Privacy Policy

1. Overview

Unsolicited Musings is a small, editor-run literary project. This policy explains what personal information we collect across the Workshop and the Magazine, why we collect it, and what choices you have about it. We aim to collect the minimum needed to run the project well.

2. What we collect

Account and profile

• Your email address, and the display name you choose to be known by.
• Your first and last name, if you give them. We use these only to offer them as a byline when you opt a piece into the Magazine.
• An optional short bio (up to 280 characters) and an optional profile photo.
• Your role on the Platform — member, judge, or owner.
• Who invited you, and any invitations you create for other people.
• Every display name you have previously used, kept so that old links to your work still resolve and so a name you’ve left behind can’t be taken by someone else.
• Your confirmation that you are 18 or over, and when you gave it.
• Which version of the Terms of Service you accepted and when, and — for each text — which version of the submission agreement you accepted and when.

If you asked to join through the public form

• Your email address, the two-line answer you wrote, and the prompt you were shown when you wrote it.
• Whether you pledged that the words were yours, and when.
• The outcome of your application, when it was decided, and which invitation was issued to you if you were admitted.

If you apply again in a later month, your new answers replace the old ones on the same record.

Content you create

• Your texts and drafts. Drafts are private to you until you submit them.
• For each submitted text: the length and form you chose, whether you opted it into the Magazine, the byline you chose, and the date and time of that consent.
• Votes and reactions you give, and any private notes you send to another member. A note carries your name to the member you send it to.
• Pieces you mark as favourites, which are private to you.
• Members you mute or block, which are private to you.
• Reports you make about a text or a note, and the reason you give.
• Suggestions and requests you send us. These always record who sent them, even when you send one anonymously — “anonymous” withholds your name from display, so that a candid message stays candid without becoming an unaccountable one.
• If a piece of yours is edited for the Magazine: your replies to the editors’ notes, your answer to each suggestion, the line you write when you send the piece back, and a copy of the piece as it stood each time it changed hands.
• If you’re a Judge or an editor: the scores and ballots you submit during curation, and the notes, suggestions and corrections you make on a piece.

Settings and housekeeping

• Whether you have opted out of email, and whether you have opted in to early features.
• If you have asked to close your account: the date you asked, held for the grace period described in Section 8.

Automatically, to run the site

We count page views, using Cloudflare Web Analytics. It tells us how many times a page was opened, which page, roughly which country the reader was in, and which site they came from. It sets no cookies, stores nothing on your device, and does not build a profile or follow you to any other site — there is no identifier that could join two of your visits together, or join a visit to your account.

There is still no Google Analytics, no product-analytics SDK, no advertising pixel and no third-party tracking cookie, and the only cookies we set are the ones that keep you signed in. Before 10 September 2026 there was no analytics at all; we added it to learn whether anyone is reading the Magazine, and chose the least invasive tool we could find rather than the most informative one.

Our hosting, database, and anti-spam providers keep short-lived technical logs — things like IP address, browser type, and the time of a request — as a normal part of serving and securing the site. We don’t use those logs to build a profile of you, and we don’t combine them with your account.

3. Who can see what

• Your drafts: only you.
• A text you have submitted to an issue: signed-in members, and the editorial team.
• A text published in the Magazine: anyone on the internet, alongside the byline you chose for it.
• Your display name, bio, and profile photo: signed-in members. Profile photos are stored in a public file bucket, which means the image file itself can be opened by anyone who has its address, even without signing in.
• Your email address: never shown to other members.
• Your favourites, mutes, and blocks: only you. The person you mute or block is never told.
• A private note: the author you sent it to — signed with your name — and the editorial team if it is reported.
• The editing of a piece (notes, suggestions, replies and earlier versions): you and the editorial team. Other members never see it, or that a piece is being edited. The editors’ notes reach you signed “the editors”, not with a name.
• Judges’ scores: hidden from authors, and author names are hidden from Judges while they score.

4. How we use it

• To operate your account and the writing, submission, reading, and voting features described in the Terms of Service.
• To run the join process: to read the answers you send, decide on applications, and issue invitations.
• To run each issue’s curation: members’ votes and Judges’ scores are tallied to help decide which texts are published.
• To keep the Platform safe: to review reported texts and notes, to act on breaches of the Terms, and — through our anti-spam provider — to keep automated sign-ups off the join form.
• To send a small number of emails: that an issue has opened or is closing soon, that pieces are waiting to be read, that your text was selected, the issue announcement, invitations and their outcomes, editorial notes on your piece, account emails such as confirming your address or resetting your password, and — for Judges — voting reminders. We don’t send marketing email, and every non-essential email carries an unsubscribe link.

On automated processing

The tallying of votes and scores is automated: the arithmetic that ranks an issue’s submissions is done by software, not by hand. It does not by itself decide anything — the final selection is made by the editorial team, who can and do depart from the ranking. No decision about you is made solely by automated means, and none of it produces a legal or similarly significant effect. We disclose it here in plain terms, in line with Australian requirements for automated decision-making disclosure taking effect in December 2026.

We do not use AI services to process your personal information or your texts. If that ever changes — for example if we add translation — we will update this policy and tell members before it happens.

5. Who this applies to, and which laws we consider

As a small Australia-based project, we currently fall under the small-business threshold for much of the Australian Privacy Act — that exemption has not yet been formally removed, though the government has signalled it intends to phase it out and the process is ongoing. We handle your information responsibly regardless of whether the exemption technically applies to us. A separate Children’s Online Privacy Code is expected to take effect on 10 December 2026, which is part of why this Platform is limited to adults (see Section 9). If you’re located in the EU or UK, we apply GDPR-consistent practices — including a clear basis for processing and your right to request deletion — regardless of our size or location.

6. Who we share information with

We don’t sell personal information, and we don’t share it for advertising. We share it only with the services that help us run the Platform:

• Hosting: Vercel, which hosts the site and runs its server-side code. Our deployment is pinned to Vercel’s Sydney region.
• Database and account sign-in: Supabase, which provides our database, account sign-in, and file storage for profile photos. Our Supabase project is hosted in Sydney, Australia.
• Email delivery: Resend, which delivers the emails described in Section 4.
• Anti-spam: Cloudflare, whose Turnstile check runs on the join form to keep automated sign-ups out. Cloudflare receives the IP address and browser details of anyone who submits that form. Cloudflare also serves as the DNS provider for our domain.
• Backups: GitHub, which stores a copy of our database each night — accounts, writing, notes and votes included — and keeps each copy for 90 days, so the club's writing survives a disaster at our database provider.

We may also disclose information where the law requires it, or where it is necessary to protect someone’s safety.

7. Where your information is stored, and sending it overseas

Your account, your writing, and your profile photo are stored in Australia: our database and file storage are hosted in Sydney, and the site’s server-side code runs in Sydney too.

Our providers are nonetheless United States companies, and some information necessarily leaves Australia:

• Email you receive from us passes through Resend, which means your email address and the contents of that email are processed overseas in the course of delivering it.
• The anti-spam check on the join form is handled by Cloudflare, on whichever of its servers is nearest to you — which may be anywhere in the world.
• Our providers keep short-lived operational and security logs, which may be stored or accessed outside Australia.
• Our nightly database backups are stored with GitHub, on servers outside Australia.

By using the Platform you consent to your information being handled this way. We take reasonable steps to use established providers that publish data-processing terms and standard contractual clauses, and if you are in the EU or UK those clauses are the basis on which your information travels.

8. How long we keep it

• Drafts are kept until you delete them or submit them.
• Submitted texts are kept as part of the issue you submitted them to.
• The record of a piece’s editing is kept for as long as the piece is, and deleted with it.
• Published texts remain part of the public Magazine archive unless you ask us to remove them — see Section 11.
• Account information is kept while your account is active.
• Technical logs held by our providers are short-lived and kept only as long as those providers retain them.
• Copies of your information can persist in our nightly backups for up to 90 days after it has been deleted from the live site.

What happens when you close your account

Nothing is destroyed straight away. Closing your account starts a 30-day window, and signing back in at any point during it cancels the whole thing — there is nothing to undo and nobody to email. Before the window even starts, we send you an archive of everything you have written; if that email can’t be sent, the closure doesn’t proceed.

At the end of the 30 days:

• your unsubmitted drafts are deleted outright;
• your display name, email address, first and last name, bio, and profile photo are erased and replaced with an anonymous handle;
• your sign-in is permanently disabled.

What remains is what could not be removed without unpicking other people’s reading: texts you submitted or published, and the votes and reactions you gave, stay in place with no name attached to them. A piece already published in a Magazine issue stays published unless you separately ask us to remove it (Section 11). Private notes you sent remain with the members you sent them to.

9. Children

The Platform is intended for adults aged 18 and over. We don’t knowingly collect information from anyone younger, and eligibility is self-confirmed at signup. If we learn that an account belongs to someone under 18, we will close it and delete the information we hold about them.

10. Security

Traffic to the site is encrypted in transit. Access to the database is governed by per-row rules, so members reach their own information and the pieces they’re entitled to read, rather than everything. Administrative access is limited to the people running the project. No system is perfectly secure, and we can’t guarantee that one is — but if something goes wrong that affects you, we will tell you.

11. Your choices and rights

• You can download everything you have written, at any time, from your account page — you don’t need to ask us.
• You can ask for a copy of the personal information we hold about you.
• You can ask us to correct anything inaccurate, and you can edit your name, bio, and photo yourself.
• You can ask us to delete your account and the personal information attached to it, subject to Section 8.
• You can ask us to take a published piece down, or to take your name off it and leave the piece up. These are different requests — please say which you mean.
• You can opt out of non-essential email through the unsubscribe link in any email we send.
• If you are in the EU or UK, you also have the rights GDPR gives you, including objecting to processing and asking for your information in a portable form.

If you are unhappy with how we have handled your information, please tell us first — we would rather fix it. You can also complain to the Office of the Australian Information Commissioner (oaic.gov.au), or, if you are in the EU or UK, to your local data protection authority.

• To make any of these requests, write to privacy@unsolicitedmusings.org.

12. Changes to this policy

If we make a material change to how we handle your information, we’ll notify members before it takes effect. Each version of this policy is dated.

13. Contact

For anything about this policy, or to make a request under Section 11: privacy@unsolicitedmusings.org. For anything else: hello@unsolicitedmusings.org.