Privacy Policy
Last updated 3 November 2026
Plain language summary
We collect only what each form asks for, and only for that form's purpose. Donations are processed by Stripe; we never see your card. You sign in with a code we email you, or with your Apple, Google, Microsoft or Facebook account; we never hold a password. If you join, you choose whether you are counted on the map, which only ever shows numbers for an area. Your card, the one that says what your brain needs, is private until you share it with an organisation on the Register. If your organisation goes on the Commitment Register, the organisation, the person responsible and what it commits to are public; their email is not. We use no advertising cookies. Optional Google Analytics visit statistics stay off unless you allow them. You can ask us to see, correct or delete what we hold at any time by emailing hello@autisticprideday.org.
Our commitment
This campaign is built by and for autistic people. We know that autistic communities have historically had their data collected, shared, and used in ways that were not in their interests. We do not do that here. We collect only what we need to run this campaign. We do not sell your data. We do not share it with researchers, advertisers, or third parties without your explicit consent. Your presence in this community is not a data point for someone else’s purpose.
Who we are
In this policy, “we”, “us” and “our” mean Aurum Foundation Ltd (ABN 39 680 160 570), the Australian charity that runs this website with Just Gold, which designs and builds it. Aurum Foundation is responsible for the personal information collected through it. Our website address is https://autisticprideday.org.
What we collect, and why
| When you | We collect | What it is used for | Who can see it |
|---|---|---|---|
| Contact us | Your name, email, the topic and your message | Replying to you | Our team |
| Donate | Your name, email and the donation amount. Card details go to Stripe, never to us | Processing the donation and emailing your receipt | Our team and Stripe |
| Put an organisation on the Commitment Register | The organisation’s name, country, region, sector and website; the actions and commitment; the name, role and email of the person responsible | Reviewing and publishing the commitment, and asking for reports | Everyone, except the email, which only our team sees |
| Report against a commitment | The report and any evidence link | Reviewing and publishing it | Everyone, after review |
| Sign in | Your email address. If you sign in with Apple, Google, Microsoft or Facebook, the name and verified email that provider gives us, and nothing else | Signing you in and linking one account to your email | Our team |
| Join the campaign | Your first name, surname and date of birth; your country and state or region; optionally your town and postcode; the roles you choose; whether you are counted on the map; what we may email you about | Your campaign page, contacting you as you chose, and counts by area and country | You and our team. The public map shows only counts for an area, and any count under five as fewer than five |
| Make your card | What helps you, what gets in the way, and an optional drawing; which organisations you share it with; your answer each year to one question: did you get what you asked for? | Telling the organisations you choose what your brain needs, and counting whether requests were met | You. An organisation you share it with, through its named admin. Your yearly answer is counted with everyone else’s and never shown with your name |
| Record an action, save a plan, write a letter | What you record or save | Showing it on your campaign page. Letters are drafted on screen; we keep only a note that you sent one, if you record it | You and our team |
| Add an event | The event details, the organiser and an email | Reviewing and listing the event | Everyone, after review, except the email |
| Invite an organisation | The organisation, its country, an optional contact and reason, and your email unless you choose anonymous | Inviting the organisation and telling you what happened | Our team. We never tell the organisation who invited it |
| Share your story | Your story, how you want it credited, where it may be used, and your email | Using the story only in the ways you chose | Our team, and the public only where you allowed it |
We never ask for a diagnosis or disability status to use anything on this site. Nobody needs one to take part, to learn or to be counted. You must be 16 or older to hold an account.
Your card
Your card is yours. It stays private until you choose to share it with an organisation on the Commitment Register. When you do, the organisation’s named admin can read it and nobody else. You can change it, stop sharing it, or remove it at any time from your account. We never read it for marketing and we never publish anything about any one of us. Once a year the card asks whether you got what you asked for. Your answer is added to a count; it is never shown with your name, and no organisation sees who answered what.
Your account
You sign in with a one time code sent to your email, or with your Apple, Google, Microsoft or Facebook account. From those providers we receive only your name and your verified email address. We never hold a password, and we never see your password for those services. Accounts are linked by verified email, so one email means one account however you sign in. You can see and remove the sign in methods connected to your account in your settings. Learning at autisticprideday.org/learn needs a signed in member account; your progress is kept against that account.
Cookies and your browser
We use no advertising cookies. Signing in sets a cookie that keeps you signed in. Your comfort settings (colour, appearance, text size, spacing, font, links, reading guide, focus ring and motion) are saved in your own browser and never sent to us.
Google Analytics visit statistics are optional. The Google tag stays off until you choose Allow statistics. If you allow it, Google receives information about visits to our public pages and uses analytics cookies, configured to expire after 30 days. We remove query strings and fragments from the page address and referrer we send. We do not send names, email addresses, card content or account identifiers. The tag does not load on private member, learning course, staff, organisation, sign-in, joining, search, message, reporting or bag/checkout pages. Automatic form-interaction and site-search measurement are off. Google advertising signals and ad personalisation are off.
You can choose No thanks, or change your choice through Visit statistics settings below the footer on public pages. Withdrawing consent stops the tag and removes its analytics cookies from this site. We also respect browser Do Not Track and Global Privacy Control signals. Your choice is stored in your browser. Cloudflare Web Analytics may separately count visits without cookies. Google’s privacy policy explains its processing.
Who we share your data with
We do not sell your data and we do not share it for marketing or research without your explicit consent. These services process it for us, only to run the site:
- Cloudflare, which hosts the site, its database and the sign in for our staff admin
- Microsoft 365, which sends our email from hello@autisticprideday.org and holds the messages that come to that inbox
- Stripe, which processes donations to Aurum Foundation
- Fourthwall, which runs the shop on Aurum Foundation’s account and handles orders and delivery
- Apple, Google, Microsoft and Facebook, only if you choose to sign in with one of them
- Google Analytics, only if you allow optional visit statistics on public pages
Some of these services store data outside Australia. Each is bound by its own privacy and security terms.
How long we keep it
We keep information while it is needed for the reason you gave it. Published commitments and reports stay on the Register as a public record, unless the organisation is taken off it. If you delete your campaign details from your settings, your location, roles, actions, page, team place, saved plans, your card, who it was shared with and your yearly answers are deleted. If you withdraw a story with the link we sent you, it is emptied from our records straight away. We keep sign in records for 12 months, messages you send us for 2 years, and donation records for 7 years, as the Australian Charities and Not for profits Commission requires.
Your rights
You can ask to see the personal information we hold about you, to correct it, or to delete it. Members can change or delete their campaign details at any time in their settings. These rights apply wherever you are. We follow the Australian Privacy Principles in the Privacy Act 1988, and for people in the European Union, the GDPR.
If you are not happy with how we handled your information, tell us first. You can also complain to the Office of the Australian Information Commissioner at oaic.gov.au. Our Privacy Officer at Aurum Foundation handles every privacy question and complaint. Reach them through the contact form, and a person will reply.
Contact
For any privacy request, email hello@autisticprideday.org. A person reads that inbox and we will respond within five business days.
