ਨਿੱਜਤਾ ਨੀਤੀ

1. Who is responsible for your information

This site is operated by Northview Productions Inc., a British Columbia company doing business as Kalam Di Goonj (“the Company”, “we”), of Surrey, British Columbia, Canada. We handle personal information under British Columbia’s Personal Information Protection Act (PIPA) and, where information crosses provincial or national borders or relates to subscribers outside BC, the federal PIPEDA.

Our Privacy Officer is accountable for how we handle your information. You can reach the Privacy Officer at [email protected], or by mail at Unit 216, 7928 128th Street, Surrey, BC V3W 4E8, Canada.

2. What we collect, and why

We collect only what the site, your account, and the law require. This section lists all of it.

Your account. Your email address, used to sign you in, verify your email, and contact you about your account; and your password, which we store only as a one-way hash and never in readable form. If you enable two-factor authentication, we store what that requires, including your enrolled second factor and your recovery codes, protected the same way.

Your reading. Your bookmarks (ਨਿਸ਼ਾਨੀਆਂ), related reading features such as saved progress, and your display and reading-form preferences. Some preferences are stored only on your own device (section 7).

Your membership. Whether your patronage is active, the dates of the current period, and the customer identifier Stripe assigns you. This mirrors what Stripe reports to us. Your card and bank details never reach us (section 5).

Your newsletter (ਚਿੱਠੀ) consent. If you request the newsletter, we keep your email address, the fact and time of your opt-in, the wording you agreed to, and the signed HMAC token used for the confirmation link. Subscription is double opt-in: we send a confirmation email after you submit the form, and you join the list only once you confirm. We retain these consent receipts because Canada’s anti-spam legislation (CASL) requires us to be able to evidence your consent.

Correspondence. Delivery logs for the emails we send you, your support and billing correspondence, and any privacy request you make, together with our response.

Submissions. Submissions reach us by email. We retain the correspondence and the work you send, and we handle contributor information under our Contributor Submission Terms. Editorial material, including sources, drafts, and journalistic records, is governed by our editorial policies rather than treated as account data.

Security and operations. Web session records, sign-in and authentication events, and IP addresses in security logs, retained briefly so we can detect intrusion attempts and protect accounts; standard server logs recording request times and errors; and nightly backups held on a 14-day rolling window for restoration.

We will not collect anything beyond this without telling you at the point of collection.

3. Purposes at a glance

We do not use advertising trackers. We do not sell or rent your information or disclose it to data brokers. We do not track you across other sites.

4. Who processes information for us

We use a small set of service providers, each for a single defined purpose. None of them endorses the Publication; we name them for transparency.

Stripe (payments). You enter your payment details on Stripe’s own secure pages when you begin your patronage. Your card number never reaches our servers and is not visible to us. For most of its processing Stripe acts as our payment processor on our instructions. For fraud prevention and its own regulatory compliance, Stripe also acts as an independent controller of that data under its own privacy policy. Stripe processes data in the United States and elsewhere.

Resend (email delivery). Delivers our transactional email and, separately, the newsletter you consented to. Resend processes data in the United States.

Cloudflare (content network and media storage, including R2). Sits in front of the site for performance and security and stores published media. Cloudflare processes data in the United States and globally.

Our hosting provider (— to supply —) operates the servers and databases behind the site.

Each provider is bound by a data-processing agreement, and our internal vendor register tracks them. Because Stripe, Resend, and Cloudflare process data in the United States, your information held there is subject to United States law, and US courts, law enforcement, and national-security authorities may be able to compel access to it under US legal process. We state this expressly, as Canadian privacy guidance requires, so that your consent to using the site is informed. We seek comparable protection by contract, but no contract displaces another country’s law.

5. Payments

Stripe processes all membership payments. We hold only whether your patronage is active, the period dates, and the Stripe customer identifier. We never hold your card number. Receipts, renewal notices, and refunds are governed by our Billing & Refunds terms.

6. Reading statistics (analytics)

Where we measure readership, we do so on a privacy-first basis and only with your consent. We run self-hosted analytics (Umami) in a cookieless configuration: it sets no cookies, stores no raw IP address, builds no advertising profile, and performs no cross-site tracking. On your first visit we ask whether you consent to these reading statistics, and nothing is counted unless you accept. You can change your choice at any time from the cookie-preferences control in the footer. Visits are counted using a short-lived visitor identifier computed on our server by hashing technical attributes with a salt that rotates monthly, so counts cannot be linked back to you over time. The resulting measures are aggregate: which pages are read, approximate region, and device class. Query strings, which can carry tokens, are excluded. Our Analytics & Cookie Notice sets out exactly what is and is not collected, and for how long.

7. Cookies

We use only the cookies the site requires to function: a session cookie that keeps you signed in between pages; a CSRF cookie that protects your account against forged form submissions; and a display preference recording day or night mode and your chosen reading form, stored on your own device. We set no advertising or third-party tracking cookies, and our analytics sets no cookies at all. These strictly necessary cookies do not require consent. Our reading statistics (section 6) are separate and run only if you accept them. The full cookie table and our position on European law are in the Analytics & Cookie Notice.

8. How long we keep information

While your account is active we retain the information in section 2 so that your account, bookmarks, and membership continue to work. Beyond that, we retain information briefly or for the period the law prescribes.

Our internal Data Retention & Secure Deletion Schedule is the authoritative version of this table. Where the law requires a hold on deletion, for example in anticipation of litigation, that hold prevails for as long as the law requires.

9. Your rights, and how to exercise them

You may ask us at any time for access to the personal information we hold about you, together with an account of how it has been used and disclosed; for correction of anything inaccurate; for an export of your account data in a portable format; for deletion of your account and information (section 10); and to withdraw a consent you have given, such as your newsletter subscription. Withdrawal takes effect immediately in most cases and within 10 business days at the latest.

Write to the Privacy Officer at [email protected] from the email address on your account, or use the privacy-request form on the site. We verify your identity before releasing or deleting anything, and we respond within 30 days. Where the law permits an extension in a particular case, we will tell you why and when to expect our response. We charge no fee for a reasonable request.

If our response does not satisfy you, you may complain to us and to the regulators: the Office of the Information and Privacy Commissioner for British Columbia (OIPC BC) and, for matters under federal law, the Office of the Privacy Commissioner of Canada (OPC). One limit applies: a request reaches all of your account and subscription data, but our journalistic materials, including sources and editorial records, are protected and are not disclosed through this process.

10. Closing your account and deleting your information

You can close your account at any time from Account → Close account (ਖਾਤਾ ਬੰਦ ਕਰੋ), or by writing to us. Closing your account cancels any active patronage and removes or anonymizes your email address, name, bookmarks, and other personal details in our live records. Anonymization means that where a record must be retained for technical or legal reasons, every identifying element is stripped out so that what remains identifies no individual.

Two limits apply. First, billing and tax records that the law requires us and Stripe to keep are retained for the prescribed period, about 7 years for tax records, and a legal hold, where one applies, suspends deletion. Second, your data persists in our backups until the 14-day backup window expires. Backups are restored only for disaster recovery, and any restoration re-applies the deletion.

11. Children and younger readers

Kalam Di Goonj is a general-audience publication written for adult readers. You must be at least 16 years old to create an account. We do not knowingly collect personal information from children below that age, and we delete it if we learn we have. Our Minors Notice covers younger readers, contributors under the BC age of majority, and guardian consent.

12. Where your information travels

We are a British Columbia company and we keep data in Canada wherever we can, but parts of the service run on providers that process data in the United States (section 4). By using the site you are informed that your personal information may be stored and processed outside Canada and may be accessible to foreign authorities under foreign law. For Quebec residents, we apply the protections of Quebec’s private-sector privacy law to your information as a matter of prudence, including assessment of transfers outside Quebec.

13. Breach notification

If a privacy breach creates a real risk of significant harm to you, we will notify you and report to the Privacy Commissioner of Canada as federal law requires. We maintain records of all breaches. Our internal breach procedure governs how we assess and respond to them.

14. Changes to this policy

This policy may change, for example when we add a feature or change a provider. Where a change is material we will update the date above, post a notice, and email account holders before the change takes effect. We will not expand what we collect without telling you.

15. Contact

Privacy questions and privacy requests: Privacy Officer, [email protected]. Postal: Northview Productions Inc. (dba Kalam Di Goonj), Unit 216, 7928 128th Street, Surrey, BC V3W 4E8, Canada. All other channels are listed on our Contact page.