The world's first Chinese-language queer museum and archive

Privacy Policy

Who We Are

This website is operated by OUT Museum ("we" or "us"). We are a 501(c)(3) nonprofit organization based in San Francisco, California. For questions about this policy or your personal information, email out@outmuseum.org or mail to 949 Clay Street, San Francisco, California.

This policy explains what information we collect on our website, why we collect it, who we share it with, how long we retain it, and how you can access, correct, or delete it.

What Information We Collect

Information Automatically Recorded While You Browse

Each time you open a page, our servers record an access log, including:

  • Your full IP address;

  • The page address, time, and language of the page accessed;

  • The type and version of your browser and operating system, device type (computer, mobile, or tablet), and the User-Agent string sent by your browser, which is also used to identify automated programs;

  • The referring page address (excluding query parameters) from which you came to our site;

  • Marketing parameters (utm_source, utm_medium, utm_campaign) to understand where visitors come from.

Some of your actions on the page will also be recorded, such as: whether donation or subscription forms appear on the screen, whether they were submitted and whether submission succeeded; whether you finished reading an article; which external links, event registration links, language switcher, or homepage carousel you clicked (external links only record the domain of the linked site); whether embedded content loads successfully; page load speed and performance metrics, as well as the location of script errors (without recording the error content). These action records also include your IP address, browser information, and the visitor cookies mentioned below.

Information You Provide Voluntarily

  • Email Subscription: Your email address, the language and page you were on when subscribing, subscription status, and confirmation time. Subscription requires double confirmation: you must click the link in the confirmation email to complete the subscription.

  • Donations: Your email address, name (optional), donation amount, currency, and time, whether it is a one-time or monthly donation, the name you would like to be acknowledged by or your wish to remain anonymous, and the transaction ID provided by the payment processor. We never see your card number: card numbers are entered directly into Square’s secure input field; when using Apple Pay or Google Pay, card information is stored on your device and digital wallet.

  • Contacting Us: Your email address and message content.

Cookies and Browser Storage

This site only uses our own first-party cookies and does not use any advertising or third-party tracking cookies:

Name

Purpose

Retention

locale

Remembers your chosen website language

1 year

dolores_vid

Access statistics: a random string used to distinguish different visitors and identify return visits. It does not contain your name or email, and scripts on the page cannot read it.

13 months, does not auto-renew upon expiration

dolores_consent

Remembers your cookie banner selection

13 months

Additionally, if you enter the site via a link with marketing parameters, your browser will store these parameters in the current tab’s session storage (sessionStorage), which will be cleared when the tab is closed.

On your first visit, a banner about the statistics cookie will appear at the bottom of the page. The statistics cookie is enabled by default; you can click "Decline", after which we will no longer set or read it for you, and any cookie already set will be deleted when you open the next page. You can change your choice at any time via "Cookie settings" in the footer. If your browser sends a "Global Privacy Control" (GPC) signal, we will automatically treat it as a decline and will not show the banner.

You can also reject or delete cookies in your browser settings, and all website functions will continue to work normally. After rejecting the statistics cookie, visitor numbers will only be roughly estimated from IP addresses and browser information; the server access logs mentioned earlier are not cookies and will still be recorded as usual.

Why We Use This Information

  • Understand website usage: which content is read, which channels bring visitors, which language translations need priority, and where issues arise in donation and subscription processes;

  • Ensure website security, troubleshoot issues, identify and filter automated programs and malicious access;

  • Process your donations, send tax receipts, manage monthly donations and memberships, and acknowledge them as you wish;

  • Send subscription confirmation emails and newsletters you’ve subscribed to;

  • Respond to your inquiries and fulfill legal and tax obligations.

We do not sell, rent, or use your personal information for advertising purposes.

If local laws (e.g., the EU’s General Data Protection Regulation) require stating the legal basis for processing: access statistics and website security are based on our legitimate interest in understanding and improving the site; email subscriptions are based on your consent; donation processing is based on fulfilling your donation request and our legal obligations.

Who Accesses Your Information

We only share information with organizations providing essential services to our site and only provide the necessary parts to complete the service:

  • Amazon Web Services: Hosts our website servers, databases, and images, and sends subscription confirmation emails and newsletters on our behalf (Amazon SES);

  • Square: Processes card, Apple Pay, and Google Pay payments, as well as monthly donations;

  • Proton: Sends donation receipts, membership reminders, and other transactional emails;

  • Google Fonts: Website fonts are provided by Google’s servers; when you open a page, your browser requests font files from Google, which receives your IP address;

  • Spline: The 3D space on the homepage is only loaded from Spline and its content delivery network after you click to load it.

Access logs and page action records are not shared with any third party. Our staff and volunteers can only see aggregated statistics in the admin system; access details with full IP addresses, subscription lists, and donation records are accessible only to administrators, and every viewing of access details and every deletion of records is logged.

If required by law (e.g., court orders), we may need to provide relevant information.

Retention Period

  • Access and Page Action Records: Retained long-term for year-over-year comparison of website usage. You can request deletion at any time (see below).

  • Email Subscriptions: Retained until you unsubscribe. After unsubscribing, we retain your email and unsubscribe date to ensure no further emails are sent.

  • Donation Records: Retained for the duration required by U.S. tax and accounting regulations.

  • Inquiries: Retained until processing is complete and for as long as necessary thereafter.

Your Rights

  • Unsubscribe: Each newsletter includes an unsubscribe link at the bottom, or you can email us directly.

  • Manage Monthly Donations: At the bottom of every monthly donation receipt is a link to manage your monthly donation, where you can cancel it or change your card yourself.

  • Access, Correction, and Deletion: Email out@outmuseum.org to request access, corrections, or deletion. To delete access records, provide the IP address used when visiting our site; we will delete all access and action records for that IP address, as well as records for the same visitor ID under other IPs.

Note: If you share a network (e.g., home, office, or event Wi-Fi), other users may also have records under the same IP address, which will be deleted along with yours. Donation records must be retained for tax purposes and cannot be deleted, though corrections can be made.

If you are in the EU or UK, you also have the right to object to or restrict our processing of your information, request data portability, and lodge complaints with your local data protection authority.

Cross-Border Data Transfer

We are based in the U.S., and our servers and service providers are primarily located there. If you access our site from another country or region, your information will be transferred to and processed in the U.S.

Children

This website is not intended for children under 13, and we do not intentionally collect their personal information. If you believe we have collected information from a child, please contact us, and we will delete it.

Security

The entire site uses HTTPS encryption for data transmission; card information is processed directly by Square and does not pass through our servers; admin accounts have tiered permissions, and sensitive operations are logged. However, no network transmission or storage can be guaranteed absolutely secure.

Policy Updates

We will publish updates to this policy on this page and update the date below. For significant changes, we will notify you via the website or newsletters when possible.

Last updated: October 18, 2026