Privacy on StayCyberSafe Learn

Who we are

StayCyberSafe is run by one person in Australia. Contact: contact@staycybersafe.online.

Pages you can use without an account

The home page, glossary, directory, business page and the policies don’t require an account, and we don’t record who reads them.

What we store if you create an account, and why

This list matches exactly what our database holds. If it changes, this page changes at the same time.

• Your email address, stored once you’ve used a sign-in link. It’s your account identifier, and it’s where we send sign-in links.
• Account creation date.
• Sign-in links you’ve requested: the email address, a scrambled (hashed) copy of the link, and when it was created and used. These records are deleted once they expire, 15 minutes after the link was sent. Addresses that never complete a sign-in don’t become accounts.
• Sign-in sessions: a scrambled copy of your session cookie and its expiry date (30 days).
• Lessons you’ve marked complete, and when.
• Your plan and subscription status from Paddle: which plan (Pro or Premium), Paddle’s customer and subscription IDs, the subscription status, and when the current billing period ends. We never receive or store card details.
• Feed preferences, if you set them: the devices, topics and industry you ticked, and when you last saved them. They’re used only to choose what appears in your feed.
• Your feed link, if you make one: a scrambled copy of the secret part of the link, and when it was made.
• The times you ran an Exposure Check, kept for 24 hours to enforce a usage limit. We don’t store the results.

We don’t store your IP address, browser details or location, and we don’t run analytics or advertising.

Cookies

We set one cookie, __Host-scs_session, which keeps you signed in. It is essential, can only be sent to this subdomain, and can’t be read by scripts. Our hosting provider, Cloudflare, may set short-lived security cookies. During sign-in, your browser’s session storage briefly remembers which page to return you to.

Who else handles your data

• Cloudflare hosts the site and the database.
• Resend sends sign-in emails, so it receives your email address.
• Paddle is our reseller and merchant of record. If you choose a paid plan, Paddle collects your payment details, billing address and email under its own privacy policy. The plan page loads Paddle’s script from cdn.paddle.com, and only that page does.
• Have I Been Pwned: when a Pro or Premium member runs an Exposure Check, we send their email address to HIBP’s API to look it up.
• Your feed reader: if you add your feed link to a reader app or service, that service fetches your feed. It sees the items selected for you, not your email address.

Some of these providers process data outside Australia, including in the United States.

Deleting your data

You can delete your account from the account page at any time. It immediately removes everything listed above from our database. Paddle keeps its billing records for as long as tax law requires.

Questions and complaints

Email us first and we’ll respond within 30 days. You can also contact the Office of the Australian Information Commissioner (oaic.gov.au).