McCluster Corp · privacy

What we hold.
And what we refuse to.

This covers every McCluster service: the site and the music, the Equity Uprise (formerly the Action Network), the mailing list, and — for business customers — the mailboxes and sites we host. It is written to be read. Where a practice would sound better in vaguer words, the plainer words are used instead.

Last updated 28 October 2026. This update describes the site-entry notice exactly as it now behaves: its entry dialog offers "Not now" as well as "I agree & continue", and you can agree later on this page. It does not change what is collected, so the notice version stays 2026-10-19 and an answer you already gave still stands.

19 October 2026. That update corrected the earlier camera/microphone statement to accurately disclose optional live, recording, and verification features already present. It did not turn on any new audio-room or recording service.

1 · What we collect

What you give us

• An account. Email address and password. The password is hashed by our authentication provider and is never visible to us.
• Your account identity and shipping details. Legal first and last name and a complete mailing address are required to complete a new M Account. They are used for account integrity, abuse prevention, monthly McCluster swag eligibility, and physical fulfillment. Phone and birth year remain optional. The birth year exists because sharing a minor's details is a different legal question from sharing an adult's, and the answer has to be recorded before the ask.
• Your privacy acknowledgement. We record the version of this notice that was presented when you create an account. If you agree to the site-entry notice while signed in, that version and the time are recorded on your account too. The site-entry notice offers two answers, "I agree & continue" and "Not now", and is shown once for each version of this policy: once you have answered it either way (or, on a document page, once its bar has been shown), it does not appear again for that version. Leaving without answering is not an answer, so the next page asks again. That you have seen it and whether you agreed are kept as the notice version in a first-party cookie that McCluster's own sites under mccluster.org share, and, with the time, in this browser's own storage, so the notice does not reappear on another page or another of those sites. Seeing the notice, or answering "Not now", records only that you saw it: "Not now" lets you in, and McCluster's own analytics stay off until you agree. You can agree later on this page.
• What you post. On Equity Uprise: posts, replies, follows, blocks, mutes, your profile photo and anything you attach.
• Purchases. What you bought and the email it is tied to. Card numbers never reach us — Stripe handles payment and we are told only that it succeeded.
• Messages you send us. Enquiries, licensing requests, fellowship applications.
• Media you choose to make or send. Photos, video, microphone audio, livestream contributions, identity-verification clips, and mission proof when you use the relevant features. We distinguish a preview on your device from media you choose to publish or submit.

What your device sends

Every request to any website carries these. We record them rather than pretending they are not there:

What you do here

Which pages you open, which tracks you play and for how long, what you save, search and download, and how far down a page you read. This is what ranks the listening room — the ordering is computed from real listening, not bought.

Camera, microphone and live features

The ordinary browsing and music experience does not require camera or microphone access. Certain optional features do: going live, joining an interactive audio/video session where available, speaking to a voice assistant, recording mission evidence, or making a video required for identity verification or a protected account change. Your device or browser controls access; a feature requests permission when it needs capture. You can deny permission, mute, stop capture or leave that feature. Some services may be unavailable without the required capture.

• Live streams: your camera image, voice and the name or profile you choose to present may be transmitted to the room's permitted audience while you are live. Room titles, host identity, participation and moderation metadata may be stored. Live broadcasting and mission recording are different: where a mission requires recording, the feature captures and uploads video/audio evidence for review; a livestream may also later be published as a post if that publication is authorized.
• Verification: where enabled, a live introduction or account-edit request can capture a video with audio and associated verification information for authorized review. A third-party identity check, if offered, has its own on-screen disclosure before you submit identification documents.
• Voice controls: when you activate a voice feature, speech may be transcribed to provide the requested response. Any additional browser or speech-service processing is subject to the permissions and disclosures shown for that feature.
• Audio-only rooms: multi-person audio rooms are not currently switched on. Before enabling them, we will describe who can listen, moderation, whether recording is available, and any applicable retention or deletion rules.

We do not activate camera or microphone capture merely because you visit the site, and acknowledging this Privacy Policy alone is not consent to start a broadcast or recording. Do not stream or record another person's voice or likeness without the permissions required by the feature and applicable law.

What we do not collect, and will not

• No Google Analytics. No advertising pixels. No Meta pixel, no TikTok pixel.
• No cross-site tracking. Nothing we set is readable by any other website.
• No IMEI, hardware serial number or MAC address. Ordinary web pages do not receive those hardware identifiers. We use a random first-party installation ID instead and do not use canvas/audio/font or transport fingerprinting to recreate a hardware identity.
• No keystrokes, and no reading of what you type. A copy from a page is recorded as having happened; the words are not banked. Anything marked as your own record — your address, your phone — is exempt even from that.
• No access to your contacts or silent background audio/video recording. Camera and microphone are used only in the capture features described above, with device/browser permission. We do not claim that no camera or microphone data is collected.
• Precise device location can be collected when your browser or phone grants location permission. If that permission is already granted, the site may read the location automatically; otherwise a location-aware feature uses the browser's normal permission flow. We may record latitude and longitude, device-reported accuracy and, when supplied by the device, altitude, heading and speed. IP-derived location remains a separate rough signal.
• Nothing is sold. Ever. Not to advertisers, not to data brokers, not to anyone. There is no "trusted partners" clause here because there are none.

2 · How we use it

3 · What is public on Equity Uprise

A social network only works if it is clear what everyone can see. On Equity Uprise:

• Public: your display name, your photo, your posts and replies, and who you follow.
• Only you: your email, your postal address, your phone, your birth year, your purchases, and anything you blocked or muted.
• Blocks and mutes are not announced. The person is not told.
• Live participation: when you broadcast, your image/voice and chosen display identity may be visible or audible to the authorized room audience. Mission livestreams can expose an approximate city-level location if you opt into the corresponding globe visibility; exact device coordinates are not published as a pin. A submitted recording or published clip may remain available after the live session.
• Not public by default: private verification submissions and mission-review evidence are for authorized reviewers unless separately and explicitly published through the relevant workflow.

A removed post is kept as a record of the removal, with the reason, rather than being erased from the account of what was moderated and why.

4 · Who else touches it

Not a vague list of "partners". These are the only companies involved, and exactly what each one does:

Each is a processor: they act on our instructions and may not use your information for their own purposes.

5 · How the services work together

One McCluster account signs you into all of it — the site and Equity Uprise. Your identity, follows and profile travel with you, because they are one system rather than several pretending to be.

What does not travel: a fellowship application does not become marketing, a purchase does not put you on the mailing list, and acknowledging this Privacy Policy does not opt you into marketing, onward sharing or precise location. The mailing list has exactly one door in, and it is the box you tick yourself.

6 · Your rights, and how to use them

Depending on where you live — Connecticut, the rest of the US, the UK, the EU — you have some or all of these. We extend all of them to everyone, because running two standards is how you get one of them wrong:

• Know what we hold about you.
• Get a copy of it.
• Correct it.
• Delete it, including your whole account.
• Withdraw consent at any time, as easily as you gave it.
• Opt out of sale or targeted advertising — trivially, since we do neither.
• Not be discriminated against for exercising any of it.

Email matthew@mccluster.org and say what you want. A person reads it. We answer within 45 days and usually the same week. We will not make you create an account to ask.

Global Privacy Control is honoured. If your browser sends GPC — or the older Do Not Track — we stop recording your IP, your device identifier, your session, and your city and coordinates, automatically and with nothing to click. Country and timezone survive so the counts stay honest.

7 · How long we keep it

8 · Where it is processed

Servers in the United States. If you are in the UK or the EU, using this service means your information is transferred there, under the standard contractual clauses our processors operate with.

9 · Legal requests and preventing harm

We will hand over information if the law genuinely requires it. We will read the request first, refuse one that overreaches, and tell you it happened unless we are legally forbidden from doing so.

We may also act without a request to stop fraud, abuse, or a credible threat to someone's safety.

10 · If you are a business customer

Different relationship, so it is set out separately.

Where we host your mailboxes, domain or site, the contents are yours. We are the processor and you are the controller. We hold what is technically necessary to deliver it: your mail in storage, the logs that prove delivery, and your account and billing records.

If you leave, your data leaves with you: we will export it, and delete our copies within 30 days of your asking.

Analytics on sites we build

Sites we build and host carry McCluster Insight, our own first-party analytics. It records the same things described in section 1 — pages, clicks, scroll depth, device type, rough location — for that site, so its owner can see how it is performing. It replaces Google Analytics rather than adding to it.

• It is first-party. What it stores lives on that site’s own domain and is readable by no other website, including ours.
• It honours Global Privacy Control and Do Not Track before sending anything — checked in the browser and again on our server.
• It is not an advertising pixel. It feeds no ad network, and nothing it collects is sold or shared with anyone outside the site’s owner and us.

When activity is linked across sites, and when it is not. If a site uses M Account sign-in, a signed-in person’s activity there can be joined to their activity elsewhere in the McCluster ecosystem, because it is the same account they chose to sign in with. A visitor who is not signed in is counted on the site they are on and nowhere else — we do not attempt to recognise them across domains by fingerprint, by IP, or by any other means.

11 · Children

This service is not for under-13s and we do not knowingly hold their information. Some things — sharing details onward — are offered only to adults, which is why the birth year is asked. Tell us if a child has made an account and it will be removed.

12 · Changes, and how you will know

The date at the top changes when this does. For a change that materially affects what we collect or who sees it, we will tell you before it takes effect — by email if you are on the list, and on the site if you are not. We will not widen what we collect and let you find out by reading this page again.

13 · Contact

McCluster Corp
matthew@mccluster.org

A person reads it. If you think we have got something wrong here, say so — that is worth more to us than being told the page looks thorough.