This Privacy Policy explains how SafeBuy (the "Service") collects, uses, and protects information when you visit our website or generate a property report. We aim to collect the minimum information necessary to deliver the Service and to keep it secure.

1. Information we collect

a. Account information

When you sign up with email we collect your email address and an encrypted password. Authentication is handled by Supabase; we do not see your raw password at any point.

If you choose "Sign in with Google" we receive only the standard openid, email and profile scopes from your Google account — that is, your email address, your name and your profile picture. We never request access to Gmail, Drive, Calendar, Contacts, Photos, YouTube or any other Google service. The only purpose of this data is to create and authenticate your SafeBuy account and email you when a report is ready. You may revoke SafeBuy's access at any time from your Google account settings, and you may delete your SafeBuy account and all associated data from the account page.

b. Addresses you look up

When you generate a report we record the address or coordinates you search, the lot identifier returned by the government cadastre, and the timestamp of the request. This lets us show your report history, debug failed reports, and monitor service availability.

c. Device & usage data

We log standard web server metadata (IP address, user agent, referrer, timestamps) for security and abuse detection. We may also record anonymous analytics events (pages viewed, report generations, button clicks) to understand how the Service is used.

2. How we use the information

To generate property reports and deliver them to your browser.
To authenticate you and secure your account.
To monitor service availability and detect abuse or fraud.
To contact you about your account (sign-in emails, security alerts, service updates).
To improve the Service based on aggregate usage patterns.

We do not sell your personal information.

3. Third-party services

The Service relies on the following third parties to function. Each has its own privacy policy which we encourage you to read:

Supabase — authentication and database hosting.
Google — optional "Sign in with Google" identity provider (email, name and profile picture only).
Mapbox — geocoding, map tiles, and static map imagery.
Vercel — web hosting for the Service.
Australian Bureau of Statistics (ABS), state, territory and local council spatial endpoints — queried live to return the planning overlays shown in your report.

Cross-origin calls to government endpoints are routed via our server-side proxy so that government services never directly receive your IP address.

4. Cookies and local storage

We use cookies and browser local storage to keep you signed in, remember interface preferences (e.g. last-used council filter), and cache Mapbox tile data so maps load faster on repeat visits. You can clear these at any time via your browser settings.

5. Data retention

We keep account and report-history data for the life of your account. Server logs are kept for up to 90 days. You can delete your account at any time by contacting us (see the Support page) — this removes your profile and all associated history from our systems within 30 days.

6. Security

Traffic to and from the Service is encrypted with TLS. Authentication tokens are stored in HttpOnly cookies. We follow reasonable commercial practices to secure our infrastructure but no system is perfectly secure — you acknowledge this residual risk by using the Service.

7. Your rights

Under Australian privacy law (Privacy Act 1988 & Australian Privacy Principles) you have the right to access the personal information we hold about you, correct it if it is inaccurate, and request its deletion. Contact us via the Support page to exercise any of these rights.

8. Children

The Service is not directed at children under the age of 16 and we do not knowingly collect information from them.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be noted on this page with an updated "Last updated" date. Continued use of the Service after a change means you accept the updated policy.

10. Contact

Questions about this policy? Reach us via the Support page.