Privacy Policy

Version: 1.0

Last updated: 12-05-2020

Updates to this Document

We may update this document from time to time, to clarify terms, expand cover for new services that we choose to offer, and other such similar needs.

In the event of any changes to this policy, we will notify you via the email address that you have provided no less than 30 days before any changes are to come into force, and we invite you to submit any concerns to privacy@cloudisland.nz.

What we Collect

Creating an Account

To create an account on the Service, we need to collect the required personal information from you, including:

• Your name,
• A username and password,
• An attestation that you are 18 years of age or older,
• An up-to-date email, to receive communications regarding the Service, and
• Accurate billing and purchase information.

If you are unable or unwilling to provide the required information, we will be unable to provide you access to the Service.

You are not required to use your name or any other personally identifiable information in your posts or media uploads to the Service.

Using the Service

In the process of using the Service, we expect you to create toots and upload media to the Service.

When you upload any content or media to the Service:

• Your toots and all service-related metadata is stored unencrypted in our active databases and database backups,
• Your uploaded media is stored unencrypted in our file storage service,
• Your uploaded media is accessible to anyone with the link, and
• Your posts and media may be uploaded to other instances in the fediverse, including private posts.

Metadata

During your use of the service, metadata associated with your use is created and stored in our servers, which includes (but is not limited to):

• The list of people who you follow,
• The date and time of any content that you upload,
• The computer or network you use to access the Service, including IP addresses,
• The IP address, browser type, and/or application used by viewers of your uploaded media, including private media,
• When, and from where, you access the Service, and
• Interactions with other users’ uploaded content, including private content.

Abuse Reports

If you need to report abuse or other violations of the Code of Conduct on the Service, we will need to collect some additional information from you, including:

• Why you think the content violates the Code of Conduct.

If you send an email, we collect the name and email address associated with that report. This email address must be the same address that you signed up with.

If you use the “Report” functionality built into the Service, metadata will be generated and stored that you reported content. When you use the “Report” functionality built into the service, if you are reporting content that originated on another instance in the fediverse, you will be offered the ability to submit that report to the remote instance.

If you choose to forward a report to the remote instance, the information we have collected regarding why the content is inappropriate will be forwarded, in an anonymised fashion, to the remote instance.

Why we Collect Your Information

Your Personal Information

We collect your personal information in order to:

• Correctly invoice you for use of the Service,
• Ensure the security and safety of accounts on the Service, and
• Adequately and completely enforce our Code of Conduct.

Enforcement of the Code of Conduct

The Code of Conduct of the Service is a detailed document that covers the intent and culture that we wish to foster.

In order to achieve that culture it’s not enough to disable a single account for a violation if a banned individual can immediately register a new account.

As a result, we are collecting a name, email address and other contact information with the intent of ensuring that when we ban a user, we ban a user.

Your Uploaded Content

Your uploaded content is collected to provide the social networking functionality as offered by the Terms of Service and Code of Conduct.

In addition to the content that you upload, metadata is also generated as a result of your interactions with the service, as detailed above.

Who has Access

Our Access

Your Personal Information

Besides our staff, we will not share your personal information with any of our suppliers, customers, or partners, for any purpose, excepting:

• Billing and contact information as necessary for our invoicing and payment processing.

Your Uploaded Content

Besides our staff, we will not share your uploaded content or media with any of our suppliers, customers, or partners, for any purpose, without your explicit opt-in consent, except as per normal usage of the Service by other users and normal operation of the fediverse.

This does not include trusted third parties who assist us in operating the Service, or our business, as long as those parties keep your content confidential.

At no point will any content be shared with any third parties for the purposes of marketing or advertising.

An example of where we may share your content is automated harm recognition.

Metadata

Besides our staff, we will not share any metadata generated generated by your use of the Service, either in part or in whole, with any of our suppliers, customers, partners, or the broader public for any purpose, excepting:

• Generation of aggregated, fully anonymised, non-identifiable usage data of the entire Service, for publication on Cloud Island or the Eiara Limited website, or as required for reporting purposes for any funding grants related to Cloud Island.

This does not include trusted third parties who assist us in operating the Service, or servicing you, so long as those parties agree to keep this information confidential.

An example of where we may share metadata generated by your use of the Service is automated log and performance analysis, database performance analysis, and other areas related to operating the Service.

At no point will any metadata be shared with any third parties for the purposes of marketing or advertising.

Exceptions

We retain the right to retain and disclose your personal information, uploaded content and/or media, and any associated metadata, including metadata related to your use of the Service, to the appropriate, competent authorities where we consider it necessary, without your consent, as part of evidential purposes related to a breach of our Terms of Service, Code of Conduct, and/or New Zealand law.

Federated Access

Your Personal Information

As detailed in Federation, the service operates as an instance in the fediverse.

As a result, your username, profile picture, and profile text will be uploaded to other instances as part of the normal operations of the fediverse.

Your Uploaded Content

As detailed in Federation, the service operates as an instance in the fediverse.

As part of normal operation of the Service and the fediverse as a whole, regular data sharing occurs, and is expected to occur.

Examples of content and media that you have uploaded to the Service that may be distributed to other instances are:

• Your username,
• Posts that you make to the Service, and
• Any media that you may upload or have uploaded to the Service, including private media.

While we do not upload any metadata that we have created to other instances, metadata will be created and stored by those parties, and will be governed by their Privacy Policies, Terms of Use, and Retention Policies.

Retention

Our Retention

As part of normal operations of the Service, we will retain the entirety of your posts and uploaded media for the duration of your subscription.

As detailed in Founding Principles, the Services are hosted in New Zealand, including uploaded media.

Sale and other Transfers of Service

Without a notification to you of no less than 30 days and your explicit opt-in consent, your personal information, content, media, and any metadata we hold that is associated with your interactions with the Service will not be transferred to any third party in any sale or transfer of Eiara Limited as a whole, or Cloud Island as a Service.

Without your consent during the notification period, your personal information, uploaded content, media, and any associated metadata will be permanently deleted.

Federated Retention

As detailed in Federation, the Service operates as an instance in the fediverse.

Any posts or media you upload to the Service that are uploaded to other fediverse instances may be retained indefinitely, and may be shared indiscriminately, as governed by the specific privacy policies and terms of use of those instances.

Additionally, any metadata created on those instances as a result of your interactions or uploads may be retained indefinitely, and may be shared indiscriminately, as governed by the specific privacy policies and terms of use of those instances.

Providing Information

Some information is optional, such as:

• A profile picture,
• A display name,
• Identity proofs (such as Keybase),
• Custom profile metadata,
• A header image for your profile, and
• A description for your profile.

Other information is not optional and is required to use the Service, as detailed in What We Collect.

Safekeeping

Optional Information

Optional information such as a profile picture, header image, and description is publicly accessible, and is stored in clear text, in the case of your description, or as publicly accessible images, in the case of your profile picture and header image.

This information will be maintained as part of our standard backup and media management processes.

Required Information

For the information that we require, it will be stored:

• Your name and contact information will be stored in our payment management platform, Patreon, and is secured according to their privacy and data management policies.
  • Our security practices related to use of Patreon include the use of strong passwords and two-factor authentication.
• Your username and email address will be stored unencrypted in the Service database, and is stored unencrypted in our backups.
• Your password will be stored encrypted in the Service databases, and is stored encrypted in our backups.
• Your payment information is not collected by us, and is stored and managed by our payment and subscription provider, Patreon. At no point do we have access to your payment information.

Termination

If you choose to terminate your subscription with the Service, you are responsible for requesting and downloading an archive of your Content prior to the end of your subscription.

Violation of the Code of Conduct

If your account is terminated for a violation of the Code of Conduct, we will retain an archive of your Content for no less than 2 years, to ensure that we retain the ability to comply with any legal processes that may result from the Violation.

In the event of a termination due to violation of the Code of Conduct, we will not provide you a copy of this or any other archive of your uploaded Content.

Updating and Accessing Your Information

You have the ability to update some of your personal information, such as your profile description, email address, and password, as part of normal operations.

You also have the right to ask for a copy of any other personal information we hold about you, and to ask for it to be corrected if you think it is wrong. If you’d like to ask for a copy of your information, or to have it corrected, please contact us at privacy@cloudisland.nz.

If your account is in good standing, at any time you may request and download an archive of your Content, which will be provided in the ActivityPub format.

This archive is readable by any compliant software.

An archive may be requested every 7 days.

Code of Conduct

Version: 1.0

Last updated:

TLDR:

Cloud Island has a zero-tolerance policy for racism, antisemitism, Islamophobia, xenophobia, sexism, homophobia, transphobia, ableism, and other forms of discriminatory and bigoted conduct. Sexually graphic and violent imagery is not permitted on Cloud Island.

Harassment of other fediverse users is not permitted on Cloud Island.

Harmful content that is provably false (for example, “5G causes coronavirus” or “vaccines cause autism”) is not allowed, will be removed, and may result in an account suspension.

Sexual harassment is an instant ban.

Transphobic content is an instant ban.

Far-right content, expression of far-right ideologies, and/or the advocation thereof is an instant ban.

We reserve the right to suspend your account at any time.

Updates to this Document

We may update this document from time to time for reasons including:

• clarifying terms,
• addressing new forms of harassment, or
• addressing harmful community behaviours.

In the event of any changes to this policy, we will notify you via the email address that you have provided of any changes to the Code of Conduct, and an announcement posted via the Mastodon administration system.

Any changes to the Code of Conduct come into force immediately.

The Long Version

The following guidelines are not a legal document, and final interpretation is up to the administration of Cloud Island; they are here to provide you with an insight into our content moderation policies.

Unacceptable Content

The following types of content will be removed from the public timeline:

• Nudity that has not been:
  • Appropriately tagged, and
  • Masked behind a Content Warning.

The following types of content will be removed from the public timeline, and may be removed entirely:

• Excessive advertising, and
• Uncurated news bots posting from third-party news sources.

The following types of content will be removed, and may result in account suspension and revocation of access to the service:

• Any pornography and sexually explicit content, including artistic depictions,
• Any gore and/or extremely graphic violence, including artistic depictions,
• Racism or advocation of racism,
• Sexism or advocation of sexism,
• Content harmful to the public good, examples including:
  • “5G causes coronavirus”
  • “Vaccines cause autism” (or, for clarity, any other anti-vaccine content)
• Xenophobic and/or violent nationalism.

The following types of content are explicitly disallowed, and will result in permanent revocation of access to the service:

• Sexual harassment,
• Content discriminating against gender and sexual minorities, or advocation thereof,
• Content illegal in Germany and/or France, such as holocaust denial or Nazi symbolism, and
• Conduct promoting any far-right ideology.

The following types of content are explicitly disallowed, and will result in permanent revocation of access to the service and referral of any and all user-generated content and personally identifiable information to the New Zealand Police Force:

• Content that is “objectionable”, as defined by the Films, Videos, and Publications Classification Act (1993).

Harassment

Any conduct intended to stalk or harass other users, or to impede other users from utilising the service, or to degrade the performance of the service, or to harass other users, or to incite other users to perform any of the aforementioned actions, is also disallowed, and subject to punishment up to and including revocation of access to the service and/or referral to the New Zealand Police force, at our discretion.

Harassment includes the following behaviours:

• Offensive comments related to gender, gender identity and expression, sexual orientation, disability, mental illness, neuro(a)typicality, physical appearance, body size, race, or religion,
• Unwelcome comments regarding a person’s lifestyle choices and practices, including those related to food, health, parenting, drugs, and employment,
• Deliberate misgendering or use of ‘dead’ or rejected names,
• Simulated physical contact (eg, textual descriptions like “hug” or “backrub”) without consent or after a request to stop,
• Threats of violence,
• Incitement of violence towards any individual, including encouraging a person to commit suicide or to engage in self-harm,
• Deliberate intimidation,
• Stalking or following,
• Harassing photography or recording, including logging online activity for harassment purposes,
• Sustained disruption of discussion,
• Unwelcome sexual attention,
• Pattern of inappropriate social contact, such as requesting/assuming inappropriate levels of intimacy with others,
• Continued one-on-one communication after requests to cease,
• Deliberate “outing” of any aspect of a person’s identity without their consent,
• Publication of non-harassing private communication,
• Continuing to engage in conversation with a user that has specifically has requested for said engagement with that user to cease and desist may be considered harassment, regardless of platform-specific privacy tools employed,
• Aggregating, posting, and/or disseminating a person's demographic, personal, or private data without express permission (doxing or dropping dox),
• Inciting users to engage another user in continued interaction or discussion after a user has requested for said engagement with that user to cease and desist (brigading or dogpiling).

Cloud Island and Eiara Limited prioritise the safety of marginalised people over the comfort of privileged people. As a result, we will not act on complaints regarding, but not limited to:

• ‘Reverse’ -isms, including ‘reverse racism,’ ‘reverse sexism,’ and ‘cisphobia’,
• Reasonable communication of boundaries, such as ‘leave me alone’, ‘go away’, or ‘I’m not discussing this with you’,
• Communicating in a ‘tone’ you don’t find congenial, and
• Criticising racist, sexist, cissexist, or otherwise oppressive behaviour or assumptions.

Participants asked to stop any harassing behaviour are expected to comply immediately.

Reporting

If you are being harassed by a user of Cloud Island, notice that someone else is being harassed, please report using the ‘Report’ feature in the application.

If you have any other concerns, please contact Eiara Limited atabuse@cloudisland.nz, using the email address you provided when you signed up.

This Code of Conduct applies to Cloud Island, but if you are being harassed by a user of Cloud Island outside of the Service, we still want to know about it.

We will take all good-faith reports of harassment by Cloud Island members seriously. This includes harassment outside our spaces and harassment that took place at any point in time. The abuse team reserves the right to exclude people from Cloud Island based on their past behaviour, including behaviour outside Cloud Island spaces and behaviour towards people who are not users of Cloud Island.

Reports intended to silence legitimate criticism may be deleted without response.

Reports that come from email addresses that are not active members of Cloud Island will be deleted without response.

These provisions notwithstanding, the administration of the service reserves the right to revoke any user's access permissions, at any time, for any reason, except as limited by law.

Netsafe

If you believe that you are being harmed by the definition of the Harmful Digital Communications Act (2015), in addition to reporting the content to Us, you are encouraged to report the content to Netsafe New Zealand.

If you choose to report content to Netsafe New Zealand, please inform us so we don’t delete the offending content before they have a chance to review it.