Privacy Policy

1. About this policy

This privacy policy explains how ToadOps Pty Ltd (ABN 62 689 868 264) ("ToadOps", "we", "us", or "our") collects, uses, discloses, and protects personal information in connection with our online store, website, ToadTurret application and related services (collectively, the "Service").

ToadOps is an Australian company based in Lowood, Queensland. We are committed to handling your personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2. Information we collect

2.1 Information you provide

• Account information: email address and display name when you create an account
• Contact information: details you provide when contacting us via email or our website contact form
• Purchases: your name, email address, phone number where collected, delivery or pickup details, purchased products and options, order totals, and payment and refund references
• Stock notifications: your email address and the product or option you ask to be notified about. A stock notification request does not subscribe you to our newsletter.
• Newsletter subscription: email address if you subscribe to our newsletter
• Device settings: configuration preferences you set for your ToadTurret device
• Image reports and feedback: report reasons and optional messages you submit when flagging a detection image for review

2.2 Information collected automatically

• Detection images: photos captured by ToadTurret devices when a detection event occurs
• Device identifiers: unique identifiers associated with your ToadTurret device and mobile device
• Location data (optional): approximate or precise location of your ToadTurret device, including GPS-derived coordinates if you choose to use your phone's location, or map coordinates you select manually
• Usage data: information about how you interact with the app, including pages visited and features used
• Device and connection data: device type, operating system version, and app version
• Push notification information (optional): push tokens, subscription details, device name, and client details used to send service notifications when you enable notifications
• Diagnostic data: limited app error messages and technical diagnostics used to detect and fix crashes or reliability issues
• Website requests: connection and browser information, such as your IP address and requested page or resource, processed by hosting, security, font and analytics services when you use our websites

2.3 On-device features

The ToadTurret mobile app uses Bluetooth and WiFi capabilities on your mobile device to communicate with and provision ToadTurret hardware devices. This communication occurs locally between your phone and the ToadTurret device. We do not collect, transmit, or store Bluetooth or WiFi data on our servers.

3. How we use your information

We use the information we collect to:

• Create and manage your account
• Process payments, fulfil purchases, apply prepaid service time, and handle returns, refunds and warranty enquiries
• Send order confirmations and secure order links, coordinate delivery or pickup, and respond to stock notification requests
• Process and display toad detection events and images
• Communicate device status and send notifications
• Manage and configure your ToadTurret devices
• Send you service updates and newsletters (if you have opted in)
• Improve and develop our product and services
• Analyse usage patterns to improve performance and user experience
• Respond to your enquiries and support requests
• Comply with legal obligations

4. Third-party services

We use the following third-party services to operate the Service. These providers may process personal information on our behalf:

• Supabase: authentication, user account management, and database hosting
• Stripe: hosted checkout and payment processing. You enter payment details with Stripe; we receive the order, contact and payment information needed to process your purchase. Our store does not store full payment-card numbers or security codes.
• Resend: transactional email delivery, including order confirmations containing order details, delivery or pickup information and secure order links
• Expo: mobile push notification token handling and notification delivery infrastructure
• Firebase Analytics: mobile app usage analytics (no advertising identifiers or cross-app tracking)
• Google Analytics: usage analytics on our main website. Google Analytics is not currently installed in the store.
• Google Fonts: fonts loaded by our websites from Google's servers
• Cloudflare: website security and protection against automated traffic, including security cookies
• Google Search Console: website performance monitoring
• DigitalOcean: cloud infrastructure and data hosting
• Amazon Web Services (AWS): cloud infrastructure and data storage

For delivery orders, we share the recipient and delivery details needed by the carrier to deliver your purchase.

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

5. Data storage and security

We use DigitalOcean and AWS infrastructure, including storage in Sydney for store product media. Personal information may also be stored or processed outside Australia by the providers listed above, including in the United States and other Asia-Pacific locations. Processing locations depend on the provider and service; not all store or payment information stays in Australia.

We take reasonable steps to protect your personal information from misuse, interference, loss, unauthorised access, modification, or disclosure. These measures include:

• Encryption of data in transit using TLS/SSL
• Secure cloud infrastructure with access controls
• Regular review of our data handling practices

6. Data retention and account deletion

We retain your personal information only for as long as necessary to fulfil the purposes outlined in this policy:

• Account data: retained while your account is active and for a reasonable period after account closure to comply with legal obligations
• Contact and subscription submissions: retained while we respond to your request or manage your subscription, and only for as long as reasonably necessary afterwards
• Purchase records: retained as needed to fulfil and support orders, handle refunds, warranty claims or disputes, and meet accounting and legal obligations. Expiry of a secure order link does not delete the order record.
• Images and sightings: retained in your account for a minimum of 90 days from when they are uploaded or recorded
• Device events: retained in your account for a minimum of 30 days from when they are recorded
• Usage and analytics data: retained in an aggregated or anonymised form

These periods apply while your account remains open, unless you delete the data or request its deletion. Records may be removed after their minimum retention period.

6.1 Account deletion

You may request deletion of your account and personal data at any time by submitting a request through our account deletion page or our contact form.

When your account is deleted:

• Your account details, email address, display name, and device registrations are permanently deleted
• Device settings, event logs, and push notification subscriptions are permanently deleted
• Any registered ToadTurret devices are decommissioned and can no longer communicate with the server
• Detection images captured by your devices are anonymised (all links to your account are permanently removed) and may be retained in a de-identified form for the purpose of improving wildlife detection accuracy
• Sighting records and image flags are anonymised rather than deleted, so that aggregate detection data remains available for conservation purposes

We aim to process deletion requests within 30 days of receipt.

Store purchase records are separate from app accounts. Deleting your app account does not automatically delete your order history. You can request access, correction or deletion of purchase information through our contact form; we may need to retain records for the purposes described above.

7. Cookies and tracking

7.1 Website

Our main website uses Google Analytics and its cookies to understand visits and improve the site. Our main website and store also use security cookies, including Cloudflare bot protection. You can control cookies through your browser preferences.

The store saves your cart in your browser's local storage so it remains available between visits. It contains selected products, options and quantities, rather than payment-card details. Temporary browser session storage helps resume checkout and access your order securely. Clearing this storage may remove your cart or require you to reopen the secure link in your order email.

7.2 Mobile app

Our mobile app uses Firebase Analytics to collect de-identified or pseudonymous usage data such as screen views, feature usage, app performance metrics, and limited error diagnostics. This helps us understand how the app is used and identify areas for improvement.

We do not collect advertising identifiers (IDFA/GAID), and we do not perform cross-app or cross-site tracking. No data collected through the mobile app is used for advertising or shared with ad networks.

8. Children's privacy

The Service is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete that information promptly.

9. Your rights

Under the Australian Privacy Act 1988, you have the right to:

• Access the personal information we hold about you
• Request correction of any inaccurate or incomplete information
• Request deletion of your personal information (see our account deletion page)
• Withdraw consent for optional data collection (such as location data)
• Opt out of marketing communications at any time

To exercise any of these rights, please use our contact form. We will respond to your request within 30 days.

10. Complaints

If you believe we have breached the Australian Privacy Principles, you may lodge a complaint with us through our contact form. We will investigate your complaint and respond within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

11. Changes to this policy

We may update this privacy policy from time to time. If we make material changes, we will notify you via the app or by email. The updated policy will be posted on this page with a revised "Last updated" date.

We encourage you to review this policy periodically.

12. Contact us

If you have any questions about this privacy policy or how we handle your personal information, please contact us: