Privacy
Policy
The short version: we collect what we need to run the society and nothing else. We do not sell your information, we do not run advertising, and there are no tracking or analytics cookies on this site. Everything below is a fuller account of that.
1. Who is responsible for your information
The Bloomfield Hall Science Society, a student-led society of Bloomfield Hall School, decides what information this site collects and what happens to it. Access to it is limited to the Society's office holders.
To ask anything about your information, or to ask us to change or delete it, use the contact page.
2. What we collect, and why
If you apply for membership
The application form asks for your name, email address, school, year group and level of study, whether you are a Bloomfield Hall student, the STEM subjects and activities you are interested in, and a short note on why you want to join. We use this to decide on your application and to contact you about it.
If you apply to the Ambassador Programme
The ambassador application form asks for your name, email address, phone number, school or college, grade or class, city and country, why you want to become an ambassador, and - if you choose to answer them - your experience, your skills, whether you have been to one of our events, and how you heard about us. It also records that you accepted the Code of Conduct and that you have a parent or guardian's permission to apply. We use all of it to decide on your application and to contact you about it. The form deliberately does not ask for any social media accounts.
While an application is being reviewed, Society office holders may attach private notes to it. These are never shown to you and never sent anywhere; ask us and we will tell you what is on your record.
If you become an ambassador
We keep an ambassador profile alongside your account: the details from your application, the cohort you served in, any short biography you write, and any certificates the Society issues you. If you submit a piece of writing for the site, we keep that submission and our decision on it.
If the Society sets tasks, we keep what you send in for each one - your note, any link you attach, and our decision.
We also keep your points: every award the Society makes, what it was for, and when. Your name, school, cohort and points total appear on a leaderboard visible to the other ambassadors - not to the public - unless the Society turns that leaderboard off.
Your profile is not published on this website unless you turn that on yourself from your ambassador dashboard, and you can turn it off again at any time.
If your application is accepted and you set up an account
We store your name, your email address and a hashed version of your password. We never store the password itself and cannot recover it - if you forget it, you set a new one.
If you play Stemdle
We record your results: games played, wins, points, and current and longest streak. These appear on the members' leaderboard next to your name.
If you use the contact form
Your name, email address, subject and message are sent to the Society's email inbox so we can reply. Contact messages are not saved to the website's database - they exist only as email.
If you appear in event photographs
We publish photographs and short captions from Society events. See section 8.
Whenever anyone visits
Our hosting provider keeps ordinary server logs - IP address, time, page requested, browser - which exist to keep the site running and secure. We do not use them to build a profile of you.
3. Students under 18
Most of our members are school students under 18. We ask for a parent or guardian's permission before a student under 18 applies or sets up an account, and a parent or guardian can write to us at any time to withdraw it. When they do, we delete the account and the application.
4. Cookies
This site sets three cookies. All three exist to make the site work; none of them tracks you, and none is shared with anyone.
| Cookie | What it does | How long it lasts |
|---|---|---|
bhss_member_token |
Keeps you signed in to your member account. | 7 days, or until you sign out |
bhss_admin_token |
Keeps a Society office holder signed in to the admin area. | 24 hours, or until sign out |
bhss_dev |
Lets someone holding a preview link we sent them see the site before it is public. | 30 days |
The two sign-in cookies are HttpOnly - scripts cannot read them - and are restricted to this site. There are no analytics, advertising or third-party tracking cookies here.
5. Who else can see your information
We do not sell your information, and we do not share it for marketing. It reaches other companies only where the site needs them to function:
- MongoDB Atlas stores the site's database, including applications and accounts.
- Google carries the email we send and receive, through Gmail. That includes contact form messages and acceptance emails.
- Our hosting provider runs the site and keeps the server logs described above.
- Google Fonts serves two typefaces used across the site. Loading them means your browser contacts Google's servers, which sees your IP address. It sets no cookie.
These providers store data on servers outside Pakistan. We may also disclose information if the law requires it, or to protect someone's safety.
Our Instagram account is a link, not an embed - visiting this site does not tell Instagram anything about you.
6. How long we keep it
- Applications - kept while the Society is running, so we have a record of who applied and when. Ask us and we will delete yours. This covers membership and ambassador applications alike.
- Ambassador profiles - kept after a term ends, as a record of who represented the Society and when, including for anyone whose role was ended early. Ask us and we will delete yours, along with your certificates, submissions and points; ask us to delete your account and that goes too.
- Member accounts and Stemdle results - kept until the account is closed, then deleted.
- Account setup and password reset links - these expire on their own; a password reset link lasts one hour.
- Contact messages - kept in the Society's email inbox for as long as the correspondence is useful.
7. How we protect it
- The site is served over HTTPS, so traffic between you and us is encrypted.
- Passwords are stored as salted PBKDF2-SHA256 hashes with 310,000 iterations - they are not readable, by us or by anyone who obtained the database.
- Sign-in cookies are HttpOnly, marked Secure, and restricted to this site.
- Sign-in attempts to the admin area are rate limited.
- Only the Society's office holders have access to the admin area.
No system is perfectly secure, and we will not pretend otherwise. If something goes wrong with your information, we will tell the people affected.
8. Photographs of people at our events
We publish photographs from Society events, including our outreach work with children, to record what we did and to show prospective partners and funders. We seek permission from participants - and, for children, from their parents, guardians or the organisation caring for them - before publishing pictures of them.
If you appear in a photograph here, or you are the parent or guardian of a child who does, you can ask us to take it down through the contact page. We will remove it, and we will not ask you to justify the request.
9. Your choices
You can ask us to:
- tell you what information we hold about you;
- correct anything that is wrong;
- delete your application, your account, or a photograph of you;
- close your account, which you can also do by asking us directly.
Write to us through the contact page. We will not charge you for this and will do it as quickly as we reasonably can.
10. Changes to this policy
We may update this policy. The date at the top shows when it last changed. If a change materially affects how we handle your information, we will say so on the site.
11. Getting in touch
Any question about this policy, or about your information, can go through the contact page.