← Back to Crowdz

Privacy Policy

Crowdz ("we", "us", "our") operates the Crowdz crowd-level reporting application. This Privacy Policy explains how we collect, use, store, and protect your personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. What Information We Collect

1.1 Account Information

When you create an account, we collect your email address, chosen username, and account type (individual or business). Business accounts may also provide a business name and ABN.

1.2 Crowd Reports

When you submit a crowd-level report, we collect the location name, your crowd-level rating (1-5), a timestamp, and your username (or "Anonymous" if you choose anonymous reporting). If you report anonymously, your username is replaced with "Anonymous" in the public report and is not visible to other users. A hashed device fingerprint is still processed server-side for rate limiting and abuse prevention, but is not published or linked to the displayed report.

1.3 Discount Interactions

If you accept or redeem a business discount, we record the interaction type (viewed, accepted, scanned) using a non-identifying reference that is not linked back to your identity in data shared with businesses.

1.4 Device Information

We collect a hashed device fingerprint (screen size, timezone, platform) for rate limiting and fraud prevention. This fingerprint is used to detect abuse patterns across both signed-in and anonymous reports. It is not used to identify you personally and is not shared with other users or businesses.

2. How We Use Your Information

• Crowd-level display: Reports are aggregated to show crowd levels at locations. Recent reports are weighted substantially more heavily than older ones so the displayed level reflects the latest conditions. When no live reports exist for a location, an "Estimated" level may be shown based on anonymised historical averages. Individual reports are never displayed to public users in a way that identifies a specific user's location.
• Trend indicators: We compare recent and older reports at a location to show short-term trend direction (e.g. "Getting busier" or "Getting quieter"). This analysis uses only the aggregate crowd-level values and timestamps — no personal data is involved.
• Nearby location influence: A crowd report submitted at one named location may contribute a small, distance-weighted influence to the displayed crowd level of geographically close locations (within approximately 500 metres). This spillover uses only the aggregated crowd-level value for the source location and its stored map coordinates — it does not involve any user's personal identity, device fingerprint, or GPS coordinates. The influence decays with distance and is weighted far below live reports at the target location.
• Fraud prevention: Device fingerprints and GPS data help us detect and prevent fake or manipulative reports. For anonymous reports, GPS data is used solely for real-time verification and is immediately discarded — it is never stored or linked to the report.
• Business analytics: Aggregated discount performance data is shared with business accounts. No individual user data is shared with businesses.
• Service improvement: We use aggregated, de-identified data to improve the accuracy and reliability of Crowdz.
• Communication: We send onboarding emails and service updates to your registered email address. You can unsubscribe at any time.

3. Anonymisation and Aggregation

Crowd data shown on the public map, including heatmaps, is always aggregated. We do not display individual user locations to other users on public maps or heatmaps. All crowd levels shown represent the combined reports of multiple users at a named location. A minimum of 3 reports is required before any live crowd estimate is displayed. For security and abuse prevention, authorised admins may view recent exact location pings in a restricted internal admin-only map.

To smooth short-term fluctuations and provide a best-guess "Estimated" crowd level for locations with no recent live reports, Crowdz also maintains a rolling aggregated hourly summary for each named location (for example: "Highpoint Shopping Centre, Monday 2pm slot: total of all reported crowd levels, number of reports"). This summary contains no usernames, no avatars, no reporter keys, no device fingerprints, no IP addresses, no GPS coordinates, and no individual report rows — only per-location, per-hour totals. Individual reports cannot be reconstructed from it.

4. Data Storage and Retention

• Crowd reports (raw): Stored temporarily and automatically expire based on a configurable time window (default: 30 minutes). Expired reports are anonymised and may be retained in aggregated form (see next item) for analytics, abuse detection, and service improvement. Personal identifiers are removed.
• Aggregated hourly crowd summaries: Per-location, per-hour totals (sum of reported crowd levels and count of reports) are retained for up to 35 days so we can compute historical baselines such as "same hour last week" and short-term trend direction. These summaries contain no identifiers and cannot be used to identify any individual user.
• Account data: Stored securely in an encrypted database for as long as your account exists.
• Discount interactions: Retained for business analytics purposes using a non-identifying reference.
• GPS data: Held in server memory only, never written to disk, and discarded after use (within 30 minutes).
• Device fingerprints: Retained in hashed form for the period necessary to detect abuse patterns across reports.

5. Anonymous Mode

Crowdz provides an anonymous reporting mode that you can enable at any time. When anonymous mode is active:

• Your username is replaced with "Anonymous" on all public reports and is not visible to other users.
• Your avatar is not shown alongside your reports.
• Reports are not publicly linked to your account.
• Your GPS coordinates may still be collected momentarily for real-time fraud verification, but are not stored with the report and are discarded after use. The approximate location derived from these coordinates is used only to confirm you are physically near the place you are reporting — it is never stored, never linked to your identity in any retained data, and never shared with any other user or third party. Even anonymous users' location data is processed this way.
• A hashed device fingerprint is still processed server-side for rate limiting and abuse prevention. It is not displayed on the report and is not used to identify you personally.

Anonymous users can view all crowd data and discounts, but must disable anonymous mode to redeem discounts. This prevents fraud while preserving your right to browse privately.

5a. Location Services Toggle

In addition to anonymous mode, Crowdz provides a Location Services toggle in your account settings. When you turn off Location Services:

• Crowdz will stop requesting your GPS coordinates for background location tracking and crowd-level estimation based on your physical presence.
• Your device will no longer send periodic location pings to our server.
• You can still submit manual crowd reports; however, GPS verification may not be possible, which means some fraud-prevention checks may apply more conservatively.
• This setting is stored locally on your device and takes effect immediately. You can re-enable location services at any time from the same settings panel.

Turning off Location Services does not affect any previously submitted reports or your account data. If anonymous mode is also enabled, neither your identity nor your location will be transmitted during background activity.

6. Account Deletion

You may delete your account at any time from your account settings. When you delete your account:

• Your profile, email, username, saved preferences, and authentication data are permanently deleted.
• Any active crowd reports you have submitted are updated to show "Anonymous" instead of your username, so they can no longer be attributed to you.
• Past discount interactions are anonymised (the link between the data and your identity is removed) to preserve the accuracy of aggregated data.
• This action is irreversible.

7. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information to third parties. We may share data only in these circumstances:

• Business analytics: Aggregated, de-identified discount performance statistics are shared with the business that posted the discount.
• Legal requirements: If required by Australian law, a court order, or a regulatory authority.
• Safety: To prevent fraud, abuse, or threats to user safety.

8. Your Rights Under the Australian Privacy Principles

Under the APPs, you have the right to:

• Access your personal information held by us.
• Request correction of inaccurate or outdated information.
• Delete your account and associated personal data at any time.
• Opt out of non-essential data collection by enabling anonymous mode.
• Complain to the Office of the Australian Information Commissioner (OAIC) if you believe your privacy has been breached.

9. Data Security

We take reasonable steps to protect your personal information from misuse, interference, loss, and unauthorised access. These measures include:

• Secure password hashing (never stored in plain text).
• HTTPS encryption for all data in transit.
• Encryption at rest for account data.
• IP-based access restrictions for administrative functions.
• Two-factor authentication for admin accounts.
• Least-privilege access controls and administrative access logging.
• Rate limiting and device-based fraud detection.

10. Cookies and Local Storage

Crowdz uses browser local storage to remember your preferences (such as anonymous mode, saved locations, and accepted discounts). We do not use third-party tracking cookies. Session cookies are used solely for authentication.

11. Children's Privacy

Crowdz is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

12. Technical Data Collection

12.1 Location Data

When you use Crowdz with location services enabled, we may collect approximate GPS coordinates to verify that reports come from users near the reported location. This data is used only for report verification and fraud prevention. It is held in server memory only, not written to disk, and discarded after use (within 30 minutes). When anonymous mode is enabled, GPS may still be used momentarily for fraud verification but is not stored with the report and is not linked to your identity in any published data. The approximate location of anonymous users is processed in the same way — it is used solely to confirm proximity to the reported location and is immediately discarded; it is never stored, attributed, or shared. Access to recent live location pings is limited to authorised admins through a restricted internal tool for safety, moderation, and anti-abuse operations.

12.2 Network and Request Data

Standard server logs may record IP addresses, request timestamps, and browser user-agent strings for operational and security purposes. These logs are rotated regularly and are not linked to your user account.

12.3 Map Technology

The Crowdz map is powered by Leaflet.js, an open-source JavaScript mapping library. Map tiles (the background imagery you see) are served by CARTO using data from OpenStreetMap contributors. When the map loads tiles, your browser makes standard HTTPS requests to CARTO's tile servers; these requests include tile coordinates and your IP address, as is standard for any web map. No personal account data or crowd report data is included in tile requests. Crowdz does not share any user data with Leaflet, CARTO, or OpenStreetMap beyond what is inherent in a normal tile load. You can review CARTO's privacy policy at carto.com/privacy and OpenStreetMap's at wiki.osmfoundation.org/wiki/Privacy_Policy.

12.4 Bot Protection

To prevent automated abuse of sign-up, login, password reset, and other sensitive forms, Crowdz uses Cloudflare Turnstile on the web. When you submit one of these forms, your browser loads a script from challenges.cloudflare.com which performs a lightweight, mostly invisible check to confirm you are a real person rather than a bot. Cloudflare may receive technical signals such as your IP address, browser user-agent, basic device characteristics, and a challenge token. Crowdz does not send your account details, password, email, or crowd report data to Cloudflare. The Cloudflare check returns a single yes/no result to the Crowdz backend, which is then discarded. You can review Cloudflare's privacy practices at cloudflare.com/privacypolicy.

In future versions of the Crowdz mobile app distributed through Google Play, the equivalent check will be performed using Google Play Integrity API, which verifies that the app is a genuine, untampered build running on a real Android device. Play Integrity is provided by Google and may receive a Google Play services device token; it does not receive your account data. You can review Google's relevant terms at policies.google.com/privacy.

12.5 Email Delivery

Verification codes, password reset links, and the welcome email series are delivered through a third-party SMTP email provider configured by Crowdz. The provider receives your email address and the message contents in order to deliver the email, which is normal for any email service. Email metadata (such as opens, where measurable via a tracking pixel) is used only to evaluate whether onboarding emails are reaching real inboxes and is not sold or shared.

12.6 Hosting and Backend Infrastructure

The Crowdz backend is hosted on a third-party cloud platform (currently Render). Standard server logs (IP address, request path, timestamp, user-agent) are generated as part of normal operation and are retained for a short period for security, debugging, and abuse-prevention purposes. Account data, crowd reports, and progress are stored in a managed PostgreSQL database operated by the same hosting provider. Data is not sold or shared with third parties beyond the limited technical providers listed in this policy.

12.7 Future Mobile App Distribution

If you install the Crowdz Android app from Google Play, the app communicates with the Crowdz backend over HTTPS using the same APIs described in this policy. Account information, achievements, and progress are stored on the Crowdz backend and not solely on your device, so they are preserved across app updates and reinstalls. App updates distributed through Google Play do not erase or reset your account.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the app or email. The "Last updated" date at the top of this page indicates when the policy was last revised.

14. Contact Us

If you have questions about this Privacy Policy, wish to exercise your rights, or want to make a complaint, you can reach us through the "Report an issue" feature in the app, or by contacting us via the email address associated with your account.

You may also contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au if you are not satisfied with our response.