OurNews Privacy Policy
Version 1.11 · Last updated 14 October 2026
OurNews is a storytelling platform for schools, run by Bolsta Education Pty Ltd (ABN 15 693 606 996; “we”, “us”). This policy covers what personal information we collect, why, how we hold it, and how to access, correct or complain.
Who is responsible for what
- Everything a school publishes (its stories, photos and names) belongs to the school, which decides what to publish.
- We act on the school’s instructions, under our Data Processing Terms (ournews.school/trust/data-processing), and don’t use, analyse or share that content for our own purposes.
- For staff accounts, visitors’ book details, the email address a reader gives when reporting a story, and concerns raised with us from the hub, we decide why and how long we keep them.
What we collect, and why
- School staff account data. Names, work emails and sign-in records for staff who publish a school’s stories, to run and protect accounts.
- Visitors’ book data. A school can set a story’s Access to Email required so its photos and names are withheld until a reader confirms an email; we record the email, IP and time each time a reader signs the visitors’ book, and the school sees all three in its access log.
- School Content. Story text, photos, captions and each story’s Visibility and Access settings, held as processor under the Data Processing Terms.
- Story submission data. When someone sends a story to a school, through the school’s submission link, by email, or a QR code, we hold the email address they confirm, the name they give, and the submission itself, including any photos and PDFs, during intake, so the school can review it and turn it into a story. When the story is created, the sender’s name fills its credit line unless they asked to stay anonymous, and the school can change or remove it before publishing. The sender’s name is also kept with the story as a private contributor detail that readers never see; their email is kept with it for 30 days.
- Story reports. Anyone reading a published story can report it to the school. We hold the reason they pick, any photos they point to, what they write, and their email address only if they give one for a reply. We email the report to the school’s coordinators. We use the reporter’s IP address to limit how many reports can be sent, and we don’t store it with the report.
- Concerns raised with OurNews. When a signed-in member of a school’s staff raises a concern with us from the hub, we receive their message, their name, email and school, and the story it names, if any, by email at hello@bolsta.education. We don’t store it in the OurNews database.
We don’t hold class lists, parent or guardian details, student ID numbers, enrolment records, or a student information system feed, and don’t run facial recognition on any photo.
How long we keep it
| What | Kept for |
|---|---|
| Visitors’ book email address | 12 months, then deleted |
| Visitors’ book IP address | 90 days, then deleted |
| Anything removed (a takedown, a closed account) | Purged from backups within 7 days |
| Story submissions (raw email and intake payload) | Raw email removed once the story is seeded, with a 7-day backstop. Intake and contributor payload erased within 30 days. Photos and PDFs uploaded to the form but never sent: deleted within 2 hours |
| A school’s content and staff accounts, after account end | 30 days to export, deleted at day 30, backups purged by day 37 |
| Staff sign-in and security-event records | IP addresses 90 days, staff identity 12 months; the de-identified event record is kept while the school’s account is open and for 24 months after it closes, so a late-reported incident can still be investigated |
| Staff interest in an upcoming feature (a “coming soon” click) | Who clicked is cleared after 90 days; the count is kept |
| A story report’s email address, where the reporter gave one | 30 days after the report, then deleted |
| The rest of a story report | Until the story it is about is deleted |
How we handle it
- A school picks its region at account creation (Australia, the EU, the UK, the US or Singapore); content is stored there, encrypted at rest and in transit.
- No photo has a raw, public storage link; every image goes through our access-controlled route, checking the story’s Visibility and Access settings on each request.
- We rely on specialist providers: hosting, database, email, error monitoring, bot protection and rate limiting. Full list at ournews.school/trust/sub-processors.
Overseas disclosure
- Data lives in the region a school picks. Where OurNews or a sub-processor sends or accesses information from outside it (including vendor staff), that’s an overseas disclosure under Australian Privacy Principle 8. Per-vendor detail: ournews.school/trust/sub-processors.
Cookies
OurNews sets only first-party cookies. We do not use third-party advertising or cross-site tracking cookies on school pages.
- Staff sign-in. Session cookies (
sb-*) keep a signed-in staff member signed in. They are httpOnly, so scripts in the page cannot read them. During a staff password or MFA reset, a 15-minute httpOnly cookie (reset-retry) holds the in-progress state (added 13 Sep 2026). - The visitors’ book. After a reader confirms their email, a signed pass on their device remembers them for that school’s Email-required stories for 90 days, renewed each time they visit, so they aren’t asked to confirm on every story. The pass is
reveal-pass; short-lived httpOnly cookies (reveal-pending,reveal-error) hold the in-progress state while a reader is confirming. - Story submission. When someone submits a story through the school’s submission link, an httpOnly pass (
submission-pass) remembers the email they confirmed for 30 days from when they confirmed it. It does not renew, so after 30 days the device asks for the email again. A short-lived cookie (submission-pending) holds the in-progress state during confirmation. - The Magic Link. For a school using Magic Link, an httpOnly cookie (
link-only) remembers that this browser arrived through the school’s Magic Link, for 90 days, refreshed on each visit. - Reactions. A per-story cookie (
reaction-<storyId>) remembers which reactions this browser already gave, for 90 days, so a reader isn’t offered the same one twice. It is readable by the page by design and holds no personal information. - Staff workspace. Small cookies remember a staff member’s workspace preferences, such as whether the sidebar is collapsed (
sidebar_state). When a staff member starts a school export, a 60-second page-readable cookie (ournews-export-started) carries only their own start token so the page can show that the export began (added 13 Sep 2026). - Share preview. Opening a collection’s share-preview link sets an httpOnly cookie (
approval-share) that holds the link until the browser closes, so the preview’s photos load. The link itself expires after 14 days. - The demonstration site. On the OurNews demo, httpOnly cookies (
demo-gate,demo-view-as) hold the demo gate and the “view as” role while someone tries the product. These never run on a real school’s pages. - No third-party analytics or tracking cookies run on school pages. Cloudflare Turnstile checks visitors aren’t bots on publisher sign-in, story submission, story reports, the visitors’ book and the demonstration site, using the IP address, TLS fingerprint and user-agent.
The OurNews website
ournews.school itself collects:
- Your full name, email address, and phone number when you open the demo.
- Your name, email address, school, and if you give them your role and a note, when you join the waiting list, and your agreement to receive updates as OurNews develops.
We email these demo details to the founder, who may follow up with you; they aren’t stored anywhere else.
We use these waiting list details to email you before OurNews launches and to send you updates about OurNews. Unsubscribe or ask for deletion at any time: hello@bolsta.education.
With your consent in the website’s cookie banner, Google Analytics measures how the website is used; decline and it is not loaded. Analytics never runs on a school’s pages.
Our status page, status.ournews.school, shows whether OurNews is working. It loads Better Stack’s own Google Analytics and Google Ads tags, which may set Google’s cookies. Better Stack’s privacy policy covers what they collect.
Children
- Photos and names of children appear only if a school chooses to publish them. The school is wholly responsible for ensuring consent and privacy policies are adhered to.
- Anyone in a school community, including a student, may sign the visitors’ book or report a story. We do not ask for age verification. What that check asks for, and why, is explained for a young reader at ournews.school/trust/child-directed-privacy-notice.
Access and correction
You can ask what personal information we hold about you, or ask us to correct it, at hello@bolsta.education. Once we’ve confirmed who you are, we answer within 30 days, free of charge.
For anything a school has published or uploaded, contact the school, or use “Report this story” on the story itself. The school decides what is published, holds the consent, and asks us to make any change. If the school does not provide a satisfactory response, write to us.
If we refuse a request, we tell you why in writing and how to complain. If we decline to correct something, you can ask us to attach your statement saying why you think it is wrong.
Complaints
Email hello@bolsta.education; we’ll look into it and respond. If you’re not satisfied with how we’ve handled a privacy complaint, contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. Outside Australia, contact your own data protection authority.
Changes to this policy
We publish the current version of this policy at ournews.school/trust/privacy, and past versions are available on request from hello@bolsta.education. At least 30 days before a new version applies, we write to each school that subscribes to OurNews with a plain-language summary of what changed. A school that doesn’t want to continue under a new version can cancel at any time, with no fee, under clause 6.2 of the Standard Terms.
Contact
Bolsta Education Pty Ltd (ABN 15 693 606 996)