge request on `git.nwpcode.org`.

**Other site members** — see only what your profile-visibility

settings expose. Default settings are private-leaning per the

visibility preferences described in

`SPIRITUAL_THEOLOGY_SUBGUILD_v5.md` §7 and equivalents.

The Operator does not share personal information with third parties

except where required by law or where you have explicitly consented.

4. Where data is stored

• AVC (Drupal) database on a Linode VPS in the United States

(region: us-iad) under the Operator's Linode account

SS (Moodle) database on the same Linode infrastructure Backup snapshots stored privately and rotated per the Operator's

backup policy

Email correspondence in the Operator's Gmail account

Data is not transmitted to any AI provider or third-party processor

in the normal operation of the site.

5. How long data is retained

• Account data: retained while your account is active and for up to

12 months after account termination, then deleted.

Submitted contributions: retained indefinitely as part of the

site's content history; you may request your name be removed

from attribution per §6 below.

Server logs: retained for up to 90 days for debugging and

security purposes, then rotated out.

Email correspondence: retained at the Operator's discretion.

6. Your rights

Under the *Privacy Act 1988* you have the right to:

• **Access** the personal information held about you
• **Correct** information that is inaccurate or out of date
• **Request deletion** of your account data (subject to §5 retention

of submitted contributions for content-history purposes)

**Be removed from attribution** on contributions you have

previously made

**Complain** to the Operator, and if unresolved, to the Office of

the Australian Information Commissioner (OAIC)

**Withdraw consent** to optional processing at any time

Email our contact form at /contact to exercise any of these rights. Reasonable

requests will be honoured within 30 days.

7. Cookies and similar technologies

The site uses session cookies necessary for authentication. No

third-party tracking, advertising, or analytics cookies are set.

8. Children

The site is not intended for children under 16. If you are under 16,

please do not use the site without parental or guardian consent.

9. Changes to this policy

When this policy is updated, you will be required to re-accept the

new version on next login. The version field at the top of this

document changes when the policy is materially updated.

10. Contact + complaints

For privacy questions or to exercise any right above, email

our contact form at /contact. If you believe a privacy breach has occurred and

the Operator's response is not satisfactory, you may also lodge a

complaint with the OAIC at oaic.gov.au.

11. Governing law

This policy is governed by the laws in force in Victoria,

Australia.