Privacy
Last updated: 15 August 2026
Who this covers
This policy covers thomas-johnston.com and mentor.thomas-johnston.com, operated by Thomas Johnston as an individual. If you have any question about your information, contact hi@thomas-johnston.com.
What is collected
If you create an account: your name, email address, whether that email has been verified, and your profile image if you sign in with Google. If you sign in with Google, an access token is stored so the session works. Once signed in: which episodes you have watched and your progress through them, your acknowledgement of the compliance disclosure and when you gave it, any certificate issued to you, and a record of resource downloads. Sessions record an IP address and browser user-agent. Nothing you enter into the dashboard's simulation inputs, capital, contributions, dates, is stored; those are used to compute a result and discarded.
Why it is collected
To sign you in and keep you signed in, to track and resume your course progress, to issue and verify certificates, to keep a record that the compliance disclosure was acknowledged, and to understand in aggregate which content is used.
Analytics
The mentor site uses Google Analytics and the Meta Pixel, which set cookies and share usage data with those providers under their own privacy policies. These record how pages are used; they are not used to make decisions about you individually.
Where it is stored, and who can see it
Data is held in MongoDB Atlas and the site is hosted on Vercel; both may process data outside Australia. Access is limited to the site operator. Information is not sold, and is not shared with third parties except the service providers named in this policy or where required by law.
What is public
A certificate verification link is deliberately public: anyone holding the link can see the name on the certificate, the season completed and the date of completion. Nothing else about your account is publicly accessible. If you would rather your certificate link not exist, ask and it will be removed.
How long it is kept
Account and progress data is kept while your account exists. Disclosure acknowledgements are kept as a compliance record. You can ask for your account and associated data to be deleted at any time.
Your rights
You can request access to the personal information held about you, ask for it to be corrected, or ask for it to be deleted, by emailing hi@thomas-johnston.com. If you are unhappy with how a request is handled, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).
Changes to this policy
This policy may be updated from time to time. The “Last updated” date above reflects the version currently in effect.