Proposed policy · Not adopted
Privacy and Data Handling
Implemented platform behavior
When intake is enabled, forms store the submitted fields, contact email, consent version, reference ID, workflow status and review notes in a private SQLite database. These records are visible only through protected administration and are not published automatically.
Account and security data
The existing single administrator account uses a password hash in a server environment file. A signed session cookie contains authentication and CSRF state, with an eight-hour authenticated lifetime. Persistent intake rate limits store a keyed hash of the client address and time, not the raw address. Old rate-limit events are purged after 24 hours when intake is used.
Hosting and third parties
The existing deployment uses DigitalOcean hosting, Cloudflare DNS/proxy services and Let’s Encrypt certificates. Nginx and the backend can produce access and error logs; retention, provider processing terms and whether logged query strings contain personal data require review. No email or third-party form delivery is implemented.
Retention and deletion
No automatic deletion of submissions or audit records is implemented. An administrator can delete a submission through protected review; private backups may retain earlier copies. Leadership must approve retention periods, backup expiry, a deletion-request process and a contact destination before live intake is enabled.
Access and inquiries
Intake is disabled by default pending review of access, retention and the privacy notice. The contact form follows the same intake gate. No privacy contact email has been supplied; leadership must provide a working contact channel before launch. Do not submit passwords, credentials, confidential source code or unnecessary personal information.