Privacy policy

How Kalgoorlie.info handles privacy for visitors, Marketplace accounts, Directory listings, business claims, security codes and moderation records.

This policy explains how Kalgoorlie.info handles personal information. It is written for site visitors, Directory contacts, people who send messages through the site, and Marketplace users.

Who this policy is for

Kalgoorlie.info is an independent local information website for Kalgoorlie-Boulder and the Goldfields. The site includes public travel information, local guides, a business Directory, contact forms and a moderated community Marketplace.

This policy is prepared with reference to the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). If the site is not legally required to comply with every APP in every circumstance, we still use the APPs as our privacy standard where practical.

Information we collect

We collect only what is reasonably needed to operate the site, respond to people, protect accounts and run the Directory and Marketplace.

Contact form details: name, email address, subject, message, time sent, IP address and basic browser information.
Account details: display name, email address, phone number if supplied, sign-in method, email verification status, two-factor status, last login time and account status.
Password account details: password hashes only. We do not store plain-text passwords.
Marketplace profile details: public profile name, phone number if supplied, social links if supplied, profile settings and saved account preferences.
Marketplace listing details: title, description, category, price information, location, contact name, contact phone if supplied, uploaded images, reports, moderation notes and messages sent through the protected contact form.
Directory business details: business name, category, address, phone, email, website, opening notes, descriptions, images and other details submitted for publication.
Directory ownership and claim details: user ID, account email, claim note, claim status, submission status, moderation note, submitted time and reviewed time.
Address verification details: address metadata such as DPID, G-NAF ID, latitude, longitude, source and verification time where supplied by the address service.
Google sign-in details: Google account ID, verified email address and public profile name if you choose to sign in with Google.
Security and audit details: IP address, browser or user agent, requested pages, timestamps, rate-limit records, verification attempts, password reset activity, two-factor code activity, admin actions and moderation events.
Technical details: cookies, session identifiers, referrer, error logs, cache logs and basic device or browser information.

What we do not collect

We do not process Marketplace payments. We do not ask for passports, driver licences, Medicare numbers, bank card numbers or bank account details for ordinary Marketplace or Directory use. Do not send those details through Marketplace messages, Directory notes or contact forms.

How we use information

We use personal information to:

run, secure and improve the website;
create, verify and manage user accounts;
send email verification, password reset and two-factor authentication codes;
reduce spam, scams, duplicate accounts and abusive activity;
publish and moderate Marketplace listings;
publish and moderate Directory business profiles;
review Directory business claim requests and assign listings to verified account holders;
send Marketplace enquiries between users without publishing email addresses on listing pages;
respond to contact form messages, corrections and update requests;
keep audit records for account security, moderation and support;
comply with legal obligations and respond to lawful requests.

Marketplace accounts

Marketplace accounts can use email and password, Google sign-in, or another enabled sign-in method. Account information is used for login, support, moderation, fraud prevention and user-requested features such as posting listings, saving listings and managing contact options.

Marketplace registration may ask for a home address to help keep accounts local and reduce spam. The address is used for account checks and moderation. It is not shown on public listings. Address metadata may be saved when you choose an address from the autocomplete list.

Directory listings and business claims

Directory pages are intended to publish business and community contact information. If you submit a Directory listing, edit a listing, or claim a business, the public business details you provide may be shown on the site after review.

Account ownership details, claim notes, moderation notes and admin review records are used to decide whether a listing should be published, edited, rejected or assigned to an account. These internal review details are not meant to be public, but the approved business profile itself is public.

Listings added by an administrator may show a claim option so a business owner can request control of the profile. Approved owners can manage their own Directory listings, subject to review and site rules.

Security codes and password resets

For account security, Kalgoorlie.info may send a six-digit code for actions such as sign-in checks, email verification or other sensitive account steps. Codes expire, normally within 20 minutes, and are checked only for the action requested.

If you request a password reset, we send a reset link or code to your account email. Reset tokens are temporary, are cleared after use where practical, and are stored in a way that avoids keeping the plain reset value longer than needed.

We keep audit and rate-limit records for these flows so we can detect repeated attempts, protect accounts and investigate abuse.

Google sign-in

If you choose "Continue with Google", Google sends Kalgoorlie.info your name, email address, email verification status and a Google account ID. We use this information to create, sign in to or link your account, verify that the email belongs to you, prevent duplicate accounts and support moderation or security checks.

We do not ask for your Google password. We do not use Google account data for advertising, do not sell it, and do not share it except where needed to operate the site, protect the service, comply with law, or handle a request you make.

You can use email and password instead of Google. To remove or unlink Google sign-in data from your account, contact Kalgoorlie.info.

Email from Kalgoorlie.info

Account security emails may be sent from a no-reply mailbox. These messages can include verification codes, password reset instructions, two-factor authentication codes and account notices. Contact form replies and support messages may come from a separate site mailbox.

Do not send passwords, bank details or identity documents by email. If a message claims to be from Kalgoorlie.info but feels suspicious, contact us through the website before acting on it.

Public information

Some information is meant to be public. This includes published Directory business profiles, public Marketplace listing details and public profile information you choose to provide.

Private account details, home address checks, internal claim notes, moderation notes, password reset records and two-factor code records are not intended for public display.

Messages, reports and moderation

Marketplace messages, listing reports, Directory claims and correction requests may be reviewed by administrators where needed for support, safety, moderation or legal reasons. We may keep records of admin actions, account changes and listing decisions so there is a clear history if a dispute or abuse report needs review.

Who we disclose information to

We do not sell personal information. We disclose information only where reasonably needed to operate the site, protect users, use service providers, or comply with law.

Marketplace messages are sent to the relevant listing owner by email.
Email and hosting providers may process messages, logs and stored files for us.
Google processes information when you choose Google sign-in.
Addressfinder or another configured address service processes address search text and selected address metadata when address autocomplete is used.
Administrators can access accounts, Directory listings, claim requests, Marketplace listings, reports, messages and audit records where needed for moderation and support.
We may disclose information if required or authorised by law, or where reasonably necessary to protect the site, users or the public.

Overseas services

Some service providers may store or process information outside Australia. This can include Google, email infrastructure, security services, hosting tools, map or address services and analytics or diagnostic services if enabled. Where practical, we use reputable providers and limit the information sent to what is needed for the service.

Cookies and sessions

The site uses cookies and session storage for sign-in, CSRF protection, language or interface behaviour, form security and basic site operation. Marketplace, Directory account features and admin pages use sessions. You can block cookies in your browser, but some account and form features may not work.

Analytics and logs

We use Google Analytics on public pages to understand how visitors use Kalgoorlie.info. Google Analytics may collect or receive information such as page URLs, referrer, approximate location, device and browser details, interactions, time of visit, IP address and cookie or similar identifiers. Google processes this information for website measurement, reporting and service security, and it may be stored or processed on servers outside Australia. We use these reports to improve the site and do not use Google Analytics to personally identify visitors.

Server logs and diagnostic tools may also record technical information needed to understand errors, performance and abuse patterns. These records help us keep the site reliable and improve popular pages.

Security

We use reasonable technical and administrative safeguards, including HTTPS, session protections, CSRF tokens, password hashing, short-lived verification codes, rate limits, access controls, moderation records, upload checks and server-side validation. No website can promise perfect security. Please use a strong password and do not reuse passwords from other sites.

How long we keep information

We keep information only as long as it is useful for the reason collected, for security, for moderation history or as required by law. Marketplace listings expire unless renewed. Unverified accounts may be automatically removed after a short period. Agreement PDFs, audit records, claim records and moderation records may be kept for accountability, support and dispute handling.

Access and correction

You can ask for access to personal information we hold about you, or ask us to correct information that is wrong, out of date or incomplete. Contact us using the details below. We may need to verify your identity before acting on a request.

Account choices

You can update many account details from your account area. You can also ask us to review, correct or remove account information where practical. Published Directory information may need to remain visible if it is already public business information, but ownership and account details can be reviewed separately.

Complaints

If you have a privacy concern, contact us first so we can look into it. We aim to respond within a reasonable time. If you are not satisfied, you may contact the Office of the Australian Information Commissioner (OAIC).

Children

The Marketplace and account features are intended for adults and local community use. If a parent or guardian believes a child has provided personal information, contact us and we will review it.

Changes to this policy

We may update this policy when the site changes, when services are added, or when privacy guidance changes. The current version is published on this page.

Contact

Email: contacts@kalgoorlie.info

Contact form: kalgoorlie.info/contact

Last updated: 8 June 2026.