Privacy policy

About this policy

This policy explains how the Mumblebone Digital Catalogue (digicat.mumblebone.com.au) collects, uses and discloses information about you. It is written for the Australian Privacy Act 1988 and the Australian Privacy Principles.

The catalogue is operated by Mumblebone, an Australian stud merino operation. If you have a privacy question or complaint, contact us using the details at the end of this page.

Information we collect

Information you give us

• Account details when you sign up: email address, password (hashed, never stored in clear text) and any display name you provide.
• Your shortlist of favourite lots, and any private notes you write against a lot.
• Messages you send through our contact form or by email.

Information collected automatically

• Standard server logs: IP address, browser type and version, device type, pages visited, the page that referred you and the time of each visit.
• Approximate location derived from your IP address (country and region, not street address).
• Anti-bot signals captured by Cloudflare Turnstile when you sign up or log in.
• Anonymous session recordings of your browsing on the catalogue, with every form input masked by default. We use these to debug problems and improve the site.

Cookies and similar technologies

We use cookies and browser storage for a few specific purposes:

• Essential: remembering you are signed in, caching your favourites and notes for offline use, and tracking whether you have dismissed the welcome popup.
• Analytics: Google Analytics 4 and PostHog set cookies to measure how the site is used. These can be disabled using the opt-out below.

Why we collect it

• To run your account, save your favourites and store your private notes.
• To understand how the catalogue is used and decide what to improve.
• To debug problems and recover from errors.
• To protect the site from abuse, bots and fraudulent sign-ups.
• To respond to your enquiries.

We do not sell your personal information. We do not use your information for targeted advertising.

Who we share it with

We use a small number of trusted service providers to run the catalogue. Each receives only the information they need to do their job:

• Supabase hosts the database and handles sign-in. Stores your account, favourites and notes. Data sits in Supabase infrastructure (United States). See supabase.com/privacy.
• Cloudflare serves the site and provides bot protection (Turnstile). See cloudflare.com/privacypolicy.
• PostHog processes product analytics and session recordings (United States region). All form inputs are masked before being recorded. See posthog.com/privacy.
• Google provides Google Analytics 4 and Google Tag Manager. See policies.google.com/privacy.
• YouTube (a Google service) hosts the lot videos. When you play a video the YouTube embed sets its own cookies. We use the privacy-enhanced embed (youtube-nocookie.com) where possible.

Where your data is stored

Your account and catalogue data is stored on Supabase infrastructure in the United States. Analytics data is processed by PostHog (United States) and Google (United States). Cloudflare serves the site from a global edge network. By using the catalogue you consent to your information being transferred outside Australia.

Your rights

You have the right to:

• Access the personal information we hold about you.
• Correct anything that is wrong or out of date.
• Delete your account and the data associated with it. Email us using the contact below and we will action it within 30 days.
• Opt out of analytics and session recording on this device, using the button below.
• Complain to the Office of the Australian Information Commissioner (oaic.gov.au) if you are unhappy with how we have handled your information.

Data retention

Account data is kept while your account is active and deleted on request. Server access logs are retained for up to 90 days for security and debugging. Analytics events are retained according to PostHog and Google's default policies.

Security

The site is served over HTTPS. Passwords are hashed using industry-standard algorithms before being stored. Database access is restricted by row-level security so users can only read and write their own favourites and notes. We take security seriously but no online system is perfectly secure.

Children

The catalogue is not directed at people under 18. If you believe a child has provided personal information to us, contact us and we will delete it.

Changes to this policy

We may update this policy as the site evolves. The "Last updated" date at the top of this page shows when it last changed. Significant changes will be communicated by email to account holders.

Contact us

For privacy questions or to exercise the rights above:

• Email: hello@mumblebone.com.au
• Post: Mumblebone, NSW, Australia