Privacy Policy

Privacy Policy

This Privacy Policy explains how personal information is handled on

this site. It is written to align with the *Privacy Act 1988* (Cth)

and the Australian Privacy Principles (APPs).

0. Who is responsible for your information

The person responsible for the personal information described here is

Robert Karsten Zaar, an individual, of Melbourne, Victoria,

Australia (the "Operator"). The Operator is not an incorporated body

and does not hold this information on behalf of Apostoli Viae or any

other organisation.

This policy covers both Narrow Way Commons, the community, and

Saint School, the courses. One login works on both.

You can reach the Operator about anything in this policy at

privacy@nwpcode.org, or through our contact form at /contact.

1. What information is collected

When you use the site, the Operator may collect:

  • Account information: name, email address, account preferences.
  • Authentication identifiers: if you sign in via OAuth2 (e.g. via the Narrow Way Commons identity service), the OAuth `sub` claim is stored to link sessions across associated sites.
  • Content you submit: feedback items, suggestions, comments, reflections.
  • Site usage data: pages visited, timestamps, IP address, browser user-agent. Used for site operation, debugging, and rate-limiting.
  • Email correspondence: if you email the Operator, the email content and address.

The site does not use third-party analytics, advertising, or

fingerprinting. It does not sell personal information to anyone.

2. Why information is collected

To:

  • Operate accounts and authenticate sessions
  • Display your contributions with attribution (subject to your profile preferences)
  • Route feedback to the appropriate reviewer/guild
  • Respond to your support requests
  • Detect abuse
  • Comply with legal obligations

3. Who can see your information

  • You — at all times, via your account profile and dashboard.
  • The Operator — for site administration.
  • Guild reviewers — when reviewing a contribution you've submitted, they can see the contribution and your account name. Per the federated content flow, your submission may also appear as an issue or merge request on `git.nwpcode.org`.
  • Other site members — see only what your own sharing settings expose. The defaults are private-leaning: your practices and your written reflections are private to you and are shown to another member, such as a mentor, only where you have chosen to share them. You set and change those choices yourself, at any time, at /my/formation-shares. Your progress through the community is visible in the ordinary course of taking part, which is what the formation-consent text you accept at /legal/formation-consent describes.

The Operator does not share personal information with third parties

except where required by law or where you have explicitly consented.

4. Where data is stored, and what leaves this site

  • The Narrow Way Commons (Drupal) database, on a Linode VPS in the United States (region: us-iad) under the Operator's Linode account
  • The Saint School (Moodle) database, on the same Linode infrastructure
  • Backup snapshots stored privately and rotated per the Operator's backup policy
  • Email correspondence, held in the Operator's mailbox with a third-party email provider (Google)

Browsing the site, holding an account, and taking courses send

nothing to any AI service. The site uses no third-party analytics,

advertising, or tracking, and no part of your formation record — the

practices you take up and the reflections you write — is ever sent to

an AI service or used to train one. That is the promise in the

formation-consent text at /legal/formation-consent, and it is not

qualified by anything below.

One thing does leave this site, and you should know exactly what.

If you send in a feedback report or a problem report, a member of

staff may decide to escalate it. Escalation is a person's decision,

never automatic. When it happens:

  • The title and text of your report are copied to an issue on the Operator's own issue tracker at git.nwpcode.org.
  • Your name, username, and email address are not copied with it. The issue identifies you only by a reference number that staff can look up back on this site.
  • If your report touches belief, teaching, or anything personal to you — the examen, confession, spiritual direction, conscience, or your own formation record — the text is not copied at all. Only a classification and a link back to this site are sent, and a report that cannot be classified is treated as though it were personal.
  • A member of staff may then mark that issue as eligible for an automated helper, which proposes a draft change for a person to review. The helper may only draft: it cannot approve, merge, or publish anything.

That helper is an AI assistant, and it runs outside this site. So the

text of an escalated report — but not your identity, and not anything

withheld under the rule above — may be processed by an AI service. If

you would rather that never happen to something you want to tell the

Operator, use privacy@nwpcode.org or our contact form at /contact

instead of the feedback form; correspondence sent that way is not

escalated to the issue tracker.

5. How long data is retained

  • Account data: retained while your account is active and for up to 12 months after account termination, then deleted.
  • Submitted contributions: retained indefinitely as part of the site's content history; you may request your name be removed from attribution per §6 below.
  • Server logs: retained for up to 90 days for debugging and security purposes, then rotated out.
  • Email correspondence: retained at the Operator's discretion.

6. Your rights

Under the *Privacy Act 1988* you have the right to:

  • Access the personal information held about you
  • Correct information that is inaccurate or out of date
  • Request deletion of your account data (subject to §5 retention of submitted contributions for content-history purposes)
  • Be removed from attribution on contributions you have previously made
  • Complain to the Operator, and if unresolved, to the Office of the Australian Information Commissioner (OAIC)
  • Withdraw consent to optional processing at any time

Email privacy@nwpcode.org, or use our contact form at /contact, to exercise

any of these rights. Reasonable requests will be honoured within 30 days.

7. Cookies and similar technologies

The site uses session cookies necessary for authentication. No

third-party tracking, advertising, or analytics cookies are set.

8. Age

This site is offered to adults. You must be at least 18 years of age

to hold an account; it is not directed at children, and accounts are

not offered to anyone under 18.

9. Changes to this policy

When this policy is updated, you will be required to re-accept the

new version on next login. The version number is at the foot of this

document, in §12, and it changes when the policy is materially

updated.

10. Contact + complaints

For privacy questions or to exercise any right above, email

privacy@nwpcode.org or use our contact form at /contact. If you believe a privacy breach has occurred and

the Operator's response is not satisfactory, you may also lodge a

complaint with the OAIC at oaic.gov.au.

11. Governing law

This policy is governed by the laws in force in Victoria,

Australia.

12. Version of this document

This is version 4 of the Privacy Policy. The version number is

recorded here, at the foot of the document, and in the record of your

acceptance. When it changes you will be asked to re-accept this

policy on your next login.