Privacy Policy

This policy explains what The Treasure Experience² does with personal information collected through this website, including the member portal. It applies to visitors, Community members and Charter members.

Our postal address is available on request through the contact form.

Account information. When you create an account we ask for your name, your email address and a password. We store your name and email. We never store your password: it is put through bcrypt, a one way hashing function, and only the hash is kept. Nobody here can read your password, including us.

Session information. When you sign in we set one cookie, named te_member. It holds a random session identifier and nothing else. It is httpOnly, so page scripts cannot read it, and it expires after thirty days. It is strictly necessary to keep you signed in, which is why there is no cookie banner asking you to opt in to it. We set no advertising or analytics cookies.

Contact form. If you write to us we receive your name, email address, chosen topic and message. That message is delivered to our inbox by email. It is not written to the member database.

Server logs. Our hosting provider records ordinary web server logs, which include IP addresses, timestamps and the pages requested. These are used to keep the site running and secure.

Payment information. Charter membership is not open for sign up at the time of writing. When it opens, payment will be handled by Stripe. Card numbers go to Stripe directly and never reach our servers. We would store only a Stripe customer reference and the date your Charter membership began.

We do not sell your personal information, and we do not share it for cross context behavioural advertising.

There is no analytics, advertising or session recording code on this site.

Typefaces are served from our own servers, so loading a page does not tell a font provider that you visited.

Video on the public pages is served from our own servers. If you watch a live stream or a replay in the member portal, that video may be delivered by a specialist video provider, and your IP address will be visible to them in order to deliver it.

To create and maintain your account and keep you signed in.

To verify your email address, and to let you reset a forgotten password.

To give you the parts of the portal your membership level opens.

To answer what you send us through the contact form.

To keep the site secure, prevent abuse and diagnose faults.

To take payment and grant Charter membership, once Charter opens.

Where the law requires a lawful basis, ours is the performance of our agreement with you for your account and your membership, our legitimate interest in a secure and working website, and your consent where you have given it.

We use a small number of service providers, and only for the purposes above:

Railway, which hosts the site and stores the member database.

Resend, which delivers our email, including verification and password reset messages and anything you send through the contact form.

Stripe, which will process payments when Charter membership opens.

We may also disclose information if the law requires it, or to establish or defend a legal claim.

Your account is kept until you ask us to delete it.

Sessions expire thirty days after you sign in, and are deleted when you sign out.

Password reset links expire two hours after they are issued, and using one signs out every other session on your account.

Contact form messages stay in our email for as long as we need them to deal with what you wrote about.

You can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it and close your account.

Depending on where you live you may have further rights, including under the UK and EU General Data Protection Regulation and the California Consumer Privacy Act, such as the right to object to processing, the right to data portability and the right not to be discriminated against for exercising a right. We do not sell personal information, so there is nothing to opt out of on that front.

Use the contact form and we will deal with it.

If you are in the UK or the EU and think we have got something wrong, you may complain to your national supervisory authority.

The site and its database run on servers in the United States. If you are outside the United States, using this site means your information is transferred there.

Passwords are hashed with bcrypt. The session cookie is httpOnly and, in production, is only sent over HTTPS. Access to the member database is limited to the people who run the site.

No system is perfectly secure. If we ever discover a breach affecting your personal information we will tell you and the relevant regulator as the law requires.

This site is not directed at children, and we do not knowingly collect personal information from anyone under thirteen. If you believe a child has given us information, tell us and we will delete it.

If we change this policy we will change the date at the top of this page. If the change is significant we will tell members by email.