Privacy Policy

This site is used by children. That single fact decided most of what follows: we collect as little as we can get away with, we ask children for nothing at all, and we do not track anybody for advertising.

The short version

• Children need no account. Every resource opens without signing in, and we never ask a child for a name, age, school or photograph.
• No advertising or analytics trackers. There is no ad network, no tracking pixel and no cross-site profiling on this site.
• We do not sell or rent personal information. To anyone, ever.
• The only thing we ask an adult for is an email address — and only if they choose to subscribe or write to us.

What we actually collect

If you subscribe to our newsletter

We store your email address so we can send you the newsletter. It is encrypted at rest in our database, and it is recorded against this site so we know where you signed up. We do not need or ask for your name.

Every newsletter carries an unsubscribe link, and unsubscribing is immediate. You can also ask us to delete the record entirely.

If you use the contact form or submit a story

We receive what you typed, including your name and email address, so that a person can read it and reply. Story submissions are read by a reviewer before anything is considered for publication. If we publish a story, we agree with you first what name — if any — appears on it.

If you have a staff account

Staff and volunteer accounts are for the people who run the site. We hold the account’s email address, display name, a one-way hash of the password (never the password itself), the date the account was created, and the time of the last sign-in. These accounts are created by an administrator; there is no public sign-up.

Server logs

Like every website, our web server records requests — the page requested, the time, the browser type and the IP address it came from. These logs exist to keep the site running and secure, are not used to build a profile of anyone, and are rotated and discarded on a short cycle.

Cookies

We use no advertising or analytics cookies. The only cookies this site sets are the two it cannot work without:

• A sign-in cookie, set only after a staff account signs in, so the session is remembered. Children and general visitors never receive one.
• A security token on pages with a form, which stops a third-party site from submitting that form on your behalf.

Things served from other companies

We would rather tell you this than let you find it in your browser’s network tab. Some parts of these pages are loaded from other companies’ servers, which means those companies can see that a browser requested a file, along with its IP address:

• Google Fonts serves the two typefaces the site is set in.
• Unsplash currently hosts some of the photographs on our pages. We are moving these onto our own servers.

Neither receives anything you type, and neither is used by us for tracking. We do not control their own practices.

Children’s privacy

We designed this site so that the US Children’s Online Privacy Protection Act (COPPA) question mostly does not arise: we do not knowingly collect personal information from anyone under 13, because there is nothing here for a child to fill in. The newsletter, the contact form and the story submission are for adults.

If you believe a child has sent us personal information anyway, email us and we will delete it.

How long we keep things

• Newsletter subscriptions — until you unsubscribe or ask us to delete the record.
• Messages and submissions — while we are dealing with them, and a reasonable period afterwards for our own records.
• Staff accounts — while the person is involved with the organization.
• Server logs — a short, rolling window.

Your choices

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Depending on where you live you may have these rights in law; we intend to honour them wherever you are, and we will not make you jump through hoops.

Security

The site is served over HTTPS. Subscriber email addresses are encrypted at rest and passwords are stored only as salted hashes. Administrative access is restricted to named accounts. No system is perfect, and we do not claim otherwise — but the less we hold, the less there is to lose, which is the main reason we hold so little.

Changes

If this policy changes materially we will update the date at the top of the page. Continuing to use the site after a change means you accept the revised policy.

Contact

Privacy questions, or a request to see or delete your data: please use the contact form.