Privacy & data protection
He taonga tō raraunga. Your information is a taonga, and we treat it that way. This page explains exactly what Tārake collects, why, and how you can take it back.
What we collect
- If you have an account: your email address, a display name, and any stories, images or reports you submit.
- If you're just reading: anonymous page and story counts, the site that referred you, and which share button you pressed. No names, no accounts, no cross-site tracking by us.
- What we never store: your IP address, your precise location, or your password. Passwords are held only as a one-way hash by our authentication provider. Where we need to stop abuse we use a one-way fingerprint of your connection that cannot be turned back into an address.
How long we keep it
- Analytics records: automatically deleted after 90 days.
- Email delivery logs: automatically deleted after 90 days.
- Abuse-prevention counters: deleted after 48 hours.
- Your account and published stories: kept until you delete them.
These deletions run automatically every night — nobody has to remember to do it.
How it's protected
- Everything travels over encrypted HTTPS, enforced by strict transport security.
- Database access is deny-by-default: each record has a rule saying exactly who may read or change it, checked by the database itself rather than by the app.
- Uploaded images live in private storage and are served through a checked endpoint, never a public bucket.
- Two-factor authentication is available on every account, and is used on editor accounts.
- Passwords found in known public breaches are rejected at sign-up and password change.
- Submissions, reports and analytics are rate limited to prevent flooding and scraping.
- A strict content security policy, frame protection and referrer policy are applied to every page to limit what third-party code can do.
Advertising
Tārake carries Google AdSense advertising. Google may set its own cookies and use them to personalise ads. You can control this at Google My Ad Center. We do not share your account details with advertisers.
Your rights
Under the Privacy Act 2020 you can ask what we hold about you, correct it, or have it deleted. You don't need to email anyone — signed-in users can do both instantly from Account & security: download a full copy of your data as a file, or permanently delete your account and stories.
For anything else, or to raise a concern, contact us through the corrections page.