Privacy Policy
Short version: we only collect what's needed to run the site and forum, use no tracking or advertising cookies, keep your data in Australia (website) and Malaysia (email), and never sell it. You can download or delete your forum data at any time.
Last updated: 30 September 2026
1. Who we are
This policy explains how Grant Ardill, trading as GGA Designs, Sydney, NSW, Australia ("GGA Designs", "we", "us") handles personal information when you use ggadesigns.com, including the blog and the community forum. Grant Ardill is the data controller and can be contacted at grant@ggadesigns.com.
We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth). Because the website is open to visitors worldwide, we also follow the EU and UK General Data Protection Regulation (GDPR) for people in those regions, and give everyone the same rights described below.
2. What we collect and why
| What | When | Why (legal basis) | How long |
|---|---|---|---|
| Server logs: IP address, browser, page requested, time | Every visit | Keeping the site secure and working, and counting visits (legitimate interests) | 90 days, then deleted automatically |
| Download counts: anonymised IP (last part removed), browser, file | When you download software | Counting downloads (legitimate interests) | Kept as statistics; the IP can no longer identify you |
| Forum account: username, email address, password (stored only as a secure hash), optional bio, join and last-seen dates | When you create a forum account | Providing the account you asked for (contract) | Until you delete your account |
| Forum content: topics, posts, likes, reports you make | When you post or interact | Running the forum (contract); moderation (legitimate interests) | Until deleted by you or a moderator. When an account is deleted, its posts show as "deleted user" and their text is removed |
| Moderation records: bans, read-only periods, reports, and a log of moderator actions | When moderation happens | Preventing abuse and keeping the forum safe (legitimate interests) | Kept while needed to prevent repeat abuse |
| Sign-in sessions | When you sign in to the blog or forum | Keeping you signed in (contract; strictly necessary) | Up to 30 days (forum) or 8 hours (blog admin) |
| Emails you send us | If you email us | Replying to you (legitimate interests) | As long as needed for your enquiry and reasonable records |
Forum usernames, posts, bios and join dates are public. Email addresses are never shown publicly. We do not collect payment details, and we do not use your information for advertising or profiling. We never sell, rent or trade personal information.
The forum sends only service emails: confirming your email address, password resets, and moderation alerts to staff. There is no marketing and no mailing list.
Forum accounts that never confirm their email address are deleted automatically after 7 days.
3. Cookies
We only use cookies that are strictly necessary. We don't use analytics, advertising or tracking cookies, so we don't ask for cookie consent.
| Cookie | Purpose | Lasts |
|---|---|---|
gga_forum_sid | Keeps you signed in to the forum, and protects forms against forgery | Up to 30 days of inactivity |
gga_blog_sid | Keeps the site owner signed in to the blog editor | 8 hours |
The cookie notice and forum notices remember that you dismissed them using your browser's local storage. That information stays on your device and is never sent to us.
Our visitor statistics come from server logs, not cookies or tracking scripts.
4. Service providers and where data is stored
We use a small number of providers to run the site. They process data only to provide their service to us:
- Oracle Cloud Infrastructure: hosts the website, blog and forum, including the forum database and server logs, in a data centre in Sydney, Australia.
- Hostinger: hosts our email server (MeetrMail), which sends the forum's service emails and receives email sent to us, in a data centre in Malaysia.
- Google: only if you choose "Continue with Google" to sign in. Google tells us a unique account ID and, if confirmed, your email address. Google handles this under its own privacy policy.
Fonts, styling and scripts are served from our own server, so simply visiting a page sends nothing to third parties. Some blog posts may embed videos from YouTube (privacy-enhanced mode) or Vimeo; those services receive your IP address when a page with a video is opened. Links to social media only contact those services if you click them.
International transfers. If you are in the EU or UK, your data is transferred to Australia and Malaysia, which do not have an EU "adequacy" decision. We transfer it because it's necessary to provide the service you asked for (GDPR Article 49(1)(b)), and we protect it with the measures in section 5. We share personal information with other parties only where the law requires it.
5. Security
The whole site uses HTTPS encryption. Passwords are stored as bcrypt hashes, never in readable form. Email links for confirmation and password resets are single-use and expire quickly. Forum sign-in cookies are marked secure and HTTP-only. IP addresses in download statistics are anonymised. Access to server data is limited to the site owner. If a data breach is likely to cause serious harm, we will notify affected people and the relevant regulator as the law requires.
6. Your rights
Wherever you live, you can:
- see and download your data: forum members can download everything held about them from Settings → Your data
- correct it: change your email address and bio in Settings, or ask us
- delete it: forum members can delete their account in Settings → Delete my account, or ask us
- object to or restrict processing based on legitimate interests
- complain to a regulator
For anything you can't do yourself, email grant@ggadesigns.com. We reply within 30 days. If you're unhappy with how we handled your information, please contact us first. You can also complain to the Office of the Australian Information Commissioner, or, in the EU or UK, to your local data protection authority.
7. Children
The forum is only for people aged 16 or older, and you confirm your age when you sign up. The website is not aimed at children, and we don't knowingly collect personal information from children under 16. If you believe a child has created an account, contact us and we will delete it.
8. Changes to this policy
If this policy changes, the updated version will be published here with a new "last updated" date. Significant changes will also be announced on the forum.
- 30 September 2026: added the community forum, cookies, service providers and data locations, GDPR rights, and self-hosted fonts and styling (no third-party requests on page load)
- 22 September 2026: first version