PRIVACY.

What this is

This page explains what personal information Goated Geese collects through this website and Discord, how we use it, and how you can access, correct or delete it.

We're an informal, unincorporated volunteer gaming community, not a company. This policy is written in plain language for exactly that kind of setup, not a certified legal compliance document.

What we collect

When you sign in and use the site, we collect:

1. 01 Your Discord user ID, username and avatar, from Discord sign-in (OAuth).
2. 02 Whether you're a member of the GG-AU Discord server and, if so, your role, checked at sign-in.
3. 03 Permission to add you to the GG-AU Discord server (Discord's guilds.join permission, shown on Discord's sign-in screen). We only use it when you sign in and you're not already in the server, to add you as a regular member with no clan rank. We never use it to add you to any other server.
4. 04 Your saved theme preference (light, dark or system).
5. 05 Whatever you submit on the clan application form.
6. 06 Your Steam ID, only if you choose to link a Steam account from the account page.
7. 07 Your Twitch or Battle.net account ID, your display name or BattleTag there, and the date you linked it, only if you choose to link that account from the account page. We never keep a sign-in token from those services.
8. 08 An optional about me line, and which parts of your profile you choose to show.
9. 09 If you answer an event sign-up in Discord (for example Going or Not going), your answer, your Discord user ID and your server display name, so the list on the event post stays current.
10. 10 Payment-related data, only if you support HONK financially: Stripe processes your payment, and we store a Stripe customer reference, your subscription or donation reference, and the amount. Your card details never reach this site.
11. 11 Your email address from Discord, to fill in the newsletter form on your account page for you. We don't save it in our database, except when you ask for email updates on a ban appeal (below).
12. 12 If you appeal a ban: your appeal, the messages you and staff exchange about it, and the decision. We keep these while they're relevant to moderation.
13. 13 If you tick the email box on a ban appeal: your Discord email address, stored with that appeal only, used only to tell you about replies and the decision, and deleted 7 days after the appeal is decided.
14. 14 If you open a support ticket: its category, subject, your messages and any links you add. We keep these while they're relevant.
15. 15 If you have the opt-in marketing role, the bot may now and then send you a pulse survey by direct message. Members are picked at random, and anyone with the opt-out role or who has opted out is never asked. Each survey asks one question to rate from 1 to 5, and you can add a comment if you want to. We store a rating without your Discord user ID. We store a comment with your server name so staff can follow up. We delete answers after the retention period, 365 days unless staff change it. You can opt out with the button on any survey message or with /pulse optout.
16. 16 So we do not ask you too often, we keep your Discord user ID and the day we last sent you a survey for the cool-down period, 90 days unless staff change it. A survey you have not answered carries your Discord user ID for up to 14 days after we send it, then we remove it. For those 14 days each survey also holds a scrambled code, made with a secret only our server knows, so we can check that whoever adds a comment or opts out is the person we sent it to. It cannot be turned back into your Discord user ID without that secret, and we delete it after the 14 days. If you opt out, we keep your Discord user ID on an opt-out list so we do not ask again, until you opt back in with /pulse optin.
17. 17 For everyone currently in the server, including people who never signed in to this website, we also store your Discord username, server display name, avatar, the date you joined and your role IDs. We refresh this every hour and remove it once you leave the server, except for the leave record described below. Staff use it to show the member list on the staff Members page, which only signed-in staff with the matching permission can open.
18. 18 If staff switch on the leaver log, then when you leave the server we store a leave record: your Discord user ID, your server display name, when you joined and the names of your roles. We post the same details to a staff channel. We keep a leave record for 90 days unless staff change that, then delete it.
19. 19 If staff switch on the welcome message, the bot may post in a channel when you join the server. The post uses your server display name.
20. 20 The bot only reads a message as a chat command when it starts by mentioning the bot, or by the command prefix if staff switch one on. We never store or log the text of your messages when you use a chat command.

How we collect it

We collect this information directly from you: when you sign in with Discord, when you make a change on the account page, and when you submit a clan application. We don't buy data from anyone else or collect it without you doing something on the site first.

When you link a Twitch or Battle.net account, that service tells us your account ID and name after you approve it on its own sign-in page.

How we hold it

Your account information is stored in a Postgres database on infrastructure we run ourselves.

When you're signed in, your browser holds a session cookie named __Secure-authjs.session-token. It's marked httpOnly, meaning a webpage's own JavaScript can't read it, and it lasts up to 30 days before you need to sign in again.

Pulse survey ratings are shown to staff with settings access as totals only. A comment shows the name of the member who wrote it. Both are deleted after the retention period of 365 days (staff can change it).

A leave record is deleted after 90 days unless staff change that period. It is only posted to a channel staff choose.

Why we use it

We use your information to check you're a member before showing you member-only pages and features, to show the roster, to review clan applications, and to remember preferences like your theme.

Your public profile

Every roster member has a profile page that anyone with the link can open. It always shows the same details the roster already shows: your Discord display name, avatar, rank and join date.

Your Discord username, your linked Steam, Twitch or Battle.net accounts and your about me only appear there if you turn them on from the account page, and they disappear again as soon as you turn them off, clear them or unlink the account.

Profile pages are kept out of search engines and the sitemap, so people only reach them through a link.

Who we share it with

We never sell your information, and we never hand it to advertisers.

Discord, Cloudflare and Google (the three services below) are all overseas companies, so using this site means some of your information may be processed outside Australia.

We share information with:

1. 01 Discord, since that's how you sign in.
2. 02 The staff reviewing your clan application, inside our own private Discord channels.
3. 03 Cloudflare, which runs the network and security in front of our website.
4. 04 Google, only if you turn on the Analytics cookie category below.
5. 05 Our own mail server (Postal), which sends the update emails you ask for on a ban appeal.

Cookies

This site uses three cookie categories: Essential (always on), Analytics and Performance monitoring. Analytics uses Google Analytics; Performance monitoring is Cloudflare's own site-speed tracking, which doesn't set any cookies at all. You choose your Analytics and Performance monitoring settings the first time you visit, and you can change them anytime with the Cookie preferences link in the footer.

We also keep an anonymous daily count of how often each page is viewed, which site a visit came from, and how often our Discord invite link is clicked. This count uses no cookies and does not store your IP address, device details or anything else that identifies you.

Essential cookies aren't part of that choice, since the site can't function without them:

1. 01 __Secure-authjs.session-token, our own sign-in cookie, so you stay logged in. This one is essential and isn't part of the cookie choice above.
2. 02 Cloudflare's own security cookies, for example __cf_bm, cf_clearance and _cfuvid, which keep out bots and abuse.

The Support Us page

If you back HONK through the Support Us page, you can choose a display name that shows up publicly there, next to other supporters. Choosing one is optional, you can stay anonymous instead and we'll list you as "A Supporter."

Your real Discord identity is never shown for a sponsor or a one-off donor. The only Discord identity we show publicly is for Discord's own server boosters, since that's Discord's own public boost list, not a disclosure we chose to make.

We never publish an individual donation amount. The Support Us page only ever shows a total, added up across every supporter for the month, never a figure tied to one person.

The newsletter

Signing in with Discord now also shares your Discord email address with us. We only use it to prefill the newsletter opt-in form on your account page, it's editable there, and we don't store it in our own database for this.

If you subscribe to the newsletter, your email, name and Discord ID are kept in Listmonk, the newsletter tool we run on our own servers, not on Discord's. Our own database only keeps a reference number linking your account to that subscription, never the address itself.

We use double opt-in for the newsletter, so nothing is sent to your address until you click the confirmation link in the email Listmonk sends you.

Every newsletter includes its own unsubscribe link, and you can also unsubscribe any time from the Newsletter card on your account page, which deletes your subscription record. This is how we follow the consent and unsubscribe rules of Australia's Spam Act 2003.

Your rights

You can access, correct or delete your own information at any time. Most of it, your Discord details and preferences, is visible and editable right there on the account page.

Account deletion is self-service too: there's a delete option on the account page, no need to email or ask anyone.

Pulse survey comments are stored with your server name, and the cool-down record with your Discord user ID, rather than tied to an account, so to have yours deleted before the retention period ends, ask in our Discord server (see Complaints & contact below). A survey you did not answer loses its Discord user ID within 14 days. A rating has no Discord user ID stored with it and staff never see it next to a name. If you also left a comment, that comment and your name are saved on the same record as the rating, so we could match the two.

How to complain and contact us

If you think we've mishandled your information, or you just have a question about this policy, the fastest way to reach us is in our Discord server. There's no formal company or office to write to, since GG-AU is an unincorporated volunteer community.

Changes to this policy

We might update this policy as the site changes or as privacy law changes. Australian privacy law is under active review at the time of writing, so nothing here should be treated as a permanent, unchanging legal position, check back if you want the current version.

We'll post about any meaningful change in Discord.