Legal
How The Bulletproof Goth handles the information you share — in plain language, because you deserve to actually understand it, not wade through it.
Last updated: 6 September 2026
The Bulletproof Goth ("TBG", "we", "us") is a one-person creative and product studio based in Melbourne, Victoria, Australia — ABN 29 438 654 159. For anything to do with your privacy, you can reach us at hello@bpgm.au.
We handle personal information in line with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
This policy covers this website (bpgm.au) and the ways we collect and use personal information through it. Some projects — such as the Sparkles app — may have their own additional privacy terms; where they do, those apply alongside this one.
Most of what we hold is information you choose to give us, usually by email. That can include:
Most of this site is hand-written static pages; the Ramblings section runs on a small self-hosted blog engine. We do want to know, in the roughest terms, whether anyone is reading any of it — so yes, we measure traffic.
Across the public site, Ramblings included, we use Plausible, a privacy-focused analytics service. What it records is the page you looked at, the site or search that sent you here (if any), your rough location at country level, and the general kind of browser and device you used — all of it aggregated into counts. It sets no cookies, stores no IP address, follows you nowhere else, and builds no profile of you. We can see that a page was read forty times. We cannot see who read it.
A few pages also count things you press — the play button on Break, for instance, or a link on the Sparkles page. Those are counted the same anonymous way: we learn that a button was pressed, never by whom.
One exception worth naming: the Ramblings blog engine keeps its own small visitor log, separate from Plausible. Each entry is a scrambled (hashed) form of the visitor's IP address plus the time, and the files delete themselves automatically after seven days. It does nothing but put a visitor count on our own dashboard. We spell it out because a hashed IP address is not quite the same as no IP address, and we would rather tell you it is there than leave it unsaid.
There is no advertising on this site and no advertising trackers, and we never share what we measure with anyone.
The password-protected areas of the site — such as Unexpected Wisdom and Refrain — carry no analytics at all.
Separately from any of that, our web host may keep standard server logs (such as IP addresses and page requests) for security and reliability, as almost all hosts do.
We load typefaces from Google Fonts. To serve them, Google may receive your IP address and the fact that your browser requested a page. This is standard for sites using Google Fonts and is governed by Google's own privacy policy.
The interactive parts of the Grief Navigator — the toolkit and both Wheels of Emotion — save what you type into them in your browser's local storage, on your own device, so your reflections are still there when you return. That information is not sent to us or anyone else, and you can clear it at any time from within the tool or by clearing your browser data.
Refrain is a private, members-only songwriting space for The Greatest Band That Never Was. It works differently from the rest of this site — it has accounts, it holds what you write and upload, and it keeps some security records. This section says exactly what that means, because none of it is obvious from the outside.
The application form asks for your name and email address, and — only if you want to give them — where you are, what you play, the genres you love, how much songwriting you have done and any notes about that, links to your work, and a message. We also record the date and your IP address with the application, as a basic guard against automated abuse.
We use it for one thing: deciding whether to invite you in, and getting in touch about it either way. Applications that are declined are kept only long enough to answer questions about the decision, and are then deleted.
Your account holds your username, a display name, your email address, and optionally your location, the genres and instruments you have told us about, and links you choose to add. Your password is stored only as a cryptographic hash — we cannot see it, and nobody at TBG can tell you what it is. If you reset it, a single-use token is stored until you use it or it expires.
Songs, seeds, ideas, comments and files — audio, sheet music, images and words — are stored on the same Australian hosting as the rest of the site, with uploaded files kept outside the public web folder so they cannot be reached by a direct link. Within Refrain they are visible only to the admins, the moderators, and the crew of the song they belong to. They are never public, never indexed by search engines, and never shown to anyone outside that space.
Refrain keeps two logs, both of which include IP addresses: failed and successful sign-in attempts, so that repeated guessing can be slowed down; and an activity log of significant actions — who changed what, and when. They exist to keep a private space private and to settle questions about what happened. They are not used to profile anybody, and they are not analytics: the note above about us not storing IP addresses is about this site's visitor counting, and Refrain is the deliberate exception to it.
Signing in sets one cookie, which exists purely to keep you signed in as you move between pages. It expires when you close your browser, carries no information about you beyond a session identifier, and does not follow you anywhere else. It is the only cookie you will pick up anywhere on this site, and it is strictly necessary — there is no way to offer a login without one.
You can withdraw from a song, or leave Refrain entirely, whenever you want and without explaining why. By default, what you have already contributed stays in the song's thread, credited to you. That is deliberate rather than awkward: songs here are written by several people over time, and quietly removing one person's contribution would misrepresent how the result came to exist.
But if you want it gone, it goes. Ask us and we will delete your contributions along with your account, your profile and your contact details. It is your work and your information, and that decision is yours to make — you do not have to justify it, and we will not argue with you about it.
Two honest limits on that. Deleting something here cannot reach a song that has already been released into the world — we can remove what we hold, but not copies other people already have. And because deleting part of a collaborative song affects the people who built on it, it is done deliberately and recorded, rather than happening quietly.
Nobody outside Refrain. Contributions are not shared with anyone else, not sold or rented, not used to train anything, and not published anywhere unless a song is released and you have agreed to how that release credits the people who made it. The separate agreement covering contributions and credit is given to you before you join a crew, and it — not this page — is where those arrangements are set out.
Some of what you might share — for example your gender, or personal stories about difficult experiences — can be "sensitive information" under the Privacy Act. We only collect it where you actively choose to give it to us, for the specific purpose you gave it, and with your consent. You are always free to share less.
We use the information you give us to:
We don't use your information for anything you wouldn't reasonably expect, and we don't do automated profiling or decision-making.
If you offer a contribution to a project, nothing is published without your agreement. Contributions to See Me, See You are intended to appear under your first name and last initial, or initials only if you prefer. We'll always confirm the details with you before anything is finalised.
We don't sell or rent your personal information. We only share it where it's genuinely needed to run TBG, for example:
We use reputable third-party providers (such as email, hosting, and Google Fonts) that may store or process data on servers outside Australia. Where that happens, we take reasonable steps to ensure your information is handled consistently with the APPs.
We take reasonable steps to keep your information secure and to hold it no longer than we need to. As a small operation, we also keep the amount we collect deliberately low — the less we hold, the less there is to protect.
You can ask us to:
Just email hello@bpgm.au and we'll help. If you're ever unhappy with how we've handled your information, please tell us first — and you also have the right to complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
This site isn't directed at children, and we don't knowingly collect personal information from anyone under 16 without a parent or guardian's involvement.
We'll update this page when things change, and we'll revise the "last updated" date at the top when we do.
Questions about your privacy, or want to exercise any of the rights above? Email hello@bpgm.au.