Privacy Policy

Who this policy covers

This policy applies to visitors reading published articles and to authorised staff who sign in to the newsroom dashboard. It does not apply to third-party websites you may reach through share links (for example X, Facebook, or email clients).

Information we collect

Public readers

If you reject cookies, we do not record analytics about your visit.

If you accept cookies, we collect anonymous usage data about articles, including:

• page views on article pages;
• use of the on-site share buttons (copy link, X, Facebook, or email); and
• approximate time spent reading an article and how far you scrolled.

This data is stored in aggregate event records linked to an article, not to your name, email address, or a personal profile. We do not use advertising networks or cross-site trackers.

We also store your cookie choice itself so the site can remember whether you accepted or rejected optional analytics.

Staff dashboard users

If you have a staff account, we store the information needed to operate the dashboard, including your name, email address, password hash, role, account status, creation date, and last login time. Passwords are stored using one-way hashing, not as plain text.

Staff sessions use server-side session data so you can stay signed in while working in the dashboard.

Cookies and similar technologies

We use a small preference cookie, pnherald_cookie_consent, to remember whether you accepted or rejected optional analytics. Your choice is also stored in your browser’s local storage.

Optional analytics only run after you click Accept on the cookie banner. You can change your mind at any time using the Cookie preferences link in the site footer.

Staff login uses session cookies that are necessary for dashboard authentication. These are separate from the public analytics consent banner and apply only when you sign in as staff.

How we use information

We use collected information to:

• understand which articles are being read and shared;
• estimate how long readers spend on articles;
• operate, secure, and maintain the website and dashboard; and
• manage staff accounts and publishing workflows.

We do not sell personal information or use reader analytics for targeted advertising.

Sharing with others

We do not routinely share reader analytics with third parties. Share buttons may open external services under their own privacy policies if you choose to use them.

Hosting providers, backup systems, or other infrastructure used to run the site may process data on our behalf as part of normal website operation.

Storage and retention

Public analytics are stored in a separate on-site database (analytics.db) on the server running this project. Staff account data is stored separately from public article content.

Analytics for a deleted article are removed when that article is deleted. We otherwise retain analytics and account records for as long as needed to operate the site unless a longer retention period is required by law.

Security

We use technical measures appropriate to a small self-hosted site, including password hashing for staff accounts, CSRF protection on dashboard forms, and access controls on non-public routes. No online service can guarantee absolute security.

Your choices

You can:

• reject optional analytics cookies when prompted;
• reopen cookie preferences from the site footer and change your choice;
• stop using the site at any time; and
• ask the site operator about access to or correction of staff account information if you have dashboard access.

New Zealand privacy law

If you are in New Zealand, our handling of personal information is intended to align with the Privacy Act 2020 and its Information Privacy Principles, including collecting information for lawful purposes, keeping it secure, and being transparent about how it is used.

Changes to this policy

We may update this policy from time to time. When we do, we will change the “Last updated” date at the top of this page.

Contact

This is an independent fictional project. If you have a privacy question about a particular deployment of the site, contact whoever operates that instance of The Palmerston North Herald.

Staff with dashboard access should direct operational privacy questions to their site administrator.