Cookie Policy

Cookie use that involves collecting personal information (such as an IP address linked to an individual) is regulated as personal information under the Privacy Act 1988 (Cth). For EU/UK residents, Article 5(3) of the ePrivacy Directive (implemented by GDPR) requires informed consent for non-essential cookies.

• Privacy Act 1988 (Cth) — APP 3 (collection), APP 5 (notification), APP 11 (security)
• Spam Act 2003 (Cth) — consent for electronic tracking used in commercial messaging
• GDPR 2016/679 — lawful basis under Art. 6(1)(a) consent for non-essential tracking
• ePrivacy Directive 2002/58/EC — prior consent for non-essential cookies for EU users

We use only the categories of cookies described below. We do not use advertising or behavioural profiling cookies.

• Strictly necessary — session tokens, CSRF protection, authentication state. Legal basis: legitimate interest (cannot be turned off without breaking site functionality)
• Analytics — anonymised page-view data collected without persistent cross-site identifiers. Legal basis: legitimate interest (Australian); consent (EU/UK)
• Preference — dark/light mode, region, language. Legal basis: legitimate interest; stored in localStorage not a cookie
• Security — bot detection signals used to protect login and form endpoints. Legal basis: legitimate interest

We have deliberately excluded the following categories from our site.

• Third-party advertising or retargeting cookies (e.g., Meta Pixel, Google Ads)
• Cross-site tracking or fingerprinting technologies
• Social media tracking pixels
• Session replay or heatmap tools that record keystrokes or personal input

Cookie lifetimes are kept to the minimum necessary for their function.

• Session cookies — deleted when you close your browser
• Authentication tokens — 30 days maximum; shorter for high-privilege sessions
• Analytics cookies — 13 months maximum, then renewed on active visit
• Preference cookies (localStorage) — indefinite until cleared by user

Visitors from the EU and UK are presented with a consent banner on first visit. Non-essential cookies are not set until consent is given. Consent may be withdrawn at any time by clearing site data or adjusting browser settings.

All major browsers allow you to view, block, or delete cookies. Note that blocking strictly necessary cookies will impair site functionality.

• Chrome — Settings › Privacy and security › Cookies and other site data
• Safari — Preferences › Privacy › Manage Website Data
• Firefox — Settings › Privacy & Security › Cookies and Site Data
• Edge — Settings › Cookies and site permissions
• Mobile browsers — Settings › Site data or equivalent

Where third-party services are integrated (e.g., embedded maps, video), those services may set their own cookies under their own privacy policies. We minimise third-party embeds and load them only on user interaction where practicable.