Privacy Policy

1. Who this policy covers

This policy applies to the Audi Outcasts website and to the club systems that run behind it: the membership application form, the club's member records, the member sign-in used for member-only pages, the members' car directory, club events and the emails the site sends.

Audi Outcasts is the party responsible for member information held in these systems. The club is run by its committee, and member records are administered by the club's authorised administrators.

2. Information we collect

Almost everything the club holds about you is information you gave the club yourself, either on the membership application form or by giving an administrator your details. Depending on how you use the site, the club may hold:

• Your name and surname, and your nickname if you use one.
• Your cellphone number. This is also what you sign in with, so it is required for member-only pages.
• Your email address, used for club and event email.
• Your date of birth, used for the club's birthday list.
• Your area — the town or city and province you are based in.
• Your Audi — model, model year and, where an administrator has recorded it, the registration number.
• A photograph of your car, supplied with your application or by an administrator.
• Membership information — your membership number, the date you joined, whether your membership is active, the version of the club rules you accepted and when you accepted them, and administrative notes kept by administrators.
• Application information — everything on your original application, including the invite code used and any business or free-text notes you supplied, kept while the application is reviewed and afterwards as the club's record of it.
• Event registrations — which club events you signed up for, the name, membership number, email address and cellphone number recorded on that registration, and whether the confirmation email was delivered.
• Sign-in and session information — see clause 4.

The club does not ask for identity numbers, banking details or payment card details through this website, and does not run advertising or third-party tracking on it.

3. How we use it

Member information is used for running the club and this website, specifically to:

• Review membership applications and tell you the outcome.
• Keep the club's membership records, membership numbers and active/inactive status.
• Let you sign in to member-only pages and keep you signed in for a short period.
• Show the members' car directory to signed-in active members (clause 5).
• Run club events: publishing event details to members, recording registrations and emailing confirmations that include the event's payment reference and banking details.
• Send club administration email — application notifications to administrators, event confirmations to you, one-time sign-in codes, and the club's internal birthday reminder to administrators.
• Keep a copy of car photographs in the club's own Google Drive archive as a long-term club record (clause 7).
• Keep the site secure: rate-limiting sign-in attempts, blocking abuse and diagnosing faults.

Audi Outcasts does not sell member information, does not rent or share member lists, and does not use member information for third-party advertising or profiling.

4. Signing in, sessions and browser storage

Member-only pages are opened with a one-time code (an OTP) rather than a password. You enter the cellphone number the club has on record, the site sends a short numeric code to it, and entering that code correctly starts a member session. Where the club's messaging service is configured, the code is sent and checked by that service; where it is not, the site generates the code itself and emails it to the address on your member record. Codes expire after a few minutes, tolerate only a small number of wrong guesses, and can only be used once.

The session itself is a random token kept in a cookie that page scripts cannot read and that your browser will only send to this site. Only a one-way hash of the token is stored in the club's database, so the stored row cannot be used to impersonate you. Sessions are short-lived and expire on their own, signing in again on a new device ends the earlier session, and every single request re-checks both that the session is still valid and that your membership is still active.

To protect the sign-in from abuse, the club records each code request and each code check: the cellphone number involved, what was attempted, whether it succeeded, and a one-way hash of the network address it came from. The address itself is not stored, and these records are automatically deleted after 24 hours.

The only other browser storage this site uses is a note of whether you chose light or dark mode, which stays on your own device. There are no analytics, advertising or cross-site tracking cookies.

5. The members' car directory

The members' car directory ("Members' Cars") is a member-only page. It is not public: it cannot be viewed without signing in, the data behind it is only released to a request that carries a valid session belonging to an active member, and the car photographs are served through the same check rather than as public files.

For each active member, the directory shows only the member's name, their nickname if they have one, their Audi model and model year, and their car photograph. Nothing else is sent to another member's browser: not your email address, cellphone number, date of birth, area, registration number, membership number, administrative notes or any internal record identifier. The search box searches the Audi model and year only, so a member's personal details cannot be looked up through it.

The directory is read-only for members — it has no way for one member to change another member's information, or their own. Corrections are made by administrators.

If you would rather your car photograph or your name did not appear in the member-only directory, contact the club and an administrator will remove it.

6. Service providers

The club uses a small number of established service providers to run the website. They process club information on the club's instructions and for no other purpose:

• Netlify — hosts the website, runs its server-side functions, and provides the club's database and the private file storage the car photographs are kept in. Netlify also provides the sign-in used by club administrators for the admin pages. Netlify necessarily processes ordinary technical request information, such as network addresses, in the course of serving the site.
• Google — Google Drive and the Google Drive API hold the club's archive copy of member car photographs, authorised by a club administrator through Google OAuth. See clause 7.
• Resend — delivers the email the site sends: application notifications, event confirmations, the internal birthday reminder and, where used, one-time sign-in codes. Resend receives the recipient address and the contents of that email.
• Twilio — where the club has configured it, Twilio Verify sends and checks one-time sign-in codes over WhatsApp or SMS. Twilio receives the cellphone number the code is being sent to. The site never handles the code itself in that case.

Beyond these providers, member information is shared only with the club's own authorised administrators, or where the club is required to share it by law.

8. How we protect information

The site is served only over HTTPS. Member-only and administrator-only information is never published as a static file: every request for it goes through a server-side check first, and member car photographs are streamed through that check rather than linked from public storage. Member-only pages ask search engines not to index them.

Behind that, the club applies the ordinary precautions: administrator pages require an administrator sign-in, the member-facing parts of the site read only the specific fields they need rather than whole member records, session tokens and one-time codes are stored as one-way hashes, the Google refresh token is stored encrypted, and service credentials are held in server configuration that browsers cannot reach.

No website can promise perfect security. If a security compromise affects member information, the club will act to contain it and will notify affected members and the Information Regulator where the law requires it.

9. How long we keep it

Member records, including car photographs and the Google Drive archive copy, are kept for as long as you are a member and afterwards as part of the club's membership history, unless you ask for them to be deleted and the club has no reason to keep them. Membership applications are kept as the record of the club's decision. Event registrations are kept as the record of who attended a club event.

Two kinds of record are deleted automatically: sign-in attempt records after 24 hours, and member sessions and one-time codes shortly after they expire. If your membership is made inactive, your access to member-only pages ends on your next request and your car no longer appears in the members' car directory.

10. Your rights

Under the Protection of Personal Information Act, 2013 (POPIA), you may ask the club what personal information it holds about you, ask for a correction, ask for information to be deleted or for your car to be removed from the members' car directory, object to a particular use of your information, and withdraw consent where the club relied on it.

Contact the club at the address in clause 12 and an administrator will deal with the request. The club may need to keep a limited record of a past membership or event for its own legitimate administrative purposes, and will say so if that applies. You also have the right to complain to the Information Regulator of South Africa.

11. Children and changes to this policy

Audi Outcasts membership is intended for adults, and the website is not directed at children. A parent or guardian who believes a child's information has been given to the club should contact the club so it can be removed.

This policy will be updated when the website, the club's systems or its service providers change. The current version is always the one on this page, with the date at the top. If a change materially affects how the club handles information received from Google APIs, this policy will be updated before that change takes effect.