Privacy and newsletter preferences

What we collect

Browsing does not require an account. If you register interest in local updates, we store your email address, chosen neighbourhoods, consent text and version, consent time, subscription status and the canonical page where you signed up. Do not submit children’s names, dates of birth or other information about children.

Capture-only, not confirmed membership

Your valid new signup is stored as pending and unconfirmed. Email delivery is not active during the pilot. Signing up does not send a confirmation or campaign email, and we do not claim a sending schedule or completed double opt-in.

Service protection and cookies

Signup and preference controls use a strictly necessary, signed anti-abuse browser cookie called __Host-small_outings_client. It lasts up to 30 days and is HttpOnly, Secure and SameSite=Lax. It gives the browser an opaque request budget, not an advertising identity. Shared rate limits also protect the service. No subscriber email or private receipt token is sent to analytics.

Aggregate form measurement

We count displayed signup forms and accepted submissions by day, canonical source page and neighbourhood. These counters contain no email address, raw IP address, private token, session ID or tracking cookie. They count events, not unique people. A signup with several areas may contribute to several area counters.

Your private browser receipt

After a signup request, the form keeps an opaque capability receipt in the open page’s memory. It is never put in a URL or analytics. Keep the page open to update the selected areas or stop updates using its buttons. Closing or reloading the page loses that receipt. The database stores token hashes rather than the original receipt.

To protect existing registrations, signing up again anonymously cannot retrieve an existing receipt, replace its preferences or reactivate an unsubscribe. Responses remain generic, so the form does not reveal whether an email address is registered.

Unsubscribe, access and deletion

The current browser receipt can authorize an explicit unsubscribe request. This stops updates and removes area preferences, while retaining the email and consent records for suppression and audit. Unsubscribing is not a claim of complete deletion. For access, correction or deletion requests, use the contact below if available. We retain information while needed for the pilot and to respect consent and suppression choices.

Providers and external links

Subscription records are stored in the Small Outings PostgreSQL database, which remains the authority for consent and preferences. The integration is prepared for Resend as the email delivery provider, not as our consent database. Sending is switched off. A separately approved confirmation would share only the address and confirmation message with Resend; signed delivery and suppression callbacks store minimal event identifiers and status, not raw message payloads. Private email links use fragments that are removed from the address bar on opening, and require an explicit button POST; merely opening a link never confirms or unsubscribes. Bounces, complaints and provider suppression block future delivery without granting consent. Hosting and font-delivery providers process connection data to deliver the service. Organiser links take you to separate sites with their own policies. We do not sell newsletter addresses.