Privacy Policy

Effective date: 31 October 2026
Last updated: 2026-10-31

This policy explains what personal information Out'n'About ("we", "us", "our", operated by Lewin Alfie Greenwood, a sole trader (ABN 42 748 420 018) trading as APP OUT'N'ABOUT) collects, how we use it, who we share it with, and the choices you have. It's written to reflect how the App actually works today. Where a feature is planned but not yet live, we say so.

We handle personal information in line with the Australian Privacy Principles under the Privacy Act 1988 (Cth).

1. Information we collect

Account information

When you sign up and use your profile, we collect:

your name and username;
your email address (from your email signup, or from Google/Apple if you sign in with them — see below);
your date of birth (used to confirm you're 18+);
your gender, postcode and preferred language, if you provide them;
a profile picture, if you upload one;
a unique user ID and referral/QR code used to add friends;
a record of your acceptance of our Terms & Conditions and this Privacy Policy — the date and time you accepted at signup and which versions of the documents you accepted.

We do not collect your phone number to create or run a personal account. (Venues that claim a listing provide a business contact number — that's a business record, not a personal login.)

Authentication information

We use Firebase Authentication (a Google service) to manage sign-in by email/password, Google, or Apple. Firebase handles your credentials; we receive an authentication token and basic profile details.
If you sign in with Google or Apple, the provider shares your name and email address with us. If you sign in with Apple and choose Hide My Email, Apple gives us a private relay address instead of your real one. We treat it as your email address; Apple forwards our messages to you and can stop doing so at any time from your Apple ID settings.
If you choose biometric login (fingerprint/face), that check happens on your device only — we never receive or store your biometric data.
We create session tokens to keep you signed in.

Device and notification information

We collect a push notification token (via Firebase Cloud Messaging) so we can send you notifications, and basic device information needed to deliver the App and messages.
The App does not currently run a dedicated analytics or crash-reporting product (for example, we don't use Firebase Analytics or Crashlytics). Google Play Services, Firebase and the app stores may still collect operational and diagnostic data under their own policies. (If we add analytics or crash reporting later, we'll update this policy first.)

Location data

Foreground location: while you use the map and related features, the App uses your device location to show nearby venues and to power presence features. Your location is matched to the nearest venue so we can show live "crowd" indicators and let friends see which venue you're at — venue-level, not a precise point, for those features.
Background location (live): if you enable friend-finding, the App asks for "Always" location permission and reports your location periodically even when the App is closed or your phone is locked, so confirmed friends can find you with Compass. On Android this runs as a foreground service with a persistent notification, so you can always see that it's on. Ghost Mode stops it entirely (see the Location and Compass Policy).
Compass (live): Compass lets a confirmed friend see your precise live position — direction, distance, and a small map with a suggested walking route — and you theirs. When someone opens Compass on you, we notify you (see the Location and Compass Policy). Only your latest known position is stored; we do not keep a location history.
Altitude (barometric): if your phone has a barometer, the App reads air pressure and converts it to an approximate altitude, which is shared along with your position. It's used only to tell a friend whether you're on the same floor, a floor above, or a floor below them — useful in multi-storey venues. Air pressure says nothing about you beyond height; it is stored only as part of your single latest-known position.
Bluetooth proximity (Compass indoors): because GPS is weak inside venues, Compass can use Bluetooth so your phone and a friend's phone detect each other directly. While a Compass session is active, your phone broadcasts a random identifier that changes every few minutes — never your name, device ID, or anything traceable — and only the friend finding you is told what to listen for. Bluetooth runs only during active Compass sessions, never in the background otherwise, and Ghost Mode turns it off completely. Signal strength between the two phones estimates distance; it is used live and the identifier is kept only as part of your latest-known position until it expires or is replaced.
WiFi network hint: if you're connected to WiFi, the App computes a one-way hash of the network's name on your phone and shares only the hash. If it matches the friend's, Compass knows you're probably in the same venue. The readable network name never leaves your device, and we can't recover it from the hash. Not being on WiFi simply means no hint.
Motion sensors (Compass indoors): while the Compass screen is open, the App reads the accelerometer to estimate your steps between GPS fixes and to tell walking apart from dancing (so dancing doesn't move your estimated position). This processing happens on your phone; raw sensor data is never uploaded.
We do not keep a location history. Where live location is stored, we keep only the latest known location (see Data Retention Policy).

Friends and social information

Your friend connections, friend requests, and any users you block. Blocking is used to stop unwanted contact and to gate who can see your presence and location.

Friend groups: group events, the leaderboard and places

Group events and your plans: your friends, and members of a friend group you have joined, can see which upcoming events (the next 14 days) you have RSVP'd to (shown as "Going") or marked as Interested in. Group members see them in the group's events; friends and group members also see them as your plans when they tap you. Events you save stay private: they are never shown to anyone. Nobody you have blocked, or who has blocked you, sees your RSVPs, and nobody sees them while you are in Ghost Mode. Leaving a group stops its members seeing them, unless they are also your friend; removing a friend stops them seeing them, unless you still share a group.
Out'n'About Leaderboard (opt-in, off by default): if you turn on "Show me on the leaderboard", we calculate a score from our records of the venues you've been at, the nights you went out, the specials you redeemed and the events you RSVP'd to and attended, for this week, this month and all time. Members of your friend groups see your score and those four counts, but never which venues, which nights or which specials. We store the score and counts so the leaderboard loads quickly, and recalculate them nightly. If you have not turned it on, none of this is calculated for you. Blocking and Ghost Mode hide you from the leaderboard as they do from the group map.
Group places: any member of a friend group can save a place to that group: a name they choose and the place's map coordinates. Only the group's current members can see it. We keep it until whoever added it, or the group's owner, deletes it, or the group itself is deleted. If the person who added it leaves the group or deletes their account, the place stays with the group (after account deletion we no longer record who added it). Places added by someone you have blocked, or who has blocked you, are hidden from you.

Reels and likes

If you're a venue, the videos and images you upload for events/Reels, and the details you provide (title, description, date, time, ticket link, ticket price).
If you're a patron, which reels you like. Likes are stored against your account so they persist.

Instagram (venues only, optional)

This applies only to venues that choose to connect Instagram in the venue portal. Patrons are never asked to connect Instagram, and nothing is collected until a venue connects. (This feature is built but not yet switched on. We'll keep this section accurate when it is.)

What we collect, with the venue's consent: when a venue connects, Instagram asks the venue to approve access, and we receive access only to that venue's own Instagram business or creator account. We store the account's Instagram user ID and username, and an access token that lets us read the account's posts. The token is encrypted before we store it and is never shown to anyone. From that account we copy posts from the last 60 days: the photos and videos, their captions, links to the posts and the dates they were posted.
What we don't collect: we don't receive the venue's Instagram password, followers, direct messages, comments or likes, and we can't post to Instagram.
Why: to show the venue's own posts on its Out'n'About profile. Videos appear as the venue's Reels and photos join the venue's photo gallery. While connected, we check for new posts about every 6 hours. The venue can hide any imported post from the App at any time in the venue portal.
Retention: we keep the connection while the venue stays connected. Posts we have copied stay on the venue's profile until they are deleted as set out below or the venue chooses to remove them when it disconnects.
Disconnecting: when a venue presses Disconnect, we delete the access token and the stored Instagram user ID and username straight away and stop copying posts. Posts already copied are kept on the venue's profile by default (the venue can hide them) unless, when disconnecting, the venue chooses Also remove my imported posts: then we also delete every post we copied for it, including the photos, videos and Reels made from them and the stored files, straight away. Kept posts stay until one of the deletions below.
Deleting an account: when the account of the person who connected Instagram, or of a venue's last remaining owner, is deleted, we delete that venue's Instagram connection and every post we copied for it, including the photos, videos and Reels made from them and the stored files. Files our storage provider fails to delete straight away are retried every 6 hours until they are gone.
Asking Meta to delete: a venue can also remove Out'n'About from its Instagram settings and ask for its data to be deleted. Meta tells us, and we delete the copied posts, their stored files and the access token for that Instagram account, and give a confirmation code to check that the deletion is complete.
No sale: we never sell Instagram data, use it for advertising, or share it with anyone except as needed to show the venue's posts in the App and to store them with our storage provider.

Chicken Run and games

Chicken Run is a real-world chase game. While a game is in progress, your live location is shared with the other players in that game to power the gameplay. This game location is held in memory on the server only for the duration of the game and is not written to our database or kept afterwards.
Other games (Truth or Dare, King's Cup, Buzz'n, Pub Golf) run largely on your device and don't collect additional personal information beyond normal app use.

Venue interactions

Venues we associate with you through presence (the venue you're near), your favourites, and your reel likes.

Notifications

Records of notifications we send you (title, body, type, status, and a link to the event's or sender's picture where the notification showed one) so the App can show your notification history. This includes the Compass transparency notices ("[name] is using Out'n'About Compass to find you"), so there's a history of who has looked for you.

Content you send us

Anything you upload or submit, any messages you send us for support, and any problem reports you send from the App (which may include diagnostic information if you send them from the diagnostics screen — the report is shown to you before you send it).

2. How we use your information

We use personal information to:

create and manage your account and authenticate you;
show nearby venues, events and Reels, and personalise what you see;
power social features — friends, presence, live friend-finding (Compass), friend groups (including group events and, if you opt in, the leaderboard), likes, and games;
send you notifications you've enabled, including Compass transparency notices;
keep the App secure, prevent fraud and abuse, and enforce our Terms and Conditions and Community Guidelines;
respond to your requests and provide support;
comply with our legal obligations.

3. When we share information

We don't sell your personal information. We share it only:

with other users, as the App is designed to work — for example your profile and username with friends, your venue-level presence with confirmed friends, and your precise live location with a confirmed friend using Compass (all subject to blocking, Ghost Mode, and your privacy settings);
with your friends and members of your friend groups: the upcoming events you've RSVP'd to or marked as Interested in (never the ones you've saved), and, only if you turn the leaderboard on, your leaderboard score and its four counts (friend-group members only; see "Friend groups" above), subject to blocking and Ghost Mode;
with venues, in aggregate/limited form — for example crowd indicators;
with service providers who help us run the App (below);
when required by law, or to protect the rights, safety and property of users, venues, the public, or us.

4. Third-party providers

Google Firebase (Authentication, Cloud Messaging) — sign-in and push notifications.
Google Cloud Storage — hosting uploaded media (venue Reels and images). Note that media is served from public storage URLs so it can stream in the App.
Meta (Instagram API): only for venues that connect Instagram: we send the venue's access token to Instagram to read its own posts and download them. Meta is located overseas.
Google Maps Platform (Maps, Places, Directions) — maps, place data, and the walking routes shown on the Compass mini-map. To fetch a route we send Google the start and end coordinates of that walk.
Google Safe Browsing — when a venue saves an event with a ticket link, we check that URL against Google's Safe Browsing database to protect you from malicious links. Only the URL is sent — nothing about you.
Google / Apple Sign-In — if you choose those login methods.
Background location SDK (Tracelet) — the on-device software that manages background location. It runs on your phone; your location is sent to our servers, not to the SDK vendor.
Email delivery — for verification codes and account emails.

These providers process data on our behalf or as independent controllers under their own privacy policies. Some are located overseas (for example in the United States), which may involve overseas disclosure of your information.

5. Cookies and similar technologies

The App is a mobile application and doesn't use browser cookies in the traditional sense. It stores data locally on your device (for example login tokens, cached media, and your preferences) to make the App work and load faster.

6. Data retention

We keep personal information only as long as we need it for the purposes above, or as the law requires. Live location (including altitude) is kept as latest-known only, with no history, and is deleted immediately when you turn on Ghost Mode. Full details are in the Data Retention Policy.

7. Your rights and choices

Access and correction: you can view and edit much of your information in the App, and you can ask us for a copy of the personal information we hold or to correct it.
Location controls: you can turn location permission off in your device settings; presence and map features won't work fully without it. Ghost Mode (in Settings) stops location sharing with friends entirely — it stops background tracking on your device and deletes your stored position from our servers.
Notifications: you can turn notifications off in your device settings.
Blocking: you can block other users to stop contact and hide your presence and location from them.
Leaderboard: the Out'n'About Leaderboard is off unless you turn it on (Friends tab). Turning it off removes you from every leaderboard straight away and deletes your stored scores.
Deletion: you can ask us to delete your account and associated personal information (see Data Retention Policy).
Complaints: if you're unhappy with how we've handled your information, contact us (below). You can also complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

8. Children

Out'n'About is for people 18 and over. We don't knowingly collect information from anyone under 18. If you believe a minor has an account, contact us and we'll remove it.

9. Security

We use reasonable technical and organisational measures to protect your information, including authenticated APIs and access controls. No system is perfectly secure; if a data breach affects you, we'll respond in line with the Notifiable Data Breaches scheme.

10. Changes to this policy

We may update this policy. Material changes will be notified in the App or by email, and the "last updated" date will change.

11. Contact us

Privacy questions or requests: privacy@outnaboutapp.au.

Related: Location and Compass Policy · Data Retention Policy · Terms and Conditions

To delete your account, see how to delete your account.