Privacy Policy

Scope and who is responsible

D4RKNet is operated from New Zealand by Paul Hayden, a sole trader trading as D4RKNet. In this policy, "D4RKNet", "we", "us", and "our" refer to that operator.

This policy applies to d4rk.net, Mythborne, JobTracker, and any other D4RKNet website, application, or service that links to it, together called the "Services". Product notes near the end of this policy add detail for particular Services.

Independent websites, stores, and services linked from a D4RKNet Service have their own privacy practices.

Information collected

The information collected depends on the Service and features you use. It may include:

• Account information: email address, username or display name, password hash, verification status, roles, permissions, preferences, and account status.
• Authentication and device information: device and session identifiers, protected token fingerprints, browser or application version, operating system, IP address, login activity, and security events.
• Content and service information: information you enter, upload, generate, share, or receive through a Service.
• Purchase and entitlement information: product, price, currency, provider and transaction references, purchase status, receipts, credits, refunds, reversals, disputes, and chargebacks.
• Communications: support requests, feedback, reports, notification choices, marketing consent, and unsubscribe records.
• Operational information: request times, requested pages or endpoints, diagnostic events, errors, performance data, and records used to prevent abuse or investigate incidents.

Please do not include unnecessary sensitive information in free-text fields, support messages, roleplaying content, workplace records, or uploads.

Where information comes from

Information may be collected:

• directly from you when you register, configure a Service, create content, purchase an entitlement, or contact D4RKNet;
• automatically when your browser, application, or device communicates with a Service;
• from another authorised user, such as a campaign member or an organisation administrator;
• from payment, authentication, notification, moderation, address-search, and infrastructure providers when needed to complete or secure a requested operation; and
• where permitted by law, from a person reporting misuse, a security concern, or a legal claim.

When personal information is collected from someone other than the person it concerns, D4RKNet will take reasonable steps to notify that person when New Zealand Information Privacy Principle 3A requires it, unless an exception applies or the person has already been made aware.

How information is used

D4RKNet uses personal information where reasonably necessary to:

• create and administer accounts, organisations, memberships, campaigns, purchases, and requested features;
• authenticate users, maintain sessions, enforce permissions, and protect users and systems;
• provide AI-assisted features, process uploads, deliver notifications, and fulfil purchases;
• provide support, respond to privacy requests, investigate reports, and communicate material Service changes;
• diagnose faults, maintain backups, improve reliability, and understand aggregate Service operation;
• prevent fraud, enforce the Terms of Service, comply with law, and establish or defend legal claims; and
• send product news or promotional communications where D4RKNet has the consent or other lawful authority required.

Sharing and service providers

Information may be disclosed or made available:

• to people you collaborate with, according to campaign, organisation, and sharing controls;
• to the public, when you or another authorised user deliberately enables a public or link-accessed feature;
• to service providers, including Google Play and Google or Firebase, Stripe, OpenAI, Cloudflare, email-delivery, hosting, and professional service providers, only for the relevant service;
• for safety or legal reasons, where reasonably necessary to investigate misuse, protect people or systems, comply with lawful process, or establish or defend legal rights; and
• during a genuine business transition, subject to appropriate confidentiality and privacy protections.

D4RKNet does not sell personal information.

Key providers publish their own information at Google Privacy, Stripe Privacy, OpenAI Privacy, and Cloudflare Privacy.

Storage and processing outside New Zealand

D4RKNet's production application servers are currently located in New Zealand. Some providers and their subprocessors operate in other countries, so information may also be stored in, accessed from, or processed outside New Zealand.

Where Information Privacy Principle 12 applies to an overseas disclosure, D4RKNet will rely on an applicable statutory basis, comparable legal safeguards, appropriate contractual protection, or informed authorisation.

Cookies, local storage, and analytics

D4RKNet websites and browser applications use necessary cookies or browser storage for features such as secure sessions, anti-forgery protection, theme selection, and preferences. Native applications may store preferences, cached artwork, and protected session credentials on the device.

The public D4RKNet website does not currently use visitor analytics or third-party advertising trackers. A product application may collect operational diagnostics needed to secure and maintain the Service. External payment pages and linked services may use storage under their own policies.

Security and retention

D4RKNet uses reasonable technical and organisational safeguards appropriate to the Services. These may include encrypted network transport, password hashing, permission boundaries, protected session credentials, rate limiting, input validation, security logging, backups, and separation of provider secrets.

No internet service can promise absolute security. Protect your password and devices, and contact support@d4rk.net promptly if you suspect unauthorised access. D4RKNet will notify affected people and the New Zealand Privacy Commissioner when a privacy breach has caused, or is likely to cause, serious harm and notification is required by law.

Personal information is retained only for as long as reasonably required for a lawful purpose. Active account and Service information is generally kept while the relevant relationship remains active. Purchase, refund, audit, security, and legal records may be kept after account deletion when needed for accounting, fraud prevention, integrity, or legal claims. Protected backups expire through their normal rotation.

Service messages and marketing

Verification, security, purchase, invitation, maintenance, and similar operational messages are sent as part of providing a requested Service. Optional notification controls may not disable essential security or transaction messages.

Product news or promotional messages will be sent only where D4RKNet has the consent or other lawful authority required. Commercial messages will identify the sender and provide a clear, functional way to unsubscribe. D4RKNet may keep a suppression record so an unsubscribe choice continues to be respected.

Your choices and privacy rights

You may ask D4RKNet to confirm whether it holds personal information about you and request access to it. You may also ask for incorrect, incomplete, out-of-date, or misleading information to be corrected. If a requested correction is not made, you may ask for a statement of correction to be attached where applicable.

You may request deletion or object to particular processing. Whether information can be deleted depends on the Service, applicable law, another person's rights, security requirements, and whether the information is still reasonably required for a lawful purpose. Mythborne also provides a self-service deletion control described on the account deletion page.

Email support@d4rk.net with the Service name and the email address or username associated with your account. Do not send your password, payment card number, or authentication code. D4RKNet may need to verify your identity before acting.

If an organisation controls JobTracker information about you, contact that organisation first. You may also contact D4RKNet, which will route or assist with the request where appropriate.

Children and young people

D4RKNet consumer Services are intended for people aged 13 and over. A person under 18 must involve a parent or legal guardian where they cannot legally agree to the applicable terms or purchases on their own.

D4RKNet does not knowingly seek personal information directly from a child under 13. If you believe a child under 13 has provided information without appropriate authorisation, contact D4RKNet so the situation can be investigated and the information deleted or restricted where appropriate.

Product-specific notes

Questions, complaints, and changes

For a question, request, or complaint, email support@d4rk.net with "Privacy" in the subject. Include enough detail to understand the issue, but do not send passwords or complete payment credentials.

If a New Zealand privacy complaint is not resolved, you may contact the Office of the New Zealand Privacy Commissioner.

This policy may be updated as the Services, providers, or law change. The current version will remain at this address. Reasonable additional notice will be given before a material change takes effect where required.