Privacy Policy

1. About this policy

This privacy policy explains how ToadOps Pty Ltd (ABN 62 689 868 264) ("ToadOps", "we", "us", or "our") collects, uses, discloses, and protects personal information in connection with the ToadTurret application and related services (collectively, the "Service").

ToadOps is an Australian company based in Lowood, Queensland. We are committed to handling your personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2. Information we collect

2.1 Information you provide

• Account information: email address and display name when you create an account
• Contact information: details you provide when contacting us via email or our website contact form
• Newsletter subscription: email address if you subscribe to our newsletter
• Device settings: configuration preferences you set for your ToadTurret device
• Image reports and feedback: report reasons and optional messages you submit when flagging a detection image for review

2.2 Information collected automatically

• Detection images: photos captured by ToadTurret devices when a detection event occurs
• Device identifiers: unique identifiers associated with your ToadTurret device and mobile device
• Location data (optional): approximate or precise location of your ToadTurret device, including GPS-derived coordinates if you choose to use your phone's location, or map coordinates you select manually
• Usage data: information about how you interact with the app, including pages visited and features used
• Device and connection data: device type, operating system version, and app version
• Push notification information (optional): push tokens, subscription details, device name, and client details used to send service notifications when you enable notifications
• Diagnostic data: limited app error messages and technical diagnostics used to detect and fix crashes or reliability issues

2.3 On-device features

The ToadTurret mobile app uses Bluetooth and WiFi capabilities on your mobile device to communicate with and provision ToadTurret hardware devices. This communication occurs locally between your phone and the ToadTurret device. We do not collect, transmit, or store Bluetooth or WiFi data on our servers.

3. How we use your information

We use the information we collect to:

• Create and manage your account
• Process and display toad detection events and images
• Communicate device status and send notifications
• Manage and configure your ToadTurret devices
• Send you service updates and newsletters (if you have opted in)
• Improve and develop our product and services
• Analyse usage patterns to improve performance and user experience
• Respond to your enquiries and support requests
• Comply with legal obligations

4. Third-party services

We use the following third-party services to operate the Service. These providers may process personal information on our behalf:

• Supabase: authentication, user account management, and database hosting
• Resend: transactional email delivery
• Expo: mobile push notification token handling and notification delivery infrastructure
• Firebase Analytics: mobile app usage analytics (no advertising identifiers or cross-app tracking)
• Google Analytics: website usage analytics
• Google Search Console: website performance monitoring
• DigitalOcean: cloud infrastructure and data hosting
• Amazon Web Services (AWS): cloud infrastructure and data storage

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

5. Data storage and security

Your data is primarily stored on servers located in Australia (DigitalOcean and AWS Sydney regions). Some data may be processed by third-party services hosted in other regions, including but not limited to the Asia-Pacific region (e.g. Tokyo) and the United States, where required for service operation.

We take reasonable steps to protect your personal information from misuse, interference, loss, unauthorised access, modification, or disclosure. These measures include:

• Encryption of data in transit using TLS/SSL
• Secure cloud infrastructure with access controls
• Regular review of our data handling practices

6. Data retention and account deletion

We retain your personal information only for as long as necessary to fulfil the purposes outlined in this policy:

• Account data: retained while your account is active and for a reasonable period after account closure to comply with legal obligations
• Contact and subscription submissions: retained while we respond to your request or manage your subscription, and only for as long as reasonably necessary afterwards
• Detection images: retained while your account is active as part of the service
• Usage and analytics data: retained in an aggregated or anonymised form

6.1 Account deletion

You may request deletion of your account and personal data at any time by submitting a request through our account deletion page or our contact form.

When your account is deleted:

• Your account details, email address, display name, and device registrations are permanently deleted
• Device settings, event logs, and push notification subscriptions are permanently deleted
• Any registered ToadTurret devices are decommissioned and can no longer communicate with the server
• Detection images captured by your devices are anonymised (all links to your account are permanently removed) and may be retained in a de-identified form for the purpose of improving wildlife detection accuracy
• Sighting records and image flags are anonymised rather than deleted, so that aggregate detection data remains available for conservation purposes

We aim to process deletion requests within 30 days of receipt.

7. Cookies and tracking

7.1 Website

Our website uses cookies and similar technologies, including Google Analytics, to understand how visitors use our site and to improve your experience. You can control cookie settings through your browser preferences.

7.2 Mobile app

Our mobile app uses Firebase Analytics to collect de-identified or pseudonymous usage data such as screen views, feature usage, app performance metrics, and limited error diagnostics. This helps us understand how the app is used and identify areas for improvement.

We do not collect advertising identifiers (IDFA/GAID), and we do not perform cross-app or cross-site tracking. No data collected through the mobile app is used for advertising or shared with ad networks.

8. Children's privacy

The Service is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete that information promptly.

9. Your rights

Under the Australian Privacy Act 1988, you have the right to:

• Access the personal information we hold about you
• Request correction of any inaccurate or incomplete information
• Request deletion of your personal information (see our account deletion page)
• Withdraw consent for optional data collection (such as location data)
• Opt out of marketing communications at any time

To exercise any of these rights, please use our contact form. We will respond to your request within 30 days.

10. Complaints

If you believe we have breached the Australian Privacy Principles, you may lodge a complaint with us through our contact form. We will investigate your complaint and respond within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

11. Changes to this policy

We may update this privacy policy from time to time. If we make material changes, we will notify you via the app or by email. The updated policy will be posted on this page with a revised "Last updated" date.

We encourage you to review this policy periodically.

12. Contact us

If you have any questions about this privacy policy or how we handle your personal information, please contact us: