Privacy Policy

TGS Pen Pal — Last updated: 11 October 2026

1. Our Privacy Promise

TGS Pen Pal is operated by Julie at This Girl Shines. We create with heart and handle your data with care. This policy covers data we collect when you register for and use the TGS Pen Pal service. We are committed to the Australian Privacy Act 1988 and recognised international standards.

2. What We Collect

Contact information: name and email address provided when you register.
Pen Pal profile data: preferred name, mailing address (used to send physical letters between matched pen pals), letter-tone preferences, focus word, favourite colours, and how you heard about us.
Subscription and payment data: if you pay for a Pen Pal membership, payment is processed by Stripe. We do not store your credit card details — only a Stripe customer/subscription reference and the status of your membership.
Email-deliverability data: whether your email address is syntactically valid, whether its mailbox is reachable, and whether our messages to you have bounced (see Section 5).
Technical data: IP address, browser type, and basic usage logs to keep the service secure and diagnose issues.
Website visit statistics: our public pages (penpalcafe.au and our event sign-up pages) use Umami, an analytics tool we run on our own server. It records the page you viewed, the site that linked you to it, your browser and device type, which buttons you clicked, and your approximate location (country, region and city) worked out from your IP address at the time. It sets no cookies, does not store your IP address, and is not shared with anyone; we use it only to see which pages and links are useful. It is not used inside the member portal.

3. How Your Data is Used

To create and manage your TGS Pen Pal account.
To match you with another member for a letter exchange. Your mailing address is shared only with the members you are paired with in an exchange you opted into: the person you write to and the person who writes to you.
To keep an Address Book for you. After an exchange finishes, each of you can still see the other's current mailing address in your own private Address Book in the portal, so you can write again. Only that pen pal can see it. It is withdrawn if your membership ends or if either of you blocks the other.
To send transactional emails (registration confirmation, match reveal, reminders, and account notifications) from hello@thisgirlshines.com.au.
To process subscription payments via Stripe.
To respond to your support enquiries.
To improve the service based on member feedback.

4. Who We Share Data With

We never sell your data. The only third parties involved in operating TGS Pen Pal are:

Stripe — payment processing for member subscriptions.
Google Workspace — operates the hello@thisgirlshines.com.au mailbox we send transactional emails from, and which the bounce monitor (Section 5) reads delivery-failure notifications from.
Your matched pen pal — receives your full mailing address only when you have actively opted into a specific letter exchange and matching has run for that exchange, and keeps it in their Address Book afterwards (see Section 3).
Hosting and infrastructure providers — used to run the application servers and database.

Some providers (notably Stripe and Google) operate in the United States. By using the service you consent to international data transfer for these specific purposes.

5. Google API Services — Limited Use Disclosure

TGS Pen Pal's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

TGS Pen Pal connects to exactly one Google Workspace account: hello@thisgirlshines.com.au, owned and operated by Julie. The connection is established once via the admin Integrations panel and lives on the operator side only. Members never connect their own Google account to TGS Pen Pal — there is no member-facing Google login or Drive picker. Everything below describes what TGS Pen Pal does with Julie's connected Workspace account.

What Google data we access

Gmail (gmail.readonly) — admin-side only. The bounce monitor reads message metadata in the hello@thisgirlshines.com.au inbox to detect delivery-failure (bounce) notifications produced by recipient mail servers when a transactional email we sent could not be delivered. We do not read regular correspondence or message bodies of human-authored emails — only delivery-status notifications from mail servers.
Google Drive (drive.file, drive.metadata.readonly) — admin-side only. Used by Julie inside the admin panel when she imports a member CSV. The Drive picker shows files in her own connected Drive (hello@thisgirlshines.com.au), and we only read files she explicitly clicks. Members have no access to this surface and no member-uploaded data is ever written to Google Drive.
Google Calendar (calendar) — admin-side only. Used by Julie to publish exchange dates from the admin panel into her own connected Workspace calendar. No member data is written to Calendar; only the public exchange schedule (e.g. "December 2026 — match release Dec 1, letters due Dec 15").

How we use Google data

To complete the specific admin-side feature Julie invoked (CSV import, calendar publish, bounce detection).
To flag a member's email address as undeliverable when our outgoing transactional email has bounced, so we don't keep sending to a dead mailbox.

What we do not do with Google data

We do not transfer Google user data to third parties except as necessary to provide or improve user-facing features, comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to users.
We do not use Google user data for advertising purposes.
We do not allow humans to read Google user data, except (a) with the operator's explicit consent for specific messages, (b) when necessary for security reasons such as investigating abuse, (c) to comply with applicable law, or (d) where the data is aggregated and used for internal operations in line with Google's policies.
We do not use Google user data to develop, improve, or train generalised AI or machine-learning models.

Storage and retention

We do not store the contents of Gmail messages. From bounce notifications we persist only the parsed recipient email address and bounce status, which we use to update the affected member's email-deliverability flag. Drive file contents are read transiently into memory during a CSV import — we save only the parsed member rows (name, email, address, etc.), never the original Drive file. Calendar interactions are write-only (we publish to Julie's calendar; we do not read existing events). Bounce records are retained as part of our admin audit trail and may be deleted on request.

6. Your Choices & Control

You can:

Unsubscribe from non-essential emails at any time via the link in any such message.
Request a copy of the personal data we hold about you.
Request corrections to incorrect data.
Request account deletion. For TGS Pen Pal members, deletion removes your profile, address, and any pending opt-ins. Records of completed exchanges may be retained in anonymised form for service integrity. See how to delete your account.

Operator note (Julie): the connected Google Workspace account (hello@thisgirlshines.com.au) can revoke TGS Pen Pal's API access at any time via the Google Account permissions page. Revoking disables the bounce monitor, Drive import, and Calendar features and affects no member account. Members do not connect their own Google account to TGS Pen Pal, so this is not a member-facing action.

7. Contact Information

Operator: Julie
Email: hello@thisgirlshines.com.au
Location: Brisbane, QLD, Australia