Privacy policy

1. About this policy

bubsname.com ("bubsname", "we", "us") is a free, ad-free, account-free information service that republishes publicly-licensed Australian baby name statistics. It is operated as a personal project by an individual based outside Australia, primarily for an Australian audience.

Although our operator qualifies as a "small business operator" under section 6D of the Privacy Act 1988 (Cth) and is therefore not strictly bound by the Australian Privacy Principles (APPs), we voluntarily comply with the APPs as a matter of good practice and to give our visitors enforceable expectations. This policy is structured around APP 1.4.

This policy applies to personal information collected through bubsname.com. It does not apply to third-party sites we link to (Wikipedia, state BDM registries, AIATSIS, etc.) — those sites publish their own policies.

2. Information we collect (APP 3, APP 5)

2.1 Information you provide directly

• Contact form — your name, email address and the content of your message. Used only to reply to your enquiry. Retained in our email inbox for as long as the conversation is relevant (typically up to 12 months), then deleted on request or in periodic cleanup.
• Shortlist and couple's matcher tools — when you click "share", we store the list of names you selected (no personal identifiers) in our ephemeral cache, tied to a random token. The token expires after 30 days, after which the data is permanently deleted.
• Likes and votes on names (heart / up-vote / down-vote / A-B preferences) — stored as anonymous aggregate counts. We do not record who voted; only that a vote happened. A small identifier in your browser's localStorage prevents duplicate voting from the same device.

2.2 Information collected automatically

• Server access logs — IP address, user-agent string, requested URL, HTTP status, timestamp and approximate response size. Used solely for security (detecting abuse, rate-limit enforcement) and capacity planning. Rotated after ~30 days.
• Google Analytics 4 data — see §4 below for the full disclosure, including the ID, cookies set, IP anonymisation and opt-out methods.
• Cloudflare edge logs — Cloudflare processes your request as part of delivering the site through its global CDN. See §5 for the third-party disclosure.

2.3 Information stored on your device (never sent to us)

• Your saved shortlist of names
• Theme preference (light / dark / auto)
• A small per-device identifier that prevents duplicate likes / votes

These items live in localStorage on your browser. Clearing your browser data removes them immediately. They are never transmitted to our servers.

2.4 What we do not collect

• No account credentials — there are no accounts.
• No behavioural advertising profiles or third-party ad-tech pixels.
• No demographic, financial, biometric or health information.
• No sensitive information as defined in section 6 of the Privacy Act.

3. How we use and disclose your information (APP 6)

We use the information described in §2 only for the purpose it was collected:

• To operate, maintain and improve bubsname.com.
• To respond to enquiries you send via the contact form.
• To enable the shortlist sharing and couple's matcher features at your request.
• To detect, prevent and respond to abuse, fraud or technical incidents.
• To comply with Australian law, lawful requests from Australian authorities, or equivalent obligations in the jurisdiction where our servers are located.

We do not sell, rent or trade personal information. We do not use your information for direct marketing. We do not maintain a mailing list and do not send commercial electronic messages (Spam Act 2003 (Cth) is not engaged).

4. Cookies, analytics & tracking

4.1 Cookies set by bubsname

bubsname itself sets no cookies. The shortlist and theme preference live in localStorage, which is a separate browser storage mechanism that is not transmitted with HTTP requests.

4.2 Google Analytics 4

We use Google Analytics 4 (measurement ID G-3BZBSRB6CD) with anonymize_ip enabled, so the last octet of your IPv4 address (or last 80 bits of your IPv6 address) is truncated before it reaches Google's servers. GA4 helps us understand which content is useful so we can focus effort on it.

GA4 sets the following cookies on your browser:

• _ga — distinguishes individual visitors (2-year expiry)
• _ga_3BZBSRB6CD — session state (2-year expiry)

Data is transferred to Google LLC in the United States; see §5 for the cross-border disclosure. We do not enable Google Signals, advertising features or remarketing.

4.3 How to opt out

You can opt out of Google Analytics in three ways:

• Install the Google Analytics Opt-out Browser Add-on (Chrome, Firefox, Safari, Edge).
• Block third-party cookies, or block the googletagmanager.com domain, using your browser's privacy settings, "Do Not Track" mode or an extension such as uBlock Origin.
• Use a privacy-focused browser (Brave, Firefox with Enhanced Tracking Protection set to Strict, Safari with Intelligent Tracking Prevention) — these block GA4 by default.

4.4 Cloudflare Turnstile (contact form only)

If you submit the contact form, we use Cloudflare Turnstile — a privacy-preserving CAPTCHA alternative that does not use cookies and does not fingerprint your browser. It only runs on the contact form page.

5. Third parties & overseas disclosure (APP 8)

bubsname relies on the following third-party service providers to deliver the site. Where these providers are located outside Australia, the disclosure of your personal information overseas is unavoidable in the ordinary course of operating the service:

We take reasonable steps to ensure these recipients handle your information consistent with the APPs. Each maintains its own published privacy policy that you can review: Cloudflare, Google, OVH.

6. Storage, security & retention (APP 11)

We take reasonable steps to protect the personal information we hold from misuse, interference, loss, unauthorised access, modification or disclosure:

• Encryption in transit — TLS 1.2+ everywhere; HSTS with a 1-year max-age on the bubsname.com domain.
• Encryption at rest — database storage uses full-disk encryption on the host volume.
• Access control — administrative access is limited to the operator and uses key-based authentication.
• Token entropy — share links use cryptographically random tokens long enough to make guessing infeasible.
• Defence in depth — CDN-level firewall, bot mitigation, rate limiting, and a privacy-friendly CAPTCHA on the contact form.
• Data minimisation — we do not store anything we do not use, and retention windows are short (see below).

Retention windows:

• Server access logs: ~30 days, then rotated.
• Ephemeral cache (shortlist / couple share tokens): 30 days, then permanently deleted.
• GA4 user-level data: 14 months (Google's minimum), then aggregated only.
• Contact-form correspondence: up to 12 months in our email inbox, or until the conversation is no longer relevant.

7. Your rights (APPs 12 & 13)

You have the right to:

• Access — request a copy of any personal information we hold about you;
• Correction — request that we correct information you believe is inaccurate, out-of-date, incomplete, irrelevant or misleading;
• Deletion / erasure — request that we delete information we hold (where we are not required to retain it by law);
• Anonymity or pseudonymity — you may use bubsname without identifying yourself (no account required), as is the default.

Email [email protected] with your request. We will acknowledge within 7 days and respond substantively within 30 days, in line with OAIC guidance. We do not charge a fee for these requests.

8. Children

bubsname is aimed at expectant parents and adults researching baby names. It is not directed at children under 15, and we do not knowingly collect personal information from children. If you believe a child has provided personal information to us, please contact us and we will delete it promptly.

We monitor the OAIC's forthcoming Children's Online Privacy Code (expected late 2026 under the Privacy and Other Legislation Amendment Act 2024) and will update this policy and our practices as required.

9. Data breaches (Notifiable Data Breach scheme)

We monitor for security incidents and would respond to a notifiable data breach in accordance with Part IIIC of the Privacy Act. If a breach is likely to result in serious harm to affected individuals, we will:

• Assess the incident as soon as practicable (within 30 days);
• Notify the Office of the Australian Information Commissioner (OAIC); and
• Notify affected individuals directly via the email address they provided to us, and via a prominent notice on bubsname.com.

The Privacy and Other Legislation Amendment Act 2024 introduced a statutory tort for serious invasions of privacy (commenced 10 June 2025) — affected individuals may also have a direct civil cause of action in addition to the OAIC complaints process below.

10. Complaints

If you believe we have mishandled your personal information or breached the APPs, please contact us first at [email protected] — we will investigate and respond within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner:

• Web: oaic.gov.au/privacy/privacy-complaints
• Phone: 1300 363 992 (within Australia)
• Post: GPO Box 5288, Sydney NSW 2001

11. Changes to this policy

We review this policy at least once a year. Material changes will bump the version number and "Last updated" date at the top of the page. For substantive changes (e.g. adding a new third-party processor or analytics provider), we will display a banner on the site for at least 30 days. Continued use after a change constitutes acceptance.

Historical versions are available on request.

12. Contact

For privacy-related enquiries, requests under §7, or complaints:

• Email: [email protected]
• Web: bubsname.com/contact

For escalation, see §10 above.