Privacy Policy

Last updated: 19 September 2026

Brisbane.Exposed (“we”, “us”) is a 3D suburb explorer that helps people discover and complete local adventures around Brisbane, Australia. This policy explains how we handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), as a matter of good practice.

You can explore the map without an account. An account is only needed if you want completed adventures saved across devices.

What we collect

Depending on how you use the service, we may collect:

Account details — email address, display name, and a hashed password if you create an account with email. If you sign in with Google, we receive the identifier, name, email, and profile image Google shares with us for that sign-in.
Adventure progress — which activities you mark done or dismiss, and the related suburb, so we can restore your map progress when you are signed in.
Session information — cookies or similar tokens that keep you signed in, plus basic request data such as IP address and browser type used to operate security and sessions.
Usage events — product analytics such as suburb opened, activity opened, marked done or dismissed, suburb cleared, sign-in or sign-up, and share. Events may include a suburb slug, activity identifier, and whether you were signed in. They are not used to build advertising profiles.
On-device data — progress and onboarding flags stored in your browser (local storage) so the map can remember what you have seen, even if you browse without an account.

We do not collect photos you take for adventure prompts, payment card details, precise live location, or government identifiers. Challenge copy may ask you to take a photo for yourself; those photos stay on your device unless you choose to share them elsewhere.

How we collect it

We collect information that you provide (for example when you create an account, sign in, or mark an adventure done), that is created as you use the service (sessions, analytics events, stored progress), and that comes from Google if you choose Google sign-in. We also use Cloudflare Turnstile on email sign-in and sign-up to help reduce automated abuse.

Why we collect it

We use this information to:

provide, secure, and improve the explorer and your account;
save and restore adventure progress across devices when you sign in;
understand how the service is used, in aggregated or limited event form;
prevent spam, fraud, and misuse; and
comply with Australian law if we are required to do so.

We do not sell personal information. We do not use it for unrelated direct marketing.

Who we share it with

We use service providers to host and run Brisbane.Exposed, including Cloudflare (Workers, D1 database, Turnstile bot protection, and related infrastructure). If you use Google sign-in, Google also processes that sign-in under Google’s terms and privacy policy.

We may disclose information if required by Australian law, to protect the service or other people, or if the service is transferred as part of a restructure — in which case we would take reasonable steps to keep this policy’s protections in place.

Overseas disclosure

Cloudflare and Google may store or process information on servers outside Australia. By using the service, you understand that personal information may be disclosed to those overseas recipients. We take reasonable steps to deal with reputable providers and to keep information secure, but overseas laws may differ from Australian law.

Storage and security

Account and progress data are stored in Cloudflare D1. Passwords are stored hashed, not in plain text. Session cookies are used to keep you signed in. No method of transmission or storage is completely secure; we take reasonable steps appropriate to a consumer web app of this kind.

How long we keep it

We keep account and progress data while your account is open. If you delete your account, we delete that stored account and progress data, except where we must retain limited records (for example security logs or analytics already collected) for a short period to operate or secure the service, or where Australian law requires retention. Browser local storage remains on your device until you clear it.

Access, correction, and deletion

You can update your password or delete your account from Manage account while signed in. Deleting your account removes your saved progress from our servers. You may also ask us to access or correct personal information we hold about you, or to delete it, by contacting us. We will respond within a reasonable time and may need to verify that the request is from you.

Cookies and similar technologies

We use essential cookies or similar tokens for authentication. Local storage is used for progress and onboarding. Turnstile and Google may set their own cookies when those features run. These are used to operate the service, not to serve third-party ads.

Children

Brisbane.Exposed is a general-audience explorer. It is not directed at children under 16. If you are under 18, a parent or guardian should review this policy and the Terms of Use with you before you create an account.

Complaints

If you have a privacy concern, contact us first and we will try to resolve it. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Changes

We may update this policy as the service or the law changes. The “Last updated” date at the top will change when we do. Continued use after an update means the revised policy applies to that further use.

Contact

For privacy questions, access or correction requests, or complaints, email hello@brisbane.exposed.