Privacy Policy

Last updated: April 2025

This Privacy Policy explains what personal information Incoplace collects, how we use it, and how we protect it. By using this site you agree to the practices described here.

1. Information We Collect

Information you provide directly

Account data: username, email address, password (stored as a secure hash — we never store your plain-text password), suburb/city.
Profile data: avatar image, bio, and any other optional profile fields you choose to fill in.
Content: posts, replies, private messages, and any other content you submit to the site.
Payment data: if you purchase a promoted listing we collect only what is necessary to process the transaction. We do not store full card details.

Information collected automatically

Log data: IP address, browser type, pages visited, and timestamps, retained for security and abuse-prevention purposes.
Session cookies: we use a secure, HTTP-only session cookie to keep you logged in. No third-party tracking cookies are used.

2. How We Use Your Information

To operate and provide the Incoplace service.
To authenticate you and keep your account secure.
To send transactional emails (password resets, notifications) — we do not send marketing emails without your consent.
To enforce our Terms and Conditions and investigate abuse.
To improve the site based on aggregated, anonymised usage data.

3. How We Share Your Information

We do not sell, rent, or trade your personal information to third parties.

We may share information only in the following limited circumstances:

Service providers: hosting and infrastructure providers (e.g. Vercel) who process data on our behalf under confidentiality obligations.
Legal obligations: if required by law, court order, or to protect the safety of users or the public.
Business transfer: if Incoplace is acquired or merged, user data may transfer as part of that transaction, subject to the same privacy protections.

4. Public Content

Posts and replies you make on Incoplace are publicly visible by default. Your username and suburb/city are displayed alongside your posts. Do not post information in public threads that you wish to keep private.

Private messages are visible only to the participants of that conversation and to administrators acting in response to a reported abuse complaint.

5. Data Retention

We retain your account data for as long as your account is active. If you request account deletion we will remove your personal profile data within 30 days, though some content (e.g. posts) may be anonymised rather than deleted in order to preserve forum context.

6. Security

We take reasonable technical and organisational measures to protect your data, including:

Passwords hashed with bcrypt.
HTTPS enforced in production.
CSRF tokens on all state-changing requests.
HTTP security headers (X-Frame-Options, CSP, etc.).
Rate limiting on login and registration endpoints.

No system is perfectly secure. In the event of a data breach affecting your personal information we will notify affected users as required by applicable law.

7. Your Rights

Depending on your location you may have the right to:

Access a copy of the personal data we hold about you.
Correct inaccurate data via your profile settings.
Request deletion of your account and personal data.
Object to or restrict certain processing of your data.

To exercise any of these rights, contact us through the site. We will respond within 30 days.

8. Children's Privacy

Incoplace is not directed at anyone under 18. We do not knowingly collect personal information from anyone under 18, including profile photos or avatars. If we become aware that we have collected such data, we will delete it promptly.

9. Changes to This Policy

We may update this policy from time to time. We will indicate the date of the latest revision at the top of this page. Continued use of the site after changes are posted constitutes acceptance.

10. Contact

If you have questions or concerns about this Privacy Policy, please contact us through the site.