In effect from 21 September 2026
Privacy policy
This policy explains what Connect Exchange (ABN 12 620 184 867) collects when you use CX8, why we collect it, and what you can do about it.
A business our size is not currently caught by the Privacy Act 1988 (Cth) — the Act exempts most small businesses. We handle your information as though it were, to the standard of the Australian Privacy Principles, because the exemption is about our turnover rather than about how much your information matters.
What we collect
Information you give us
- Your email address. Required. It is how you sign in and how we reach you.
- A display name, if you give one.
- A phone number, if you give one.
- What you publish — your workspace, your listing, and anything else you put into the service.
Information that comes from signing in
- A password hash, if you set a password. We store a hash produced with Argon2, never the password itself.
- Passkeys. If you register one, we store its public key and the identifier your device gives us. The private key never leaves your device and we never see it.
- Sign-in codes, while they are valid.
Information about your sessions
When you sign in we record, against that session: a device label, your browser's user-agent string, and the IP address the request came from. This is what lets you see where you are signed in and sign a device out from somewhere else.
Information from using the service
Ordinary server logs, and records of significant actions on your account — who did what and when — which we keep so that a security question can be answered later.
We do not use advertising or analytics cookies, and we do not track you across other websites. The cookies we set exist to keep you signed in.
Why we collect it
- To give you an account and keep you signed in.
- To confirm you are who you say you are, and to show you your own sessions.
- To publish what you asked us to publish.
- To send you service messages — a sign-in code, a confirmation, a notice about a change like this one.
- To keep CX8 working and secure: rate limiting, abuse prevention, debugging.
- To meet our legal obligations.
We do not sell your personal information. We do not disclose it for anybody else's marketing.
Who else sees it
We use a small number of providers to run the service. They only get what they need to do their part.
- Resend — your email address and the contents of the message, so that it can be delivered.
- Our hosting and database providers — whatever is stored, at rest, because the service runs on their machines.
We may also disclose information where the law requires it, where it is needed to investigate a serious threat to somebody's safety, or to a buyer if the business is sold — in which case this policy continues to apply until you are told otherwise.
Our infrastructure is hosted in Australia today. Some providers operate elsewhere, and as the service grows we may add or move regions — so your information may at times be stored or processed overseas. Wherever it is, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles, and this section is updated when the answer changes.
How long we keep it
We hold things for as long as they are useful and then remove them. Today the periods are:
- Sign-in codes — 10 minutes.
- Access tokens — 15 minutes.
- A signed-in session — 30 days since it was last used.
- The record of a session, after it ends — 30 days.
- Passkey registration challenges — 7 days.
- An account you started and never finished — 30 days.
- A closed account — 30 days, then deleted or de-identified.
- The email address of a closed account — reserved for 90 days, so that nobody else can take it and start receiving your mail.
Your published content is removed when you remove it or when your account is deleted. Backups age out on their own cycle after that.
Keeping it safe
Passwords are hashed with Argon2. Passkeys are supported, and are stronger than a password because the secret never leaves your device. Traffic to CX8 is encrypted in transit. Session cookies cannot be read by scripts in the page, and the public API refuses to read cookies at all so that a request forged from another site has nothing to borrow.
No service is perfectly secure. If a breach occurs that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.
Your choices
You can:
- See and correct most of what we hold, from your account settings.
- Ask for a copy of what we hold about you.
- Close your account, which starts the deletion timetable above.
- Withdraw consent to optional things — though some, like your email address, are needed for an account to exist at all.
Write to legal@cx8.ai and we will respond within 30 days.
If you are not satisfied with how we have handled a privacy matter, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992.
Children
CX8 is not for people under 18 and we do not knowingly collect their information. If you believe a child has given us information, write to us and we will delete it.
Changes
We will update this policy as the service changes. The current version is always here with the date it takes effect, and earlier versions stay readable at their own addresses.
For a change that materially affects how we handle your information, we will give you at least 30 days notice by email before it takes effect.
Contact
legal@cx8.ai, or write to Connect Exchange at PO Box 8, Pooraka SA 5095, Australia.