Policies & terms

This policy explains what personal information CSAFI collects when you use csafi.org, why we collect it, who we share it with, and the choices and rights you have. We have written it in plain English on purpose.

Who we are and how to reach us

CSAFI — the Cybersecurity Association of the Food Industry — is a membership association that helps food-industry organisations defend themselves against cyber threats. We are the controller of the personal information described in this policy.

Global Headquarters
26828 Maple Valley Hwy, #273, Maple Valley, WA 98038, USA

Australia
U30, 24 Dunmore Tce, Auchenflower, Brisbane 4066 QLD, Australia

• Email: contact@csafi.org or support@csafi.org
• Phone: +1 (206) 619-1852 (US) · +61 401 693 502 (Australia)
• Contact form: csafi.org/contact

Privacy questions and requests can go to either email address. Please put "Privacy" in the subject line so we route it quickly.

What information we collect

Information you give us

• Your account. Your email address, full name, company, job title, phone number, your membership tier and roles, and your display preferences (the language you chose and whether you use the dark or light theme).
• Membership scope. If you join on an organisation tier, we record the address of each site you are covering and the employee-count band for that site. Cooperative members give a member-count range instead. We collect this because it is what the price is based on.
• Forms you submit. Contact messages, cyber incident reports, threat-alert subscriptions, career applications, thought-leader applications, and partner demo requests. Each form collects only the fields shown on it.
• Content you publish. If you are an approved thought leader or a partner company in the Growth Hub, we store what you write for publication — profiles, articles, reports, events, testimonials and marketplace listings — because publishing it is the point.

We do not accept file uploads. There is nowhere on this site to upload a document. Where a job application would normally ask for a CV, we ask for a link instead (LinkedIn, a portfolio, or a CV you host yourself).

Information we collect automatically

• Server logs. Ordinary web-server records: your IP address, the page requested, the time, and basic browser information. We use these to keep the site running and to investigate abuse.
• Rate-limiting counts. We count recent requests per IP address so that our forms and the sign-in step cannot be flooded. These counts are kept only for the length of their window and are then deleted automatically.
• A record of what our staff do. When someone at CSAFI changes a record — approving an application, publishing an article, deleting an account — we log who did it, what they changed and when. This is an accountability measure: it is how we can tell you what happened to your information, and it never contains a password or a code, because we hold none.
• A session cookie. csafi_session is set only after you sign in. It is strictly necessary — it is what keeps you signed in — it cannot be read by scripts running on the page, and it is removed when you sign out.
• Browser local storage. We store your colour-theme choice, and a cache of translated text so the same sentence does not have to be translated twice. Neither contains your personal information, and neither is ever sent to us.

That is the complete list. There is no advertising cookie and no third-party analytics or tracking cookie on this site. Our Cookie Policy sets out each item in detail.

Information from payment processing

Payments — memberships, donations and paid event seats — are handled entirely by Stripe. No card number ever reaches CSAFI. You enter your card details on Stripe's own hosted page, and Stripe tells us only the outcome.

What we store is the amount, the currency, the status of the payment, what it was for, and Stripe's reference ids so a payment can be matched to your account. For a subscription we also store its state (active, past due, cancelled and so on) and the date the current period ends, so we know whether your membership is still running.

Why we use it, and our lawful bases

We do not sell your information, and we do not track you

To be completely plain about it:

• We do not sell personal information, and we never have.
• We do not share it for cross-context behavioural advertising.
• We run no advertising on this site.
• We use no third-party analytics, no tracking pixels, no ad networks and no social-media trackers.
• We do not build profiles of you for marketing, and we make no automated decisions that produce legal or similarly significant effects.

The only third parties who receive your information are the service providers listed below, who process it on our instructions to make the site work.

Who we share it with

• Stripe — payments, subscriptions and the billing portal. Stripe receives your card details directly from you, plus your name, email and billing information. It is the payment processor; we could not take money without it.
• Postmark — sending email. Postmark receives the recipient's email address and the contents of the message: sign-in codes, receipts, event confirmations, calendar invites and notifications.
• Google Cloud Translation — translating the page, and only when you switch the site's language away from English. The visible text of the page is sent for translation. English is never sent to Google, so if you never switch language, nothing goes there at all.
• Google Places — address suggestions. When you type an address into an address box, what you type is sent to Google to return suggestions.
• Neon — our PostgreSQL database provider. Neon stores the data described in this policy.
• Vercel — website hosting. Vercel serves the pages and handles the requests, including the associated server logs.

We may also disclose information where the law requires it, to establish or defend legal claims, or to a successor organisation if CSAFI ever merges or transfers its activities — in which case this policy travels with it.

International transfers

CSAFI serves members in the United States, Australia, the United Kingdom, the European Union and beyond. Our data is processed in the United States, where our providers are based, and our staff in Australia and the US both access it.

If you are in the UK or the EU, that means your information is transferred outside your country. We rely on the safeguards those transfers require: Standard Contractual Clauses with our providers, together with the UK Addendum where the UK's rules apply, and — where a provider participates in it — the EU–US and UK–US Data Privacy Framework. You can ask us for details of the safeguards that apply to you.

How long we keep it

We keep information only as long as we need it, and then delete it. That is not a slogan here: a scheduled job actually removes the following, on these timings.

Everything else is kept on a judgement, not a timer, and we would rather say so than invent a number:

• Your account and membership record are kept while you are a member and for a reasonable period afterwards, so you can rejoin and so we can answer questions about your membership.
• Payment records are kept for as long as tax and accounting law requires — typically several years — because we are obliged to keep them.
• Form submissions — contact messages, incident reports, career applications, thought-leader applications and threat-alert subscriptions — are records rather than working data, and we have deliberately not set an automatic deletion period for them. We keep them for as long as we need them to deal with the matter and to keep a proper record of it. You can ask us to delete yours at any time.
• Published content stays up until you or we take it down.

There is one deliberate exception, and it exists to protect you. If you unsubscribe or tell us to stop emailing you, we keep your address on a do-not-contact list and we never delete it. Deleting that entry is what would cause us to start emailing you again. It is the one piece of information we keep precisely in order to respect your wishes.

How we protect it

Concretely, and not as a slogan:

• We store no passwords, anywhere. There is no password field in our database, because there are no passwords (see below).
• Sign-in codes and session tokens are stored only as one-way hashes. We cannot read either one back. If our database were ever exposed, nobody could take a code or a session token out of it and use it.
• A sign-in code expires after 10 minutes, can be used once, and dies after 5 wrong guesses.
• Every failed sign-in returns the same message, so the site cannot be used to work out who has an account.
• The session cookie is httpOnly, so no script running on the page can read it.
• Card details never reach us. They go from your browser to Stripe. We could not leak a card number, because we never hold one.
• Traffic is encrypted in transit with HTTPS, database access is restricted to our servers, and administrative screens are behind a role check on every request.

No system is perfect, and we will not pretend otherwise. If a breach affects your rights, we will tell you and the relevant regulator as the law requires.

Signing in without a password

CSAFI has no passwords. To sign in, you enter your email address and we email you a six-digit code; you type the code back, and you are in.

This is unusual, so it is worth saying why we do it. A password is something we would have to store, you would have to remember, and an attacker could steal from us and try on your other accounts. A code that lives for ten minutes, works once, and only ever arrives in your own inbox removes that whole problem. It also means that a request to "reset your password" is meaningless here — there is nothing to reset, and nothing for anyone to phish out of you and reuse.

When our team accesses your account

Sometimes support needs to see exactly what you are seeing — most often when you cannot receive your own sign-in code. A CSAFI super-administrator can open a one-time link that signs their browser in as you.

We think you should know that exists, and know how tightly it is bounded:

• only a super-administrator can do it, only if they have signed in recently themselves, and never while they are already acting as somebody else;
• the link works once, expires within minutes, and is stored only as a one-way hash — a copy of our database contains no usable link;
• the link's secret travels in the part of a web address that browsers never send to any server, so it appears in no log;
• an administrator can never be accessed this way — the feature refuses to target one;
• the session it opens is short and does not renew itself;
• we record who opened it, and everything done during it is recorded against the administrator, not against you; and
• it can be revoked at any time, which also ends any session already open.

We use it for support, not for browsing. If you would rather we did not, tell us and we will note it on your account.

Your rights if you are in the UK or the EU

Under the UK GDPR and the EU GDPR you have the right to:

1. Access the personal information we hold about you, and get a copy.
2. Correct anything that is wrong or incomplete.
3. Delete it, where we have no continuing reason or obligation to keep it.
4. Restrict how we use it while a question about it is resolved.
5. Object to processing we carry out on the basis of legitimate interests.
6. Portability — receive the information you gave us in a machine-readable form, or have it sent to another organisation.
7. Withdraw consent at any time, where we relied on consent. Withdrawing does not undo what we did before.

The quickest way to stop our emails is the unsubscribe link at the foot of them. It is signed, so nobody can unsubscribe you but you, and it deliberately never expires — a link in a year-old email still works. There is no matching "resubscribe" link, so it can only ever stop mail, never start it.

How to exercise the rest: email contact@csafi.org or support@csafi.org, or use the contact form. We will respond within one month, and will tell you if we need longer for a complex request. Because we hold no passwords, we usually verify who you are by emailing a code to the address on the account — please write from that address if you can.

You can also complain to your data protection authority. In the UK that is the Information Commissioner's Office (ico.org.uk); in the EU it is the supervisory authority for your country. We would rather you came to us first, but the right is yours either way.

Your rights if you are in California

Under the CCPA, as amended by the CPRA, California residents have the right to:

1. Know what personal information we collect, why, where it comes from and who receives it — this policy sets that out.
2. Access a copy of the specific pieces of personal information we hold about you.
3. Delete the personal information we hold, subject to the exceptions the law allows (for example, records we must keep for tax purposes).
4. Correct inaccurate personal information.
5. Opt out of the sale or sharing of personal information. We do not sell or share personal information, and have not done so in the preceding 12 months, so there is nothing to opt out of and we run no "Do Not Sell or Share My Personal Information" link.
6. Limit the use of sensitive personal information. We do not collect sensitive personal information for the purposes that right covers.
7. Not be discriminated against for exercising any of these rights. We will not charge you more, give you less, or cancel your membership because you asked.

The categories we collect are identifiers (name, email, phone, IP address), commercial information (memberships, donations, event seats), professional or employment information (company, job title, job applications), internet activity limited to our own server logs, and the site addresses organisation members give us for pricing. We collect them for the purposes in the table above.

To make a request, email contact@csafi.org or support@csafi.org. An authorised agent may act for you if they provide written permission signed by you. We verify requests using the email address on your account.

Children

This site is for food-industry professionals. It is not intended for anyone under 18, and we do not knowingly collect personal information from children. Memberships, donations, event registration, job applications and partner accounts are all for adults. If you believe a child has given us personal information, tell us and we will delete it.

Links to other sites

Some links take you off this website, and this policy stops at the boundary.

• Our older member application at app.csafi.org is a separate system with its own accounts and its own privacy practices. Signing in on csafi.org does not sign you in there, and the two do not share the information described here.
• Stripe's checkout and billing pages are Stripe's, and your card details are handled under Stripe's privacy policy.
• Partner profiles, marketplace listings, articles, reports and job links may point to websites we do not run. We do not control what those sites do.

Please read the privacy policy of any site you follow a link to.

How we tell you about changes

If we change this policy, we publish the new version on this page and update the effective date shown under its title. If a change materially affects how we use your information, we will do more than that: we will email members and subscribers at the address we hold, before the change takes effect where we reasonably can.

If you disagree with a change, you can ask us to delete your information, cancel your membership, or unsubscribe — and you can always ask us what changed and why. Write to contact@csafi.org.

What these terms cover, and your agreement to them

These terms are the agreement between you and the Cybersecurity Association of the Food Industry (CSAFI) for your use of csafi.org and everything on it — reading our articles, joining as a member, donating, registering for events, applying to programmes, and using the Growth Hub.

By using the site, you agree to these terms. If you do not agree, please do not use the site.

Our older member application at app.csafi.org is still running while we move features across. These terms apply there too.

CSAFI's global headquarters is at 26828 Maple Valley Hwy, #273, Maple Valley, WA 98038, USA, with an Australian office at U30, 24 Dunmore Tce, Auchenflower, Brisbane 4066 QLD, Australia. You can reach us at contact@csafi.org, support@csafi.org, or through the form at csafi.org/contact.

Who may use the site, and account eligibility

Anyone may read the public parts of the site. To hold an account you must:

• be at least 18 years old;
• give us a real email address that you control; and
• give accurate information about yourself and, where relevant, your organisation.

This is a professional association for the food industry. Our site is not designed for children and we do not knowingly create accounts for anyone under 18.

Signing in is not the same as joining. Our sign-in only issues a code to people who already hold a membership. If you have no membership, you will not receive a code at all — you will be shown a link to join instead.

Your account and keeping it secure

There are no passwords anywhere on this site. You sign in by entering your email address; we email you a 6-digit code, and you type it back.

That means one thing above all: your email inbox is your account. Anyone who can read your email can sign in as you. Please protect it — use a strong password and two-factor authentication on your email account, and do not forward or share a sign-in code with anyone. We will never ask you for a code by phone, chat or reply email.

For your information, here is how we handle the code and your session:

• the code is stored only as a one-way hash, never in readable form;
• it expires after 10 minutes, can be used once, and stops working after 5 wrong guesses;
• your session is held in a browser cookie that scripts on the page cannot read, and the session token is also stored only as a hash.

Our support team can, in limited circumstances and with safeguards, open your account to help you — how that works and how it is bounded is set out in our Privacy Policy.

Tell us straight away at support@csafi.org if you think someone else has reached your account. You are responsible for what happens under your account, except where someone gained access through our own failure.

Membership, billing and automatic renewal

We sell memberships in several tiers — individual, organisation, cooperative and partner tiers. What each tier includes is described on the membership pages at the time you join.

How the price is worked out

• You choose monthly or yearly billing. Yearly is discounted.
• Some tiers are priced by scope. Organisation tiers are priced per site, using the address and employee-count band of each site you add, and those are added together. Cooperative tiers are priced on a member-count range.
• The price is always shown on screen before you pay, and the final amount is calculated by us, not by your browser.

Payment

Payments are taken by Stripe. Card details go to Stripe and never touch CSAFI's systems — we record only the amount, the currency, the status and Stripe's reference numbers.

Automatic renewal

A membership renews automatically at the end of each billing period, at the price then in force, until you cancel. You can manage your card, view invoices, cancel or resume your membership from the "Your membership" card on your dashboard, which opens Stripe's own billing page.

If a renewal payment fails, Stripe will retry it. Your access continues while it retries. If the payment is never made, your membership ends.

If we change the price of your membership, we will tell you before the change applies to your renewal, and you may cancel rather than accept it.

Cancelling and refunds

You can cancel your membership at any time.

• Cancelling does not stop your membership immediately. It stops the next renewal. Your membership stays active until the end of the period you have already paid for, and then ends. You keep your access for the whole of that period.
• You can resume a cancelled membership before that end date, and it will go back to renewing normally.

On refunds:

• A full refund ends the membership. If we refund a payment in full, the membership it paid for is cancelled and access ends.
• A partial refund does not end the membership. Partial refunds are used for adjustments and goodwill; your membership continues as normal.
• We are not obliged to refund a period you have already used, but we will always look at the circumstances. Write to support@csafi.org.
• Nothing here removes any refund right you have under consumer law that cannot be excluded — see Governing law below.

Donations

You can donate to CSAFI through the site. Donations are also handled by Stripe and are shown to you before you confirm.

• Donations are not refundable as a rule. If you donated by genuine mistake — a duplicate, or the wrong amount — contact us promptly and we will do our best to put it right.
• A donation buys nothing. It does not grant membership, access, influence or any benefit.
• We do not give tax advice. We do not promise that your donation is tax-deductible in your country. The receipt we email you records what you gave; whether you can claim it is between you and your own tax adviser.

Events and paid seats

We list free events and sell paid seats at others.

• Registering for an event requires a CSAFI membership.
• A seat is only yours once payment has completed. If you start a payment and do not finish it, no seat is held for you and nothing is charged.
• Event details — date, time, format, speakers and venue — can change. We will tell registered attendees about material changes as early as we can.
• If we cancel a paid event and cannot offer a suitable alternative, we will refund the seat.
• Anything you receive at an event — recordings, slides, threat briefings — is for you and your organisation. Please do not republish it without asking.

The Thought Leader programme

Applying to become a CSAFI thought leader is an application, not a membership, and not a job.

• Applying grants nothing. It creates no account, no membership and no role. A human at CSAFI reviews every application.
• A decision is made once. If your application is approved we will tell you by email; if it is declined we will also tell you.
• Approval is not publication. Being approved means you may write for us. Each article is reviewed on its own, and we may decline to publish, ask for changes, or take an article down later.
• You keep ownership of what you write. See Content you submit below for the permission you give us to publish it.

Partner companies and the Growth Hub

Partner companies maintain their own public profile, articles, reports, events and marketplace listings through the Growth Hub.

• A partner is responsible for everything it publishes about itself. Descriptions, claims, certifications, prices and contact details come from the partner, not from CSAFI.
• We review marketplace listings before they become public, and a listing that is edited after approval goes back for review. That review is a check that the listing is appropriate for our members — it is not an endorsement, and it is not verification.
• The compliance standards and certifications a partner lists in our directory are the partner's own declarations. CSAFI does not audit or verify them. If a certification matters to your decision, ask the partner for evidence of it.
• A listing on CSAFI is not a recommendation, and we are not a party to any agreement you reach with a partner.

Acceptable use

This is a cybersecurity association, so we take the following seriously and enforce it.

You must not:

1. try to gain unauthorised access to any part of the site, another person's account, or any system connected to it;
2. probe, scan or test the security of the site without our prior written permission — if you believe you have found a vulnerability, please report it to support@csafi.org and give us a fair chance to fix it;
3. scrape, harvest or bulk-download content, or use automated means to collect information about our members;
4. interfere with the site's operation, including flooding our forms or sign-in step;
5. misuse the cyber incident reporting form — do not submit false reports, someone else's confidential information, malware, or material you are not permitted to share;
6. impersonate anyone, or misrepresent who you are or who you work for;
7. upload or link to unlawful, defamatory, infringing, misleading or malicious material;
8. use the site to send unsolicited marketing, or to advertise anything not agreed with us; or
9. use anything you get here to build a competing directory or database.

We may remove content, suspend access, or end an account for a breach of this section, and we will report unlawful activity to the authorities.

Content you submit

You keep ownership of everything you send or publish through the site — your profile, articles, reports, listings, testimonials, event details and incident reports.

By submitting it, you give CSAFI a non-exclusive, worldwide, royalty-free licence to store, reproduce, adapt for formatting, publish, translate and display it for the purpose of running the site and promoting CSAFI's work, including in newsletters and on social media. That licence lasts while the content is published and for a reasonable period afterwards in archives and back-ups.

You confirm that you are entitled to submit it, that it does not infringe anyone else's rights, and that it does not break any confidentiality obligation you are under — this matters especially for incident reports.

We may edit for length, clarity, formatting or accuracy, and we may decline to publish or later remove anything.

Our intellectual property

The site itself — its text, design, graphics, logos, structure and code — belongs to CSAFI or our licensors and is protected by copyright and trade mark law. The CSAFI name and logo are ours; please do not use them to suggest a relationship, endorsement or membership you do not have.

You may read, print and share our public pages for your own or your organisation's internal use. You may not republish substantial parts of the site, sell access to it, or present our material as your own.

Third-party links and services

The site links to and relies on services we do not control — Stripe for payments, Postmark for email, Google for translation and address suggestions, and any website a partner, job listing or article points to. We are not responsible for those services or sites, and their own terms and privacy policies apply when you use them.

Disclaimers — please read this section

CSAFI publishes threat information, security guidance, articles, reports and resources for general awareness and education across the food industry.

It is not professional security advice, and it is not tailored to you. Every organisation's systems, risks and legal obligations are different. Nothing here creates a consultant–client relationship, and you should take your own qualified advice before acting on anything you read.

Reporting an incident to CSAFI is not reporting it to anyone else. We are an industry association, not a law-enforcement body, a regulator or an emergency service. Telling us about an incident does not satisfy any obligation you have to notify the police, a regulator, a data protection authority, your insurer, your customers, or anyone else, and does not start any official process. If you are dealing with a live incident, contact the appropriate authorities in your country first. We cannot promise to act on a report, to act within any particular time, or to act at all.

Beyond that, and to the extent the law allows, the site and everything on it is provided "as is" and "as available". We do not warrant that it will be uninterrupted or error-free, that information on it is complete, current or accurate, or that it is fit for any particular purpose.

Limitation of liability

Nothing in these terms limits liability that cannot be limited by law — including for death or personal injury caused by negligence, for fraud, and for any right you have under consumer law that cannot be excluded.

Subject to that, and to the fullest extent the law allows:

• we are not liable for indirect, incidental, special or consequential loss, or for loss of profit, revenue, business, goodwill, data or anticipated savings, however it arises;
• we are not liable for any loss arising from a security incident you suffer, including one you told us about or one you might have prevented by acting on our material; and
• our total liability to you for all claims in any 12-month period is limited to the total amount you paid CSAFI in that period, or USD 100 if you paid us nothing.

Indemnity

You agree to indemnify CSAFI against claims, losses and reasonable costs arising from your breach of these terms, from content you submit, or from your unlawful or unauthorised use of the site.

Suspending or ending accounts

You may stop using the site at any time, cancel your membership from your dashboard, and ask us to delete your account.

We may suspend or end an account, or remove content, if these terms are breached, if we are required to by law, or if we reasonably believe it is necessary to protect our members or the site. Where it is reasonable to do so, we will tell you why and give you a chance to put it right. If we end a paid membership other than for a breach, we will refund the unused part of it.

Sections that by their nature should survive — content licences, intellectual property, disclaimers, limitation of liability, indemnity and governing law — continue after an account ends.

Changes to these terms

We may update these terms. The current version is always on this page, with its effective date under the title. If a change materially affects your rights, we will tell members by email before it takes effect where we reasonably can. Continuing to use the site after a change means you accept it; if you do not, please stop using the site and cancel any membership.

Governing law

These terms are governed by the laws of the State of Washington, USA, and the courts of Washington State have jurisdiction, without regard to conflict-of-laws rules.

If you are a consumer, this does not take away your local rights. In particular, if you are in Australia, nothing in these terms excludes, restricts or modifies any guarantee, right or remedy you have under the Australian Consumer Law, and where that law applies our liability is limited to what it permits. Consumers in the UK, the EU and elsewhere keep the protections of their own local law in the same way.

How to reach us

Questions about these terms: contact@csafi.org or support@csafi.org, the form at csafi.org/contact, or by post to either of the addresses at the top of this document.

This policy explains what CSAFI stores in your browser when you use csafi.org. It is short because the honest answer is short: this site sets almost nothing. For the wider picture of what we collect and why, see our Privacy Policy.

What cookies and similar technologies are

A cookie is a small piece of text a website asks your browser to keep, and which your browser hands back to that site on later visits. "Local storage" is similar but simpler: it is a small notepad your browser keeps for a site, and it is never sent anywhere — it only ever stays on your own device. Websites use both for three broad reasons: to remember that you are signed in, to remember a preference you chose, and to avoid redoing work that has already been done. We use them for exactly those three things and for nothing else.

Exactly what this site uses

That is the complete list. If you read this site without signing in, without changing the theme and without switching language, nothing at all is stored.

There are no passwords on this site, so the session cookie is the only thing that keeps you signed in. Signing in means typing back a 6-digit code we email you; the code and the session token are both stored on our side only as one-way hashes.

What we do not use

• No advertising cookies. We do not sell advertising and we run none.
• No third-party analytics or tracking cookies. There is no Google Analytics, no advertising pixel, no social media tracker, no session recorder.
• We do not track you across other websites, and we do not build a profile of you, sell your data, or share it with advertisers.

Because nothing we set is for advertising or analytics, there is no cookie consent banner on this site — there is nothing to consent to. Strictly necessary items like the sign-in cookie do not require consent, and the two local-storage items exist only because you asked for a theme or a language.

What our third-party services may set

Stripe handles all payments — memberships, donations and paid event seats. When you pay, you are sent to a payment page hosted on Stripe's own website, not ours, and the same is true of the billing portal where you manage your card and invoices. On those pages Stripe sets its own cookies, under its own policies, to keep the payment working and to detect fraud. We do not control them and we receive no tracking information back — only the amount, the currency, the status and Stripe's reference ids. No card number ever touches CSAFI.

Our other services do not put anything in your browser. Google Cloud Translation (used only when you switch away from English) and Google Places (address suggestions) are called from our server, not from your browser, so they set no cookies on you. Postmark sends our email, and Neon and Vercel store and host the site — none of them set cookies here.

How to control or clear this

Every browser lets you view, block and delete both cookies and local storage, usually under Settings → Privacy. In Chrome and Edge look for "Cookies and other site data"; in Safari, Preferences → Privacy → Manage Website Data; in Firefox, Settings → Privacy & Security → Cookies and Site Data. You can also clear just this site's data from the padlock icon in the address bar.

The consequences are small and worth knowing:

• Clearing or blocking the csafi_session cookie signs you out. You can sign in again at any time — we will email you a fresh code.
• Clearing local storage loses your theme choice (the site returns to light) and empties the translation cache, so the site translates itself again the next time you switch language.

Nothing else on the site depends on browser storage. You can read every public page with cookies blocked entirely.

How we tell you about changes

If we start using anything not listed above, we will update this page and change the effective date shown under its title before the change takes effect. If a change is significant — for example if we ever added an analytics tool — we will say so plainly here and, where it affects members, by email.

Questions about this policy? Email contact@csafi.org or use the form at csafi.org/contact. You can also write to us at 26828 Maple Valley Hwy, #273, Maple Valley, WA 98038, USA, or U30, 24 Dunmore Tce, Auchenflower, Brisbane 4066 QLD, Australia.