Kindling clarity and courage in times of big change

Back

Privacy policy

This policy says what I do with personal information on gregturner.com and in my coaching practice. I keep coaching contact details in my private CRM and calendar tooling.

Who I am

I'm Dr Greg Turner. I live in Melbourne, Victoria, Australia, and I run this website and a coaching practice. Questions about this policy: use the contact page.

What this covers

The coaching contract is the agreement for that professional work: confidentiality, notes, sponsors, fees, and how either of us can stop. This policy is the privacy side of the same practice. If that contract page isn't up when you look, ask and I'll send the current copy. Where the contract is more specific about confidentiality, that wording is the one we work to.

The home page is https://gregturner.com/.

CRM and calendar tooling

I keep coaching contact details in my private CRM and calendar tooling: names, email addresses, organisations, and session times.

The calendar tooling reads Google Calendar so those session times stay in step with the calendar. Connecting a Google account requests:

For events in a window of about 90 days before and after today, that read includes the event id, status, and title, the start and end, whether it is all-day, the organiser's email address, and each attendee's email address and response.

A session time and length go into the CRM when the other person's email is already on file. The connection also stores its OAuth tokens (a refresh token and a short-lived access token), the account email, which calendars to read, and when the last sync ran. An event I exclude keeps its Google id so later syncs skip it. While I reconcile the diary, event titles are visible to me in the admin.

My use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting the account deletes the stored tokens. Access can also be revoked from the Google Account at myaccount.google.com/permissions. Session times already in the CRM stay with the coaching records until they're deleted in the ordinary way.

Coaching and other professional work

The contact details and session times above are how I keep the work. With them I also keep:

Invoices go out through Xero. Credit card payments are taken by Stripe.

I handle that personal information in line with the Australian Privacy Principles.

Notes I keep on paper are destroyed when that notebook is finished, as the coaching contract says. Records in my private practice system stay so I can do the work, answer a later question, handle a complaint, or meet a legal duty (tax records generally for five years).

I don't publish what is said in a session. If a sponsor pays, they only hear what you, the sponsor, and I agreed up front. That is usually attendance and high-level themes, not the content of the session. The contract sets that out.

I take professional supervision. I may talk about themes and my own practice. I don't use your name. Those conversations are themselves confidential.

I may need to share information if there is a serious risk of harm to you or someone else, or if the law requires it (for example a court order). I'll talk with you first when I can.

The website

I don't run a visitor-analytics product, and I don't use advertising cookies.

The site is hosted in Sydney on Fly.io. The host keeps ordinary server logs: IP address, browser, the page requested, and the time. I use those to keep the site up and to fix faults. If a page throws an error, a technical report may go to Sentry. I don't enable the Sentry setting that deliberately attaches personal information.

Fonts load from Google Fonts, so your browser sends that request, including your IP address, to Google. Google's privacy policy applies.

Clicking the plant in the logo sets a first-party cookie, colour_scheme, that remembers the colour for about a day. If a dark-mode control is on, that choice stays in your browser's local storage on your device. It isn't a profile I collect.

The contact page sets a CSRF cookie so the form can be submitted safely. That cookie is for security, not tracking.

Contact form

What you submit (your message, and your name or email if the form asks) is stored in the site database and emailed to me through Amazon SES, so I can reply. The form is protected by Google reCAPTCHA v3. reCAPTCHA sends a token and technical data, including IP address, to Google to reduce spam. Google's Privacy Policy and Terms of Service apply to that.

Newsletter

The footer form posts your email address to Buttondown, who hold the list and send the mail. Buttondown's policy is at buttondown.com/legal/privacy. Every issue has an unsubscribe link.

When I draft a newsletter I sometimes ask Anthropic's API for a one-sentence summary of a post I have already published. That input is my own article text.

Who else handles information

These services process personal information for that work:

I also disclose information if the law requires it, or if you ask me to.

How long I keep it

Access, correction, and deletion

Email me through the contact page. I'll show you what I hold, correct it, or delete it, unless a law says I have to keep it. Google Calendar access is dropped by disconnecting, as described above.

Complaints

Start with me. If you're not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Changes

When this changes, I'll update the date below. The current version lives at /privacy/.

Last updated: 3 November 2026.