Privacy notice, what Boomerang collects and how it is handled

Scope of this privacy notice

This page describes how Boomerang handles reader information on this publication. It does not describe how any third-party platform handles reader information; each platform publishes its own privacy page and that page is the authoritative source for any account-related question.

Boomerang is an editorial publication. The site does not run login forms, deposit flows, wallet screens or any other collection of account-related data. The site does not collect a phone number, an email or a payment instrument from its readers.

What Boomerang collects

Boomerang collects the minimum data needed to deliver the publication. That includes server log data (IP address, user agent, request path), aggregated traffic data for editorial decisions, and any reader-submitted material the reader sends to the editorial mailbox. The site does not collect or store a phone number, an email address or a payment instrument of any kind.

Reader-submitted material to the editorial mailbox is retained for as long as the editorial cycle requires, then deleted. The retention window is six months for unsubmitted messages and indefinitely for material the reader has explicitly asked to be retained (such as a published correction with the reader's name attached).

Cookies and local storage

Boomerang does not set advertising cookies and does not embed third-party tracking. The site uses one cookie (a session identifier for the editorial mailbox) and one piece of local storage (the mobile-drawer open/closed state). Both are cleared when the reader closes the browser.

Server logs are retained for 30 days and are then deleted. Logs are not shared with any third party and are not used for advertising. They are used only for editorial decisions about what to fix, what to keep and what to retire.

Third-party services

The publication uses two third-party services. Google Fonts is loaded from fonts.googleapis.com to deliver the DM Sans and Noto Sans Devanagari typefaces. Cloudflare fronts the publication's DNS and caching. Neither service receives any reader data beyond the request itself; neither service is used for advertising on Boomerang.

Reader rights

A reader who has submitted material to the editorial mailbox and wants it deleted can write to the mailbox with the deletion request. The desk will confirm deletion within seven working days and reply to the same address. A reader who wants a copy of any retained submission can write with the request and the desk will provide a copy in plain text within seven working days.

Changes to this notice

Material changes to this notice are dated and listed in the change log. A reader who wants to be notified of changes can subscribe to the RSS feed at /sitemap/rss.xml.

What Boomerang does not collect

Boomerang does not collect biometric data, geolocation data, device fingerprints, advertising identifiers, or cross-site tracking identifiers. Boomerang does not run a third-party analytics tag that fingerprints the reader's device, and Boomerang does not embed any third-party widget that requires the reader to log in to a third-party account to view the publication's content. The publication's pages load with the request itself and nothing else.

Boomerang does not collect the reader's IP address beyond what the server logs automatically for the purpose of serving the page, and the server logs are rotated on a cadence disclosed in the change log. Boomerang does not sell reader data, share reader data with advertisers, or use reader data to build a profile that is shared with any third party.

What happens to contact-form submissions

When a reader uses the contact form, the submission (the reader's email address, the subject line, and the body of the message) is delivered to the editorial mailbox and stored there until the editorial desk has replied and the issue is closed. Submissions are not used for marketing, not added to a newsletter list, and not shared with any third party. A reader who wants their submission deleted can write to the mailbox with the deletion request, and the editorial desk will confirm deletion within seven working days.

The contact form is the only place on Boomerang where the reader is asked for personal information. The form is optional, and the reader is not required to use it to read the publication. Boomerang's editorial standard is to keep the contact form minimal: an email address, a subject line, and a message body. No additional fields are required, and no fields are marked as required that are not actually needed to reply.

RSS feed and optional newsletter

The publication offers an RSS feed at /sitemap/rss.xml for readers who want to be notified of editorial changes. The RSS feed does not require a reader to provide an email address, sign up to a third-party service, or accept any tracking. Boomerang does not currently offer a direct email newsletter, and any future newsletter offering will be disclosed on this privacy notice before it goes live.

Where Boomerang uses a consent banner for any future optional service, the consent banner will record the reader's choice and honour that choice across visits. Boomerang does not require the reader to accept cookies or tracking as a condition of reading the publication. The publication is free to read with cookies disabled; optional services that require cookies will be clearly labelled in the consent banner.

Data retention policy

Contact-form submissions are retained until the editorial desk has replied and the issue is closed, then rotated on a cadence disclosed in the change log. Server logs are rotated on a separate cadence, also disclosed in the change log. Boomerang does not retain reader data beyond what is needed to operate the publication and respond to reader enquiries, and Boomerang does not build a profile of the reader across visits.

Where Boomerang is required to retain data for a longer period by law (for example, to comply with a regulator's request or a court order), the retention period is the minimum required by law, and the retention is logged in the change log with a date stamp. Boomerang's editorial standard is to be transparent about retention, and a reader who has a question about a specific retention can write to the mailbox.

Children's privacy

Boomerang's content is intended for adults 18 and over, and Boomerang does not knowingly collect any data from readers under 18. If Boomerang becomes aware that a reader under 18 has submitted data through the contact form, the submission is deleted on receipt and the editorial desk takes no further action. A parent or guardian who has reason to believe a reader under 18 has submitted data to Boomerang can write to the mailbox, and the editorial desk will confirm deletion within seven working days.

Boomerang does not serve advertising to readers of any age, and Boomerang does not use any third-party service that builds a profile of a reader under 18 for advertising purposes. The publication's editorial standard is to be safe-by-default for readers of all ages, and the only data Boomerang ever holds is what the reader chooses to submit through the contact form.

How to contact the desk about privacy

Readers who have a question about this privacy notice, a request to delete a contact-form submission, or a request for a copy of any retained submission can use the contact route to reach the editorial desk. The contact form is monitored during the publication's working hours, and a reply is normally sent within two working days. Boomerang's editorial standard is to take every privacy-related submission seriously, and the editorial desk will reply even where the request is not the publication's to fulfil.

Where a reader's question is about a clause in this privacy notice that has since been updated, the change-log route is the right place to compare today's notice against any earlier version. Boomerang does not edit the change log retroactively; the change log is a historical record, and any change to this notice after a date stamp is a change that the reader should evaluate against the version they originally agreed to.

Where this privacy notice applies

This privacy notice applies to the boomerangin.com domain and to every page on the boomerangin.com domain. It does not apply to the platform reached through the first-party redirect; that platform has its own privacy notice, and the reader is bound by the platform's notice when the reader follows the redirect. Boomerang's editorial standard is to be clear about the scope of this notice, and the contact route is the right place to ask a question about a specific page or section.

This privacy notice also does not apply to third-party sites linked from Boomerang's pages. Boomerang links to a small number of third-party sites (the platform's own help page, the platform's responsible-play support routes, and a small set of independent support organisations listed on the responsible-play route). Each of these sites has its own privacy notice, and a reader who follows a third-party link should read the destination site's notice.

A reader who is using a privacy-focused browser, a VPN, or a tracking-protection tool may notice that Boomerang's pages load with fewer third-party requests than a typical commercial page. This is by design; Boomerang's editorial standard is to publish pages that load cleanly under privacy-focused browsers, and the publication does not require any third-party tracking to render correctly.

How changes to this privacy notice are communicated

Material changes to this privacy notice are dated and listed in the change log. A reader who wants to be notified of changes can subscribe to the Boomerang RSS feed at /sitemap/rss.xml. The RSS feed lists every editorial change, including changes to the privacy notice, in the order the changes are published. Boomerang does not currently offer a direct email newsletter; any future newsletter offering will be disclosed on this privacy notice before it goes live.

When the privacy notice is updated, the date stamp at the top of this page is updated to reflect the date of the most recent change. The change log lists the specific change in plain language, and the change is also reflected in the body of this page. Boomerang's editorial standard is to make every change to this notice visible to the reader without requiring the reader to compare versions manually.

A reader who disagrees with a change to this privacy notice can write to the editorial mailbox. The desk replies to privacy-related submissions within two working days, and any change that the desk rolls back is logged in the change log as a separate entry. The desk's editorial standard is to be transparent about privacy changes, and a reader who raises a substantive concern about a change can expect a substantive reply.