Privacy Policy

DRAFT -- needs review by Scott and a lawyer before publishing.

Based on the privacy policy written for the website-dd-1st redesign, extended for accounts, the online services, payments, comments, and email. Every factual claim about how the systems behave must be checked against the real setup before this goes live. Those claims are marked [TBD]. The website-dd-1st README lists the same concerns: a confidently wrong privacy policy is worse than none.

---

This page explains what information Duensing Digital collects, why we collect it, where it's kept, who else sees it, how long we keep it, and how you can get it corrected or deleted.

It covers this website (https://test.duensing.digital), your account, the online services (search, Nextcloud, Minarca, Linkwarden, and Vaultwarden), events booked through the site, and the work we do on your computers and devices.

[TBD: whether kangaroopunch.com, which runs on the same server with its own user accounts, gets its own policy or is covered by this one.]

The Short Version

• No ads, no analytics, and no tracking. Nothing on our pages loads from another company's server.
• We collect what we need to run the things you ask us to run, and we use it only for that.
• Your files, backups, bookmarks, and passwords are yours. We don't look through them, sell them, or use them to train AI.
• Payments are handled by PayPal and Stripe. We never see your full card number.
• [TBD: Scott to confirm.] We have never sold, rented, or traded anyone's personal information, and we won't.
• You can download your data or delete your account at any time.

Who We Are

Duensing Digital [TBD: legal name and type of business], 302 W Washington St, Freeburg, IL 62243.
Email: scott@duensing.digital. Phone: 618-228-2235.

When this policy says "we", it means Duensing Digital.

When You Visit This Website

Our web server keeps a log of each request: your IP address, the page you asked for, the time, the page that linked you here, and the browser and operating system your browser reports. We use the log to keep the site working and to spot attacks. [TBD: confirm exactly what the reverse proxy and Saltcorn log.]

There is no analytics on this site: no Google Analytics, no Facebook pixel, no heatmaps, and no session recording. No fonts, scripts, images, or maps are loaded from anyone else's server, so reading a page here doesn't tell any other company that you visited.

[TBD: confirm that no third party sits between visitors and the server, such as a CDN or a DDoS-protection proxy. If one does, it sees every visit and must be named here, and the paragraph above must change.]

When you pay for something, you are sent to PayPal's or Stripe's own website to pay. Our pages never load their scripts. They only learn about you when you choose to go to their site.

Links to other websites (for example, the map link on our contact page, or Kangaroo Punch Studios) take you to sites with their own privacy policies. Nothing is sent to them unless you click.

Cookies

We don't use advertising or tracking cookies.

We use cookies only to make the site work:

• a session cookie that keeps you signed in (it lasts longer if you tick "Keep me signed in");
• a security token that protects forms from being submitted by other websites. Visitors who aren't signed in get the session cookie too when they use the contact form, because it holds that token; with cookies blocked, the form can't be sent.

[TBD: confirm the complete list by inspecting what Saltcorn, the theme and our plugins actually set, including on the sign-in pages used by the online services.]

Each online service (Nextcloud, Minarca, Linkwarden, and Vaultwarden) sets its own cookies on its own address to keep you signed in. They run on our servers and are used for the same purpose.

Your Account

When you create an account, we keep:

• your email address, username, and display name;
• your password, stored in a form we can't turn back into the password;
• your two-step sign-in secret, if you turn it on;
• your app passwords, stored in a form we can't turn back into the passwords;
• that you confirmed your age and accepted our terms, and when;
• whether your email address has been confirmed;
• your notification settings.

[TBD: whether sign-in times and IP addresses are recorded for security, and for how long.]

We use this to run your account, sign you in, keep it secure, and send you the emails described below. Your display name appears next to your comments and is public. Your email address is never shown to other users.

Signing In to the Online Services

Your one account signs you in to every online service. When you sign in to a service, our sign-in system tells that service who you are: your username, email address, and display name. [TBD: confirm the exact details each service receives.] All four services run on our own servers.

To share your storage between Nextcloud and Minarca, we check how much space each one is using every 5 minutes, and adjust the limit each service enforces. We read totals, not your files.

What You Keep in the Online Services

What you store in Nextcloud (files), Minarca (backups), Linkwarden (bookmarks and saved copies of pages), and Vaultwarden (passwords) is yours. We don't scan it, index it for advertising, use it to train AI, or give it to anyone else.

The people who run the servers can technically reach what's stored on them, because someone has to maintain and back them up. We don't look through your things. We would only look at a specific item:

• if you ask us to, for example to help with a problem;
• to investigate a report that it breaks our Acceptable Use Policy;
• if the law requires it (see "Who We Share Information With").

Vaultwarden is different. Your vault is encrypted on your own device with your master password before it reaches us. We can't read what's in it, and we can't recover it if you forget your master password.

[TBD: whether files in Nextcloud and backups in Minarca are encrypted on disk. Neither is end-to-end encrypted unless you set that up yourself. Say so plainly once confirmed.]

When Linkwarden saves a copy of a page you bookmark, our server fetches that page. The website you bookmarked sees a request from our server, not from you. [TBD: Linkwarden can also send bookmarked addresses to the Internet Archive's Wayback Machine. Confirm whether that option is off, or on and under each user's control, and say which.]

Where it's kept: on hardware we own and run. [TBD: location. The website-dd-1st policy said "hardware in Freeburg, Illinois"; the live site says only "entirely local".] It is not stored with a cloud provider.

[TBD: offsite backups. PLAN.md calls for offsite backups of the site database and file store. If any copy of user data is stored with a third party (a backup or storage provider), name it here, say whether the copy is encrypted before it leaves our hardware, and adjust the sentence above.]

Search

Our search engine (https://search.test.duensing.digital) runs SearXNG. You don't need an account to use it. It sends your search to other search engines from our server, so they see our server's address instead of yours. They do see the words you searched for.

[TBD: confirm how SearXNG and the web server in front of it are configured: whether searches or IP addresses are logged, and for how long. Do not publish "we don't log searches" until that's checked.]

Payments

When you buy storage, pay for an event, or make a donation, you pay on PayPal's or Stripe's website. You give them your payment details, not us. We never see or store your full card number.

They send us a reference for the payment, the amount, the currency, whether it succeeded, and [TBD: the other details each provider returns, for example the payer's name and email from PayPal, and the card brand and last four digits from Stripe].

We keep a record of each order and payment: what you bought, when, the price, any tax, which provider you paid through, and their reference. If tax applies, we also keep the location details needed to work it out: [TBD: the fields actually collected, which depend on the tax rules decided in PLAN D6].

PayPal and Stripe are responsible for what they do with the information you give them. See their own privacy policies: [TBD: links].

Comments, RSVPs, and Events

Comments are public. They show your display name, the date, and what you wrote. If you delete a comment, [TBD: match account.md -- is it removed, or replaced by a placeholder?]. If you report a comment, only moderators see who reported it.

When you RSVP to an event, we keep your name, the number of seats, and your place on the waitlist if there is one. We use them to run the event. [TBD: whether attendee names are ever shown to other attendees. PLAN.md describes attendee lists for administrators only.]

Our blog posts are also published on social networks. That sends our posts to those networks, not anything about you.

Contact Messages, Email, and Phone Calls

If you call, email, or use the contact form, we keep what you send: your name, how to reach you, and what you asked about. We use it to answer you and to remember what we did last time, which is useful when the same computer comes back.

Messages from the contact form go into an inbox that only the site's administrators can see, and a copy is emailed to us, so it also sits in our mailbox [TBD: which mail service carries and stores those copies]. We may add a short note to a message for ourselves, such as what we did about it. Contact messages aren't linked to an account, so "Download my data" and account deletion don't include them; ask us and we'll find yours by your email address.

To stop the form being flooded, we keep a scrambled fingerprint of your network address (not the address itself) for about an hour. If the form shows you an error, what you typed is held for up to ten minutes so you don't have to type it again.

We send email only for things you've asked for or need to know about:

• account emails: address confirmation, password resets, and security notices;
• receipts, renewal notices, and payment problems;
• replies to your comments and reminders for events you've RSVPed to, if you turn those on.

We don't have a mailing list and we don't send marketing email. [TBD: confirm.]

[TBD: how outgoing email is sent. If it goes through a third-party sending service rather than our own mail server, name the service here. It will see the address, subject and contents of every email we send you.]

Work on Your Computers and Devices

Repairing a computer sometimes means seeing what's on it. We look only at what we need to in order to fix the problem you brought us. We don't copy your files except where the job needs it, and we don't discuss what was on your device with anyone.

If we recover data for you, you get it back and we delete our copy [TBD: confirm the practice: when the copy is deleted, and whether it can end up in any backup].

[TBD: what happens to data on devices dropped off for e-recycling -- wiped, destroyed, or offered back. Match the e-recycling page.]

Who We Share Information With

We don't sell, rent, or trade personal information, and we don't pass it to advertisers, data brokers, or AI companies.

We share information only:

• with PayPal and Stripe, when you choose to pay through them;
• with [TBD: any service providers that end up holding data on our behalf -- email sending, offsite backup, domain or network providers -- each named, with what it receives];
• when the law requires it. If we receive a valid legal order, we must comply. If we're allowed to tell you about it, we will.

[TBD: lawyer -- what happens to this information if the business is sold, closed or transferred.]

How Long We Keep Things

Your Choices and Rights

• See your data. Use "Download my data" on your profile page. It covers what this website holds about you. Each online service has its own export, explained on that page.
• Correct it. Edit your profile, or ask us.
• Delete it. Use "Delete my account" on your profile page, or ask us.
• Stop emails. Turn off reply and event notifications on your profile page. Account, security, and billing emails can't be turned off while you have an account, because they tell you about changes to it.

You can also email scott@duensing.digital or call 618-228-2235 and tell us what you want. You'll be dealing directly with the person who runs the systems. We may need to confirm it's really you before acting on a request.

[TBD: lawyer -- whether the laws that apply to you or to us (for example the GDPR for visitors in the EU or UK, or US state privacy laws) give you additional rights that must be listed here, with the time limits for answering requests.]

Security

Every page and service is served over an encrypted connection. Passwords are stored in a form that can't be turned back into the password. Two-step sign-in is available for every account. Payment details never pass through our servers.

No system is perfectly secure. If a security breach affects your information, we'll tell you [TBD: how and how quickly, as required by law -- for example the Illinois Personal Information Protection Act].

Children

Accounts are for people aged [TBD: minimumAge] and over. We don't knowingly collect information from younger children. If you think a child has given us information, tell us and we'll delete it.

Children are welcome at the museum and at events [TBD: confirm, and match the age policy on the events page]. That's separate from having an account.

[TBD: lawyer -- if minimumAge is ever set below 13, US law (COPPA) applies and this section must change.]

Changes to This Policy

If we change this policy, we'll change it on this page and update the date below. If a change affects how we use information we already have, we'll email account holders [TBD: how long] before it takes effect.

We won't quietly start doing something this page says we don't do.

Questions

Ask us anything about this policy, including the awkward questions. If any part of it is unclear, tell us and we'll fix the wording.

Email scott@duensing.digital, call 618-228-2235, or write to Duensing Digital, 302 W Washington St, Freeburg, IL 62243.

Last updated: [TBD: date of publication]