Privacy policy

1About this site

This website is VGNews, the student newspaper at Vista Grande High School in Casa Grande, Arizona. Students report, write, edit, shoot and publish everything on it. A faculty adviser advises the staff and does not approve stories before they run.

Most people who read this site are students, so we collect as little personal information as we can get away with. This page explains what we do collect, why we collect it, and how to reach us about it.

Where anything here conflicts with a policy of Vista Grande High School or the Casa Grande Union High School District, the school's policy controls.

2Who this covers

Three groups use this site:

• readers, meaning anyone who opens a page here
• people who write to us through the submit form or join the newsletter
• staff, the students and the adviser who can sign in to the newsroom

Most of this page is about the first two. The last section of it is about staff accounts.

3What we collect from readers

You can read the entire site without telling us who you are. There is no login, no paywall and no reader account.

Our host records standard server logs: an IP address, a browser string, the page asked for and the time. Every website does this. We use them to keep the site up and to work out what went wrong when something breaks.

The site counts requests per IP address so that one visitor cannot flood it. The counter holds a short key derived from the address and a number, and it expires within minutes.

Reading pages sets no cookies. Cookies are set only when you use a form protected by our bot check, or when a staff member signs in to the newsroom. You can block cookies in your browser and the public site still works.

We do not run advertising, we do not allow ad trackers, and we do not build profiles of individual readers.

4What we collect when you write to us

The submit form takes tips, feedback and story pitches. We receive what you typed. A tip may be anonymous: if you leave the name and email fields empty, we have no way to identify you and we do not try. Feedback asks whether it is about something we published or about the site itself, because the two go to different people.

The newsletter sign-up stores an email address and the date it was added. Nothing else, and we do not send anything from this site; editors download the list and send from the newsroom.

Both forms keep a small ledger of recent submissions, keyed by IP address, so that one sender cannot fill the inbox. It is separate from the submissions themselves, an editor cannot read it, and rows age out of it.

Please do not send sensitive information through this site: no student ID numbers, home addresses, medical details or grades. If you send something like that anyway, we delete it.

5Sources and anonymity

If you tell us something in confidence, we protect your identity in what we publish. An editor has to approve any use of an anonymous source, and we say in the story why the source is not named.

Be clear about what this form is and is not. It reaches a school newsroom over an ordinary encrypted web connection. It is not end-to-end encrypted, we can see what you send, and the ledger above records that a submission arrived from an address, though not which submission it was.

If what you have to say could get you into real trouble, do not use the form. Come to Room 214 and talk to an editor in person.

6What we collect from staff

Newsroom accounts exist so that a small number of approved people can publish. For each account we keep an email address, a hashed password, and a record of what that account has done.

That record is the activity log, and it is deliberately detailed: every sign-in and failed sign-in, every publish, edit and deletion, with the time, the IP address the request came from, the country, the browser and operating system, and whether that account had signed in from that browser before. It exists so an editor can tell a staff member signing in from school from someone who is not, and so a mistake can be traced to the person who made it and undone.

Only editors can read the log. Everyone with an account can see their own recent sign-ins on the newsroom overview.

7What we do with it, and what we never do

We use what is above to run and secure the site, to answer messages, to report stories, to send the newsletter to people who asked for it, and to understand roughly how many people read us. That is the whole list.

We do not sell or rent anyone's information. We do not share it with the school or the district except where the law or school policy requires it. There is no reader account to sign up for and nothing on this site is behind a login.

8Services we rely on

The site depends on a few outside services, each with privacy practices of its own:

• Cloudflare hosts the site, serves it, stores what we publish, and runs the bot check on our forms
• Cloudflare Images stores and delivers every photograph on the site
• YouTube hosts our video. We embed the privacy-enhanced player, which sets no cookies until you press play; once you do, YouTube's own privacy policy applies
• Have I Been Pwned checks a new staff password against known breaches. Only the first five characters of its SHA-1 hash leave this site, and the comparison happens here

9Names, photographs and student work

We are a newspaper, so we name the people we report on, quote them, and photograph them at school events. That is what a paper does, and it is not something you have to opt into for us to report accurately on a public event.

Where a photograph identifies a student, we check the school's media release on file for that student before it runs. Photographs of minors outside a public school event are not published without permission.

If you are a student, a parent or a guardian and you want a photograph, a name or a piece of work looked at again, email news@email.cdespalo.com. Tell us the story and the specific line or picture. We will not always take it down, because a newspaper that unpublishes on request is not one, but we read every request, we answer it, and we fix anything that is wrong.

10Children under 13

This site is meant for high school students, their families and school staff. It is not directed at children under 13 and we do not knowingly collect their personal information. If you believe a child under 13 has sent us something, email news@email.cdespalo.com and we will delete it.

11School records

Nothing sent to this site becomes part of a student's school record, and this site is not a school record system. Education records are governed by the Family Educational Rights and Privacy Act (FERPA) and by school policy, so questions about them belong with the school office rather than with us.

12How long we keep things

• submissions to the inbox: deleted at the end of the school year unless a story is still open
• the submission ledger: rows age out within a day
• newsletter addresses: until you ask to come off the list
• staff accounts: closed within 30 days of a student leaving the staff or graduating
• the activity log: kept, because it is the record of who published what
• published stories, photographs and video: kept indefinitely; see the next section

Server logs and the counters our host keeps are held on its own schedule, which we do not control.

13The archive is permanent

Assume anything printed here is permanent and public even if it later comes down. Search engines and archives keep their own copies, and we cannot reach into those.

14Security

The site is served over HTTPS. Staff accounts are individual, passwords are never shared and are stored only as slow hashes, sign-ins are refused from outside the United States, an account locks itself after repeated wrong passwords, and every attempt is logged.

None of that makes a website perfectly secure, and we cannot promise anything sent over the internet stays private in transit. If you find a security problem here, email news@email.cdespalo.com rather than posting about it. We would rather fix it first.

15Your choices

You can read the site without identifying yourself. You can leave the newsletter at any time by asking. You can ask us what we hold about you, and you can block cookies in your browser.

Depending on where you live, privacy law may give you further rights over your information. Email news@email.cdespalo.com with any request and we will honour it if it is reasonable, whether or not a law requires us to.

16Changes to this policy

When we update this policy we change the "Last updated" date at the top of this page, and we note anything significant on the front page for 30 days.

17Contact

VGNews · Vista Grande High School
General: news@email.cdespalo.com
Room 214, Tuesdays at lunch
1556 N. Arizola Road
Casa Grande, Arizona 85122