Policy
How Tumut.org handles website analytics, advertising, directory information and data supplied by visitors.
Tumut.org operates its own first-party analytics system to understand which pages are being used, how people arrive at the site, how visitors move between pages and whether site features are working well. Depending on browser and server support, this may record the page viewed, date and time, IP address, first-party visitor/session identifiers, referral website, campaign parameters, browser and operating system, device type/model, screen and viewport size, language, time zone, approximate country, network connection hints, page-load time, real-user performance metrics such as TTFB, first contentful paint, largest contentful paint, interaction latency and layout shift where supported, time on page, active/visible engagement time, scroll depth and interactions with links, buttons and forms.
The analytics system does not record passwords, form field contents, payment card details or the text people type into forms. Sensitive URL parameters such as authentication tokens, passwords, API keys and session codes are removed before URLs are stored.
Tumut.org also records automated requests and classifies recognised crawler User-Agent strings into categories such as search engines, AI search crawlers, AI user-triggered fetch agents, AI training crawlers, social preview bots, SEO tools, monitoring services, browser infrastructure, archive/feed crawlers, automation clients and recognised security scanners. These labels are based on the User-Agent presented by the requester and are not treated as cryptographic proof of identity.
IP addresses and other raw analytics records are used for traffic measurement, fraud/bot detection, site security and troubleshooting. Raw first-party analytics are automatically removed after the configured retention period. Aggregated statistics may be kept for longer where they no longer need the raw visit record.
Where available, Tumut.org may receive a country, region or city hint from its hosting, CDN or server GeoIP service. If a country is not supplied by the server, the analytics system may use the browser's reported time zone or regional language setting to infer a country code. This is approximate and is labelled by its source in the private admin analytics dashboard.
Tumut.org does not request precise GPS coordinates for first-party analytics and does not send each visitor's IP address to a separate geolocation provider simply to fill the analytics country field.
If Tumut.org introduces user or Facebook Login features, analytics may associate a visit with the Tumut.org account or Facebook name that the person has explicitly authorised Tumut.org to receive through that login process. Tumut.org cannot and does not read a person's Facebook identity merely because they are logged into Facebook in their browser.
The site also uses Google Analytics and Google AdSense. Those services may use cookies or similar technologies according to their own policies and applicable consent requirements. Sponsored placements on Tumut.org are labelled separately from factual rankings and organic directory information.
Business information displayed on Tumut.org is intended to help people discover local services. Listing owners can request corrections or claim/update eligible listings. Information submitted through event, deal, business or correction forms is used to operate those features and is not treated as anonymous analytics.
Community accounts store the information needed to operate the account and the features the member chooses to use, such as display name, email address, local area, verification status, saved items, notifications, community posts and Marketplace listings. Public posts and listings are intentionally visible to other visitors. Private account email addresses are not displayed as part of a public listing unless the member explicitly places contact information into public content.
Tumut.org records moderation actions, reports and account activity needed to prevent abuse, investigate scams and operate trust/safety features. Email verification means that the person demonstrated control of the email address; it is not proof of legal identity.
Garage-sale sellers choose whether an exact street address is shown immediately, revealed close to the sale time, or kept at a general-area level. Tumut.org may automatically remove exact addresses from expired or cancelled garage-sale records. Free printable posters include a QR code to the live listing; scans and actions such as directions, saves and tracked shares may be counted so the seller can see basic listing performance. Tumut.org does not use the garage-sale route planner to store a visitor's live GPS position.
If a member uses an invite link, Tumut.org may record which member invited the new account so community growth can be measured. Community poll votes are associated with the member account to enforce one vote per account per poll; public poll results are shown as aggregate counts/percentages rather than a public list of who voted.
Members and advertisers may pay for clearly labelled promotional placement. Tumut.org records the transaction status and campaign/listing performance needed to provide the purchased service, including impressions and clicks. Tumut.org does not process the purchase price between Marketplace buyers and sellers.
When a member buys Member Pro, Business Pro, a job listing, lead unlock, featured deal/event, sponsored story or Visitor Guide sponsorship, Tumut.org stores the order, product, amount, payment status, account/business association and dates needed to provide the purchased access. PayPal processes the payment; Tumut.org stores PayPal order/capture references and payment status but does not store card numbers or PayPal account passwords.
Business owners may submit claim/contact information to prove control of a listing and keep it current. Tumut.org may store verification dates, claim history and status notes. Visitors may report changed details, duplicates or closures; these reports can include contact details supplied by the reporter and are reviewed before a directory status is changed.
Quote/service enquiries can include the requester's name, email address, phone number, postcode, preferred contact method and enquiry details. Lead contact information is not published on the public business page. It is made available through protected owner tools to an approved claimant of the business after the applicable lead-access step.
Requests for digital business help, sponsored stories and Visitor Guide sponsorship can store business/contact details, creative copy, URLs and editorial material needed to review, deliver and administer the service. Clearly labelled sponsored content may be published publicly when approved.
If a member creates an alert, Tumut.org stores the alert criteria and uses it to match new Marketplace listings, jobs, events, garage sales or configured fuel thresholds. Private Marketplace enquiries are stored so participants can communicate without publishing their email addresses. Members can disable alerts or digest email preferences from their account.
Tumut.org may display job summaries from configured third-party APIs or feeds. Source names and original listing links are retained so job seekers can verify details and apply with the original provider.
Tumut.org links to third-party publishers, tourism bodies, councils, retailers, travel services and other websites. Their privacy practices are controlled by those organisations.
For privacy questions or requests relating to information held by Tumut.org, use the contact page or email the contact address shown in the site footer.