Privacy Policy, The Anthroposophy App (www.anthroposophy.app)

Version 1.8. Operator: VirgoLabs, ABN 62 345 335 476, Australia. This policy takes effect on the date of its publication at www.anthroposophy.app/privacy and remains in force until a later version replaces it.

Part A - The operator, this policy, and the Privacy Act

A.1 The platform and the operator

The Anthroposophy App is a community platform for people interested in anthroposophy. VirgoLabs, ABN 62 345 335 476, based in Australia, operates it as a website at www.anthroposophy.app and as a mobile application, both running on one shared backend. A member can publish posts with images, comment, and create and join events, courses and groups. A member can also list a business or a project or initiative, send direct messages to other members, upload documents for the platform to read, maintain a profile, and follow other members.

In this policy "the operator" means VirgoLabs, "the platform" covers both the website and the mobile application, and "member" means a person holding an account. The operator's public identifiers for privacy purposes are the ABN above and the privacy contact in Part L.

A.2 Definitions

The terms below carry the meanings the Privacy Act 1988 (Cth) (the Privacy Act) gives them, quoted from the current compilation of the Act.

• Personal information: "information or an opinion about an identified individual, or an individual who is reasonably identifiable: (a) whether the information or opinion is true or not; and (b) whether the information or opinion is recorded in a material form or not" (Privacy Act s 6(1)).
• Sensitive information: relevantly, "information or an opinion (that is also personal information) about an individual's racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual orientation or practices, or criminal record", together with health, genetic and certain biometric information (Privacy Act s 6(1)). Philosophical beliefs and religious beliefs or affiliations are named limbs of this definition, and Part C addresses their consequence for this platform.
• Consent: "express consent or implied consent" (Privacy Act s 6(1)).
• Holds: an entity holds personal information "if the entity has possession or control of a record that contains the personal information" (Privacy Act s 6(1)).
• Collection, use and disclosure: their ordinary meanings under the Act, collection being the obtaining of personal information for inclusion in a record, use its handling within the entity, and disclosure the making of it accessible to others outside the entity.
• APP entity: an agency or organisation to which the Australian Privacy Principles (the APPs, Schedule 1 to the Privacy Act) apply. OAIC: the Office of the Australian Information Commissioner.

A.3 The operator and the Privacy Act

The Act binds APP entities. An "organisation" is "an individual, a body corporate, a partnership, an unincorporated association, or a trust", excluding among others a "small business operator" (Privacy Act s 6C(1)). Section 6D(1) provides that "a business is a small business at a time (the test time) in a financial year (the current year) if its annual turnover for the previous financial year is $3,000,000 or less", and s 6D(3) provides that a small business operator is a person or entity that "(a) carries on one or more small businesses; and (b) does not carry on a business that is not a small business". The operator has confirmed three facts:

• The aggregate annual turnover of all businesses it carries on is $3,000,000 or less.
• It discloses personal information about no one for a benefit, service or advantage.
• It provides no benefit, service or advantage to collect personal information about anyone, the trading conduct that s 6D(4) would otherwise catch (see also E.6).

On those facts the operator is a small business operator and the Privacy Act does not apply to the platform automatically. The operator rests nothing on that exemption, for the reasons in A.4.

A.4 Application of the Australian Privacy Principles

This policy applies the Australian Privacy Principles as binding practice from the date it takes effect. The operator has further chosen the election under s 6EA of the Act, by which a small business operator may, by written notice to the Information Commissioner, have the Act apply to it as law. The operator will lodge that notice before the platform's public launch. It applies the Act's disciplines, including the data breach scheme in Part J, from adoption whatever the registration date. The reasons arise from the data itself:

• The platform collects and holds sensitive information within the statutory definition.
• Membership of an anthroposophy community platform may itself reveal a person's philosophical or religious beliefs.
• The platform displays several classes of member data to the public by design.
• Community life of this kind involves families, so mishandling of the information held causes real harm.

The operator applies these disciplines because of that data character, and applies them whatever the turnover threshold.

Part B - Information collected

B.1 Information a member gives directly

The platform collects twenty-eight categories of personal information directly from a member, each drawn from the code as at the date in L.5.

Account:

• (1) The email address, which the authentication service holds and uses for sign-in, confirmation and password reset.
• (2) The password, which the authentication service holds only in hashed form; the operator cannot read it.

Profile:

• (3) A unique handle, (4) a display name, (5) a profile photo and (6) a free-text bio.
• (7) The home country, (8) the home region or state, and (9) the home locality, down to suburb and postcode. Each of these three is optional, and Part E states exactly how much of them the platform ever shows publicly.
• (10) The chosen fields of interest.

Records about the account:

• (11) A record of the Terms of Use version the member accepted and when.

Content and submissions:

• (12) Posts, including titles, bodies and audience settings, and (13) comments.
• (14) Events and courses the member creates, including titles, descriptions, times, venues and attachments.
• (15) Groups the member creates, including names, descriptions and locations.
• (16) Blog posts the member submits, and blog and explore-page content where the member is an administrator author.
• (17) Free-text suggestions for new fields or locations, and messages sent through the Contact and help page; the platform stores both in the same record.
• (18) Images the member uploads, and (19) documents the member uploads.
• (20) Reports the member files about content or conduct, including the free-text reason.
• (21) Business listings the member creates, including name, description, business type, website, category, fields and location.
• (22) Project and initiative listings the member creates in the Projects/Initiatives section, including title, description, stage, category, website, fields and location.
• (23) Files the member uploads for the platform to read, with the record of who uploaded them, the group chosen to upload on behalf of, the email address and display name on the account at the time, and the events, blog posts and announcements read out of them.

Relationships and preferences:

• (24) Whom the member follows.
• (25) Saves, group memberships, pending join requests, responses to events (going or interested), and requests to take over a group or event.
• (26) Notification and feed preferences.
• (27) Direct messages sent and received, with the time each was sent and read.
• (28) The members the member has blocked.

B.2 Information about a person that others provide

The platform also collects personal information about a person indirectly:

• Another member may mention or tag the person in a post or comment.
• An event organiser may add the person to a private event's invitee list.
• A post author may name the person on the list of followers permitted to see a restricted post.
• A group owner may add the person to, or approve the person into, a group.
• Another member may send the person a direct message.
• Another member may block the person, a record the platform holds and does not show to the blocked person.
• Another member may file a moderation report about the person or the person's content, with a free-text reason.
• Moderators and administrators create moderation actions, ban records and appeal records about members.
• A member may upload a file, or email a newsletter, that names or describes the person, and an event, blog post or announcement read out of it may carry the person's name as the file printed it.
• The free text of any post, comment, event, group, business, project or initiative description may name or describe a person, whether or not that person holds an account.

Where the platform holds information about a person collected in these ways, this policy applies to it, and the notification measures in L.4 are the practicable notice of that collection.

B.3 Cookies and device storage

The website sets authentication session cookies through the Supabase client library (named in the pattern sb-<project>-auth-token), which are essential to staying signed in. The website sets no other cookie. It expires the retired anthro-mode and anthro-view cookies wherever a returning visitor's browser still holds them.

The website stores a small number of values in the browser's localStorage, where they stay on the device and reach no one:

• The chosen display language (anthro-lang).
• The countries chosen as the default location (aia_web_countries, with a legacy key aia_web_country).
• The unsent draft of a post the member is composing (compose_draft_v1).
• The version of this policy whose update notice the member has closed (aia_web_policy_notice_seen).
• Whether the visitor has seen or dismissed the install-as-app hint (anthro_install_dismissed, anthro_ios_install_dismissed, anthro_ios_visit_count).
• Whether the visitor has seen the welcome tour or dismissed its banner (anthro_welcome_seen, anthro_welcome_banner_dismissed).

The website also keeps, in sessionStorage for the life of the tab, the time of the last automatic page reload (anthro-chunk-reload-at). Where a visitor installs the website as an app, a service worker keeps copies of the site's static interface files in the browser's cache so pages can load offline. It caches only files on an explicit static allowlist, and it caches no signed-in content and nothing from the platform's data service.

The mobile application stores the authentication session on the device in AsyncStorage. The sign-up, sign-in, password-reset and email-verification forms on the website load the Cloudflare Turnstile check described in E.4. No analytics, advertising or tracking cookie, and no other third-party script or SDK, exists on either surface.

B.4 Information not collected

The platform collects no date of birth, no payment details, no government identifiers and no device advertising identifiers. It collects no location telemetry from a device, since the home location is only what the member types into the profile. It collects no push notification tokens, since a push preference exists in the settings screens and the delivery machinery behind it is not built. No analytics or behavioural tracking service receives member data. The operator will revise this policy before any of these positions changes.

B.5 Data sources that are not about a person

Place reference data (countries, regions, localities) derives from the GeoNames geographical database, used under a CC BY 4.0 licence and imported into the platform's own database. The platform sends no member data to GeoNames.

B.6 A publicly-sourced directory of anthroposophical initiatives

The Directory page carries, in its Courses, Events, Businesses and Projects/Initiatives sections, a set of listings that the operator compiled from publicly available information about anthroposophical organisations worldwide. A listing carries the organisation's name and a category, and in most cases its website, country and a short description of the organisation. A listing in the Events section carries the title and date of an event as the organisation published them on its own website, with a link to that page.

None of these organisations holds an account or has confirmed a listing, the operator has asked none of them for consent to it, and the Directory page states this. The description of an organisation names no living individual. The name of a historical figure who founded or led an organisation may appear where that person is deceased. The platform reproduces an event title as published, so a title may name a presenter or performer as the organisation itself advertised them, and the operator adds nothing about that person.

Once its published date has passed, the platform lists an event under the Archived tab instead of among upcoming events. It keeps the event there for twelve months after the last date the listing carries, and then no longer shows it. An organisation, or a person named in an event title, may ask for correction or removal of a listing through the privacy contact in Part L. Where an organisation creates its own listing on the platform, the compiled listing stays in the Directory until the organisation asks for its removal through the same contact.

Part C - Sensitive information

C.1 Sensitive information and this platform

The Privacy Act's definition of sensitive information names "religious beliefs or affiliations" and "philosophical beliefs" as protected limbs (s 6(1), quoted in A.2). Anthroposophy is a spiritual and philosophical movement. The fact of holding an account here, the chosen fields of interest, the groups a member joins, the events a member attends and the content a member writes may therefore each reveal, or support an inference about, that member's philosophical or religious beliefs. Sensitive information attracts a higher collection standard than ordinary personal information, and the platform's central function, participation in an anthroposophical community, is collection of that kind. The platform treats all member data connected to participation in the community to the sensitive-information standard, whichever fields would qualify on an item-by-item view.

C.2 The collection standard

APP 3.3 provides that an APP entity "must not collect sensitive information about an individual unless the individual consents to the collection of the information and the information is reasonably necessary" for one or more of the entity's functions or activities. Collection here rests on the member's express consent: the member creates the account, chooses each profile field, and chooses each group, each event and each post. Joining an anthroposophy community may itself reveal a member's beliefs, so the signup flow on both surfaces presents a consent statement saying so. Creating an account records the member's agreement to the collection and handling of that information as this policy describes. A member cannot participate without the account data, and each sensitive-adjacent item beyond it is individually optional.

C.3 The consequence of public display

Part E describes which classes of member data the platform displays to the public. Where a member places information revealing beliefs into a public field, a public post or a public group, the platform discloses that sensitive information to anyone on the internet, without an account, by design. The member controls this through what the member chooses to publish and through each post's audience setting, and the platform adds no belief labels to anyone's data of its own motion.

Part D - Purposes of collection and use

D.1 Purposes of collection

The platform collects the categories in Part B for these primary purposes:

• Operating the service: accounts, sign-in, profiles, feeds filtered by country, events, courses, groups, business listings, project and initiative listings, comments, follows, saves, direct messages between members, and a count of the members online shown to signed-in members.
• Reading files and emailed newsletters that members supply, so that the platform can list the events, blog posts and announcements in them.
• Showing a member's content to the audiences the member selects.
• Sending service messages: email confirmation, password reset, and the notifications the member has enabled in the notification preferences.
• Notifying members in-app, subject to their settings: the recipient of a direct message, and the followers of a member when that member publishes a public post, event, course, group, project, business or blog post.
• Moderating the community: receiving reports, reviewing content, recording moderation actions, applying and lifting bans, and running appeals.
• Maintaining the integrity of the service: rate limits and terms-acceptance records.
• Meeting legal obligations.

D.2 The use and disclosure discipline

APP 6.1 provides that where an entity "holds personal information about an individual that was collected for a particular purpose (the primary purpose), the entity must not use or disclose the information for another purpose" without consent or another permitted basis. The operator applies that discipline through four commitments:

• The operator sells, rents and trades personal information to no one.
• The operator uses personal information for no third-party marketing, profiling or advertising.
• The operator discloses personal information for no benefit, service or advantage to itself.
• The operator will put any new purpose to the member for consent, or notify it through a revision of this policy, before that purpose begins.

These commitments also underpin the position in A.3, since the platform does not trade in personal information.

Part E - Disclosure

E.1 Disclosure to the public

The website has no login wall, anyone on the internet can read its public pages without an account, and search engines can index them. The platform discloses seven classes of member data to the public in this way, each verified in the platform's access rules:

• Member profiles: handle, display name, photo, bio, fields of interest, join date, and, where the member has set them, the home country and the home region or state. The platform shows nothing finer: the suburb and postcode never appear on a public profile, and the database rule that backs public profile reads does not include the locality at all. Every location field is optional, and a member can leave them all empty.
• Public posts: the author's name, handle and photo, with the post.
• Public events and courses: the organiser's identity, title, description, times and location, including, under an Archived tab, events and courses whose dates have passed. Anyone who can read a public event can read the responses to it (going or interested).
• Public groups: name, description and location.
• Comments on any publicly visible content: the commenter's identity with the comment.
• Published blog posts, explore pages, announcements and featured items.
• Business, project and initiative listings: the identity of the member who created them, and the name or title, description, website, category, fields and location given.

An eighth, non-member class is also public: the publicly-sourced listings B.6 describes, on the Directory page.

Attachment records (file name, type, size) on public content are also publicly readable. The underlying image or document bytes are not directly public. The platform serves them through time-limited signed links that only signed-in members can mint, and any such link remains usable by anyone who holds it for its one-hour life.

E.2 Disclosure to other members

According to the audience rules of each item, and limited to the relevant counterparties by the platform's access rules, members additionally see:

• Restricted posts they may see.
• Private events they are invited to.
• Group content of groups they belong to.
• Who follows whom, and group member lists.
• Mention tags and invitee lists.

Only the sender and the recipient can read a direct message. The recipient of a direct message receives an in-app notification naming the sender, subject to the recipient's notification settings. A member who follows another member receives an in-app notification, subject to the follower's settings, when the followed member publishes a public post, event, course, group, project, business or blog post. That notification carries the followed member's name and the item's title, or for a post without a title the first sixty characters of its body.

While a member is signed in with a tab open, the website counts that member among the members online and shows the count to signed-in members. The presence channel behind the count identifies each online member to every signed-in client by account identifier and carries nothing else about them. The home locality a member has optionally set on the profile remains readable to signed-in members under those rules, at the suburb level the member provided.

E.3 Disclosure to moderators and administrators

Moderators and administrators see reported content, reporter identities and report reasons within their moderation scope. They record actions about members (clearances, removals, escalations, bans, appeal outcomes) with free-text notes, and the platform retains those records as its moderation history. Administrators also see each file uploaded for reading, with the account email address and display name of the member who uploaded it and the group it was uploaded on behalf of. They see the events, blog posts and announcements read out of it. The Notifications page shows administrators counts of reports, uploads and suggestions awaiting review.

E.4 Disclosure to service providers

The platform runs on Supabase, a hosted backend service providing the database, authentication and file storage, so Supabase infrastructure holds every category in Part B. Part F sets out where that data lives.

Resend, an email delivery provider in the United States, sends transactional email (sign-up confirmation, password reset, and the notifications the member has enabled) and handles the member's email address and the content of those messages for delivery. An email telling a member that another member has sent a direct message goes the same way; it carries the sender's name and a link to the inbox, never the message text. The recipient's setting for new-message email, under New messages in the notification settings, is on by default, and the platform sends that email only while the setting remains on. The platform does not repeat the email while an earlier message from the same sender in the last fifteen minutes remains unread.

Newsletters emailed to the address the operator publishes for that purpose arrive through Resend, which holds each message and its attachments for the platform to fetch. The platform emails a reviewer the sending address and subject line of an import awaiting review. Mail sent to the platform's contact addresses in Part L arrives in mailboxes hosted by Proton AG in Switzerland.

The website offers a translation control. Where a visitor chooses a display language, the platform's own server sends the text of the pages viewed to Google Cloud Translation (Google LLC, United States) and returns the translation to the browser. That text can include members' posts, comments, profiles, and event and group descriptions. The request carries the text and the language pair, and no name, account or email address. The browser caches translated text for the session, and the operator stores none of it. The mobile application contains the same translation capability in its code, and it is not enabled there as at this policy's date.

The sign-up, sign-in, password-reset and email-verification forms on the website include a Cloudflare Turnstile check, loaded as a script from challenges.cloudflare.com (Cloudflare, Inc., United States). Cloudflare's script runs in the browser while the check runs, and the form passes the token it issues to the authentication service. The platform passes no name, email address or password to Cloudflare.

The platform screens uploaded images against databases of known child sexual abuse material. Screening runs on the shared backend that serves both the website and the mobile application, so the backend screens an image uploaded through either surface after storing it. The website additionally checks an image before upload. The operator uses Project Arachnid Shield, operated by the Canadian Centre for Child Protection in Canada; Microsoft PhotoDNA (United States) is a named alternative that is not in use. When the platform screens an image, it sends the image data to the screening provider for matching against known illegal material, and for no other purpose.

The platform reads events, blog posts and announcements out of files that members upload and out of newsletters emailed to the address the operator publishes for that purpose, so that it can list them. A signed-in member with a confirmed email address may upload up to five files of up to 15 MB each, as PDF, JPG, PNG or WebP. A file may be a poster, a flyer, a programme, a newsletter, a screenshot or any other document, and the member may upload on behalf of a group the member organises. The platform screens images among those files against known child sexual abuse material before storing them.

The platform sends each file, and the text of a covering email where there is one, to Mistral AI, a company in France. Mistral AI converts the file to text, then reads the text for the events and articles it contains. The request carries the file, the covering text, the date and time zone needed to read the dates in it and, for an emailed newsletter, the date of the email. It carries neither the sending address nor the account details of any member. The operator's Mistral AI account, as its settings showed on 26 September 2026, has the use of the platform's requests for model training switched off and zero data retention enabled. Under that setting Mistral AI stores and logs neither the file nor what it returns for longer than it takes to read it.

The platform stores the file, the record of who supplied it, and the events, blog posts and announcements read out of it. For an upload that record is the email address and display name on the uploading account at the time, and the group chosen; for an email it is the sending address and name, and the subject line. Those remain available to the site administrator, who reviews an import before publication unless the sender is on the operator's confirmed allowlist and, for an upload, the allowlist entry is bound to the uploading account.

H.2 states what happens to a file uploaded for reading when the uploading member deletes the account. A person who does not want a file, a newsletter, or the entries read from it held may ask for their removal through the privacy contact in Part L.

No third party beyond the providers named in E.4 receives member data, and the operator will revise this policy before adding any service provider.

E.5 Disclosure required or authorised by law

The operator will disclose personal information where Australian law requires or authorises it, including to courts, law enforcement and regulators with lawful authority. In respect of illegal content, it will disclose to the eSafety Commissioner and police where the law requires or permits it.

E.6 No sale

The operator does not sell, rent or trade personal information, and discloses it to no person for a benefit, service or advantage.

Part F - Overseas disclosure

F.1 The rule

APP 8.1 provides that before an APP entity discloses personal information to a person "who is not in Australia or an external Territory", the entity "must take such steps as are reasonable in the circumstances to ensure that the overseas recipient does not breach the Australian Privacy Principles". Under s 16C of the Act, an entity that discloses personal information to an overseas recipient is, in certain circumstances, accountable for the recipient's acts, which are "taken to have been done by the APP entity". The OAIC's APP guidelines add that providing information to an overseas cloud provider may be a "use" of the information, and not a "disclosure", where a binding contract limits handling, subcontractors carry the same obligations, and the entity retains effective control of the information (APP Guidelines ch 8, paragraphs 8.10 and 8.14).

F.2 Where the data lives

Supabase hosts production data in its Sydney region (ap-southeast-2), so the primary copy of all platform data remains in Australia. A corporate group headquartered in the United States operates Supabase, so even with Australian-region hosting, technical support access, sub-processing and backup arrangements may involve access from outside Australia. The operator treats that possibility as overseas handling, discloses it here whether the arrangement is a "use" or a cross-border "disclosure" under the guidelines above, and holds itself to the discipline in F.1 either way.

F.3 Countries

APP 1.4 asks a privacy policy to state, if practicable, the countries in which overseas recipients are likely to be located, and they are these:

• Australia, for primary hosting (Supabase, Sydney region).
• The United States, for Supabase's corporate group, for Resend (transactional email, and receipt of newsletters emailed to the platform), and for Google LLC (translation, when a visitor requests it).
• The United States also, for Cloudflare, Inc., the provider of the Turnstile check on the sign-up, sign-in, password-reset and email-verification forms.
• France, for Mistral AI, the reader of the events, blog posts and announcements in a file or newsletter a member supplies.
• Switzerland, for Proton AG, the host of the operator's contact mailboxes.
• Canada, for the Canadian Centre for Child Protection (Project Arachnid Shield), the recipient of uploaded image data for screening against known child sexual abuse material.

Microsoft PhotoDNA (United States) is a named alternative that is not in use.

Part G - Security

G.1 The standard

APP 11.1 provides that an entity holding personal information "must take such steps as are reasonable in the circumstances to protect the information: (a) from misuse, interference and loss; and (b) from unauthorised access, modification or disclosure".

G.2 Measures in place

The database itself enforces the platform's visibility model, through row-level access rules that it evaluates on every read, independently of the user interface. Uploaded files live in a private storage bucket, at randomised paths, and the platform serves them through signed links that expire after one hour. The authentication service hashes passwords and holds no readable form of them. A member needs a confirmed email address to post, comment, create content or upload a file for reading.

Moderation machinery (reports, automatic hiding of reported content pending review, moderator actions, bans, a three-level appeal ladder) operates on both surfaces, and the platform rate-limits report filing. The platform hides a reported post, comment, event or group pending review on the first report, and a reported business, project or initiative listing on the second report from a different member. The platform rate-limits direct messaging, and a member may block another member from sending messages to the member who set the block.

G.3 Limitations

As at this policy's date, a signed file link, once any member mints it, remains usable by anyone who holds it until it expires. The platform grants access to a file object outside a member's own uploads only after it re-checks, under that member's own session, whether the member may see the content the file is attached to. That check runs server-side before the platform mints a link.

The platform keeps the moderation history in an ordinary database table without append-only or tamper-evidence guarantees. The platform screens uploaded images against databases of known child sexual abuse material through the provider named in E.4, in addition to report-based moderation. That screening matches only material already known to the provider, so it does not guarantee detection of every unlawful image. Screening runs after the platform stores an image, so a just-uploaded image is briefly unscreened until the next screening pass, typically within a minute and longer if the provider is temporarily unreachable. The platform removes a matched image and records the incident.

A file attached to content a member deletes without deleting the account may persist in storage until an administrative removal runs, as H.2 describes.

Part H - Retention and deletion

H.1 Account deletion

Both surfaces provide an account deletion control. On deletion the platform deletes the member's personal posts, together with their attachment records. It retains the member's comments, detached from the member's identity and shown as authored by "deleted user". It retains posts the member made in a group's name, with the group. It freezes groups and events for which the member is the sole organiser, so that other members may take them up. It retains moderation records that reference the member, with the member's identifier removed. It deletes the profile and the sign-in record, and with them the records the database ties to the profile:

• The direct messages the member sent and received, so the other member's inbox no longer holds them.
• The blocks the member set.
• The member's business, project and initiative listings.
• The member's responses to events.

This asymmetry between removed individual contributions and retained communal content is deliberate. The deletion screen states it, and this policy restates it so that no one deletes an account expecting the removal of comments and group history as well.

H.2 Files

A file object that nothing on the platform links to is an orphaned file: it has a randomised, unguessable path, it is reachable only through a signed link that expires within an hour of minting, and it persists in storage until an administrative removal runs.

A deletion of the account, whether made through the website or through the mobile application, removes from storage within one day the files the member uploaded to posts, events, groups, blog and explore content, the profile photo, and the files the member uploaded for the platform to read. It also deletes the records of those uploads for reading: the upload record, its file records and the record of the entries read from it. Entries already published from such a file, and the feed announcements of them, remain on the platform. Where a removal fails at the time of the deletion, the platform repeats it daily until it succeeds, and until then keeps those files and records with the account identifier removed and the email address retained. Emailed newsletters have no uploading account, and account deletion does not touch them. A member may ask for the removal of any file through the privacy contact in Part L.

When a member deletes an individual post or other item without deleting the account, the platform removes its records pointing to the item's files at once, and the underlying file object remains an orphaned file until an administrative removal runs. A member can require the immediate removal of any specific file by writing to administrator@anthroposophy.app, and the operator will remove it within the response period in Part I, except where the operator must preserve it for a lawful purpose.

H.3 Notifications

The platform purges in-app notifications after 90 days.

H.4 The destruction standard

APP 11.2 requires an entity to take reasonable steps "to destroy the information or to ensure that the information is de-identified" once it is no longer needed for a permitted purpose. The retention positions above (comments de-identified and kept, communal content retained, moderation history retained for platform integrity, orphaned content files pending administrative removal) are the operator's implementation of that standard. The operator re-examines them whenever it revises this policy.

Part I - Access and correction

I.1 Access

APP 12.1 provides that if an entity "holds personal information about an individual, the entity must, on request by the individual, give the individual access to the information", and for organisations the response is due "within a reasonable period after the request is made". The platform gives a member this access directly: from the account on the website a member can download a copy of the member's data at any time. The export assembles the data in the account that the platform's access rules let the member read and that the export is built to gather. It reads every category through to completeness and hands the file to the browser on the spot; the platform emails nothing and involves no third party. The file holds:

• The profile and account details.
• The posts, comments, events, courses and groups the member created.
• Group memberships, whom and what the member follows, and saved items.
• Notification and feed preferences, in-app notifications and terms acceptances.
• Requests to take over a group or event, the reports the member filed, and the details of the files the member uploaded.
• Records where others mentioned or invited the member, the member's own ban records and appeals, and any blog posts the member submitted.
• The businesses and projects the member listed, the direct messages the member sent and received, the members the member has blocked, and the member's responses to events.
• The record of each file the member uploaded for reading, including the details supplied with it and the events and articles read out of it.

Four things are absent from that file, and the export names each of them:

• The free-text suggestions and Contact and help messages the member submitted; the system lets a member write these but not read them back.
• Reports that other people filed about the member's content.
• Moderation actions that moderators recorded about the member.
• The contents of the files themselves, whose names and details the export lists.

A person may request each of these, and anything else the platform holds about the person, through the privacy contact in Part L. On the mobile application, the request-a-copy control files the request with the operator, who fulfils it by the same standard. The operator acknowledges every access request, made in-product or by email, within 7 days and answers it within 30 days.

I.2 Correction

APP 13.1 requires an entity to take reasonable steps to correct personal information that is "inaccurate, out of date, incomplete, irrelevant or misleading", on its own satisfaction or on request. A member can correct the profile, posts, events and groups directly in the product at any time. A person may raise anything the person cannot edit, including information about the person supplied by others under B.2, through the privacy contact in Part L. The operator will correct or annotate it within the same 30-day period.

Part J - Data breaches

J.1 The scheme

Part IIIC of the Privacy Act establishes the Notifiable Data Breaches scheme. An eligible data breach arises where there is unauthorised access to, unauthorised disclosure of, or loss of personal information, and a reasonable person would conclude that it is likely to result in serious harm to any individual to whom the information relates (s 26WE(2)). An entity aware of reasonable grounds to suspect an eligible breach must assess it, taking "all reasonable steps" to complete the assessment within 30 days (s 26WH(2)). Where the entity confirms an eligible breach, it must prepare a statement (identity, description of the breach, kinds of information, recommended steps) and give a copy to the Commissioner as soon as practicable (s 26WK(2)). It must also notify affected individuals of the statement's contents as soon as practicable (s 26WL(3)).

J.2 Applicability and commitment

The scheme binds APP entities, so once the s 6EA registration described in A.4 takes effect it applies to the operator as law. The operator applies its discipline from adoption in any event. It contains the incident, assesses it within 30 days, notifies the OAIC and affected members as soon as practicable where serious harm is likely, and records the incident and the decisions taken. Given the sensitive character of the data (Part C), the working assumption in any breach assessment here is that disclosure of membership or belief-revealing content is capable of serious harm. The operator approaches the threshold question with that weighting.

Part K - Children

K.1 Age

The operator intends the platform for adults aged 18 and over. A person signing up on the website must tick a statement that reads "I am 18 or older, I accept the Terms of Use, and I consent to the collection and handling of the information I choose to share here - which, on a community like this, may reveal my religious or philosophical beliefs - as described in the Privacy Policy", and a person signing up on the mobile application must tick a statement that reads "I am 18 or older and I accept the Terms of Use". Neither surface collects a date of birth, and neither performs technical age verification, so the control on both surfaces is self-attestation. Content concerning children may appear in material adults post about community and family life. Such content is subject to the moderation and reporting machinery in G.2, and anyone can report it to the safety contact in L.1.

Part L - General provisions

This Part applies to every reader of this policy, whether a member, a visitor, or a person who holds no account and appears in content under B.2.

L.1 Contact

Privacy enquiries, access requests, correction requests and complaints go to the privacy contact: privacy@anthroposophy.app. Reports of illegal or harmful content go to the safety contact: safety@anthroposophy.app, which the product also links as "Report illegal content". Requests for the removal of a specific stored file under H.2 go to administrator@anthroposophy.app.

L.2 Complaints

A complaint about the handling of personal information goes to the privacy contact first. The operator will acknowledge it within 7 days and respond substantively within 30 days. A complainant not satisfied with the response may complain to the Office of the Australian Information Commissioner at www.oaic.gov.au, which accepts complaints online. The s 6EA registration described in A.4 places the operator within the Act's complaint machinery, and the operator's own commitment above applies regardless.

L.3 Changes to this policy

This policy carries a version number and a date. The operator will notify material changes in-product before they take effect, and the current version will remain available on the website at all times. No change operates retrospectively to authorise a use or disclosure this policy did not permit when the information was collected.

L.4 Collection notice

APP 5.1 requires an entity, at or before the time of collection or as soon as practicable after, to take reasonable steps to notify the matters in APP 5.2. Those matters include the entity's identity, the purposes of collection, usual disclosures, access and correction, complaint routes, and the likelihood of overseas disclosure. This policy is the platform's standing notice of those matters: identity in A.1, purposes in D.1, disclosures in Part E, overseas position in Part F, access and correction in Part I, complaints in L.2. For a file uploaded for reading, the notice beside the upload form states what the platform keeps, who receives it and how to have it removed. For information collected indirectly under B.2, the practicable notice is this policy together with the mention notification that alerts a member when tagged.

L.5 Interpretation

Headings organise, they do not limit. The factual statements about the platform's behaviour were checked against the code on the dates below, and they speak as at the latest date:

• 10 July 2026: the code of both codebases.
• 11 July 2026: direct verification of the website's data export, translation, contact routes and device storage.
• 15 July 2026: re-verification of the screening, auto-hide-threshold and storage-access claims in Parts E, F and G.
• 25 July 2026: removal of the example-content (demo) view and its anthro-mode cookie.
• 10 September 2026: addition of the publicly-sourced initiatives and events directory (B.6, E.1), with living individuals removed from organisation descriptions, and of the anthro-view cookie controlling display of that seed content.
• 26 September 2026: the Cloudflare Turnstile check; the direct-message, block, event-response, business, project and initiative records; the browser storage keys in B.3; and the report thresholds in G.2.
• 26 September 2026: the Archived tabs on Events and Courses; the merge of initiatives into Projects/Initiatives; and the upload and reading of member-supplied files by Mistral AI under the training and retention settings shown on the operator's Mistral AI account.
• 27 September 2026: the in-app notifications for direct messages and for followed members; the recipient's control of direct-message email; and the addition of listings, direct messages, blocks, event responses and upload records to the data export.
• 27 September 2026: the removal, within one day, of uploaded files and files uploaded for reading on account deletion through either the website or the mobile application; the twelve-month limit on archived directory events; and the single record class behind Projects/Initiatives.
• 3 October 2026: the Directory page, which carries the compiled listings formerly shown on the Businesses, Courses, Events and Projects/Initiatives pages; the retirement of the anthro-view cookie; the website, country and description fields a listing may lack; and the replacement in B.6 of the statement that an organisation's own listing supersedes the compiled one.

The Schedule and the Adoption Record below form part of this policy.

Schedule - Legislative sources

The source shown supplied each provision quoted in this policy, fetched on 10 July 2026, and the quoted words match the fetched text. The Federal Register of Legislation text is the current compilation of the Privacy Act 1988 (compilation in force 4 June 2026).

Adoption Record

• Operator: VirgoLabs, ABN 62 345 335 476, Australia.
• Basis of compliance: voluntary compliance with the Australian Privacy Principles from adoption, with written notice under s 6EA of the Privacy Act to be lodged with the Information Commissioner before public launch. The operator has confirmed that the aggregate annual turnover of all businesses it carries on is $3,000,000 or less, so the Act binds the platform as law only upon that registration.
• Contacts: privacy@anthroposophy.app for privacy; safety@anthroposophy.app for safety; administrator@anthroposophy.app for file removal. Proton AG, Switzerland, hosts the contact mailboxes.
• Hosting: database, authentication and storage on Supabase, Sydney region (ap-southeast-2), with primary data in Australia.
• Providers: transactional email, and receipt of emailed newsletters, through Resend, United States. Translation, at the reader's request, by Google Cloud Translation, United States. Reading of uploaded files and emailed newsletters by Mistral AI, France, with model training switched off and zero data retention enabled on the operator's account as its settings showed on 26 September 2026. The sign-up, sign-in, password-reset and email-verification check by Cloudflare Turnstile, Cloudflare, Inc., United States.
• Screening: uploaded images screened against known child sexual abuse material by Project Arachnid Shield (Canadian Centre for Child Protection, Canada); Microsoft PhotoDNA (United States) is a named alternative that is not in use.
• Files: a deletion of the account, through the website or the mobile application, removes uploaded files within one day, including files uploaded for reading and their upload records. Files orphaned by content deletion are removed administratively, and immediately on request; lawful-preservation holds excepted.
• Report thresholds: a post, comment, event or group hidden pending review on the first report; a business, project or initiative listing on the second report from a different member.
• Age: 18 and over, by self-attestation on both surfaces; no date of birth collected.
• Public profile granularity: home location shown publicly at no finer than region or state and country; suburb and postcode never displayed publicly.
• Response periods: acknowledgement within 7 days; substantive response within 30 days.

Version 1.8. Published by VirgoLabs (ABN 62 345 335 476) at www.anthroposophy.app/privacy.